سياسة الخصوصية وحماية البيانات

1. Data controller

Beauty Star Medical Company (Beauty Star Clinics), Commercial Registration 4030432423, VAT number 310999887100003, Yab Business Center, 7850 Prince Sultan Road, Al Khalidiyah, Jeddah 23423.

For questions about your data: info@beautystar.com.sa or the unified number 9200 24880.

2. What we collect and how

We only collect what you enter yourself in the website forms:

• Booking and call-back forms: name, mobile number, requested service, preferred doctor, branch, date and time, and a convenient call time.
• Customer account: name, mobile number, and email if you add it (optional).
• Orders and payments: selected services, amounts, order number, and the payment transaction ID, status and date.
• Technical data needed to protect the website: your IP address in hashed form to prevent abuse and repeated submissions, and a log of important actions.

The website forms do not ask for health information. If you write health information in your notes, it is treated as sensitive data and used only to contact you about your request.

3. Why we use your data

• To receive your booking request or order and contact you to confirm the appointment.
• To process and verify online payments and handle refunds and disputes.
• To manage your account and show your bookings, orders and points.
• To answer enquiries and complaints.
• To protect the website, prevent fraud, and meet legal obligations.

We do not use your data for a purpose other than the one it was collected for, unless you consent or the law permits it.

4. Marketing messages

The website does not send marketing messages, and accepting the terms or agreeing to be contacted about your request is not consent to marketing. If marketing messages are introduced in the future, they will only be sent after a separate, optional consent from you, with a clear way to stop them at any time.

5. Sharing

We do not sell personal data. We share only the minimum needed with:

• The Moyasar payment gateway, when you pay online, to process and verify the payment.
• The hosting provider that runs the website and its database.
• The mobile verification service used for customer sign-in, when enabled; it receives only your mobile number to send the verification code.
• The clinic's medical and administrative team, to provide the service.
• Competent government authorities when the law requires it.

Where a technology provider's servers are outside Saudi Arabia, this is done in line with the legal rules on transferring personal data.

6. Card and payment data

Card details are entered in the payment form provided by the Moyasar gateway and are sent directly from your browser to the gateway. Card numbers and security codes (CVV) never reach the website's servers and are not stored by us. We keep only the payment transaction ID, status, amount and date to follow up the order, refunds and disputes. The gateway processes card data under its own policy.

7. Cookies and browser storage

The website only uses what it needs to work:

• A session cookie when you sign in, to keep you securely signed in.
• Local storage in your browser for your cart contents and language choice.

The website does not currently use third-party analytics, advertising or tracking tools. If any are added in the future, this policy will be updated before they are enabled, and names, mobile numbers or health information will not be sent to them.

8. Retention and deletion

We keep data for as long as needed for the purpose it was collected for, or for the period the law requires for medical and financial records. After that, the data is deleted or anything that identifies you is removed. Appropriate access and security controls apply throughout.

If your data is affected by a breach, we will notify you and the competent authorities as the law requires.

9. Your rights

Under the Personal Data Protection Law, you have the right to:

• Know how and why your data is collected.
• Access your data and obtain a copy.
• Ask for your data to be corrected, completed or updated.
• Ask for data that is no longer needed to be deleted, subject to mandatory retention periods.
• Withdraw your consent at any time.

To exercise these rights, email info@beautystar.com.sa or call 9200 24880. We may ask you to verify your identity first, and we respond within the period set by the regulations. You can also ask us the same way to close your website account at any time. You may also file a complaint with the authority responsible for personal data protection.

10. Changes

Any change to this policy is published on this page with the date of the last update.