Privacy Policy
Privacy Policy
1. Introduction
Cycles Healthcare Technology ('Cycles', 'we') is committed to protecting the privacy and security of data handled through its Revenue Cycle Management platform, in accordance with Saudi Arabia's Personal Data Protection Law (PDPL) and applicable health sector regulations.
This policy applies to all users of the Cycles platform, including private healthcare providers and government health clusters.
2. Data We Collect
Account data: name, work email, job title, and organization name.
Operational data: claims records, insurance coverage data, and NPHIES integration outputs as transmitted by your HIS system.
Usage data: login records, session activity, and user actions within the platform for support and improvement purposes.
Health and claims data transmitted through the platform is classified as sensitive personal data under PDPL. It is processed under heightened protection controls and only within the scope of the agreed service.
We do not collect direct patient health records outside of what is passed through approved integration channels.
3. Purpose of Processing
Delivering Revenue Cycle Management services and maintaining platform performance.
Automating claims workflows and coverage validation via NPHIES.
Providing executive dashboards and operational reports.
Supporting issue resolution and responding to support requests.
Complying with regulatory requirements from MOH, CCHI, and SDAIA.
4. Legal Basis for Processing
Cycles processes personal data on the following legal bases as defined under PDPL:
Contract performance: processing necessary to deliver the agreed RCM services.
Legal obligation: processing required to comply with MOH, CCHI, NPHIES, and SDAIA regulatory requirements.
Legitimate interest: processing for platform security, fraud prevention, and service improvement, balanced against data subject rights.
Where processing relies on consent, that consent may be withdrawn at any time by contacting privacy@cycles.sa.
5. Data Sharing
We do not sell or share client data for marketing purposes.
Data may be shared with Saudi healthcare regulatory bodies only where legally required.
Supporting technology service providers may process data under binding confidentiality and data processing agreements.
All data processed by Cycles remains within the Kingdom of Saudi Arabia. We do not transfer personal data to servers or entities outside the Kingdom except where explicitly required by law or agreed in writing with the client.
6. Data Security
Technical and organizational controls are in place to protect data from unauthorized access, disclosure, or manipulation.
The platform supports enterprise Single Sign-On (SSO) via Microsoft Entra ID for access control.
Security practices are reviewed periodically in alignment with SDAIA and PDPL requirements.
In the event of a personal data breach, Cycles will notify SDAIA within 72 hours of becoming aware of the incident. Affected organizations will be notified without undue delay where the breach is likely to result in risk to their rights.
7. Retention
Operational data is retained for the contract duration and up to 36 months following termination, or as required by applicable health sector compliance requirements.
Organizations may request deletion of their data following contract end through the defined process.
8. Your Rights
Under PDPL, you have the right to:
Access personal data we hold about your organization and its users.
Correct inaccurate or incomplete personal data.
Request deletion of personal data where no legal basis for retention exists.
Request a portable copy of your data in a structured, machine-readable format.
Object to or restrict certain types of processing.
Withdraw consent where processing is based on consent.
We will respond to all rights requests within 30 days of receipt. Requests can be submitted to: privacy@cycles.sa
You may also file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) at: sdaia.gov.sa
9. Cookies
The Cycles platform website uses only essential cookies necessary for navigation, locale preferences, and secure session management.
No advertising or third-party tracking cookies are used.
By continuing to use the website, you acknowledge the use of these essential cookies as described in this policy.
10. Contact
For questions about this policy or our data handling practices, contact us at: privacy@cycles.sa
11. Updates
This policy may be updated to reflect new regulatory requirements or service changes. Registered clients will be notified of any material changes.