Privacy Policy
How DHAT collects, uses, and protects data.
This policy explains how DHAT handles personal data when you use our website or our platform. We treat mental healthcare data as among the most sensitive data there is, and we design our systems on that basis.
Who we are, and our role
DHAT is a software platform provided to licensed psychiatric clinics in Saudi Arabia, operated by DHAT under Commercial Registration No. 1010687423, Riyadh.
The clinic is the controller of its patients' data; we act as a processor on the clinic's behalf, following its instructions and our agreement with it.
For visitors to this website and people who request a demo, we are the controller of that data.
What we collect, why, and for how long
We collect the minimum needed to provide the service. The table below sets out each category of data together with the reason we hold it, the legal basis under the Personal Data Protection Law, and how long it stays with us.
| Data | Why we hold it | Legal basis | Retention |
|---|---|---|---|
| Demo requests — name, clinic name, work email, mobile number, number of clinicians | To respond to you and arrange a demo | Your consent | 24 months from our last contact with you |
| Platform accounts — name, email, role and permissions | To operate the platform for your clinic and control access | Performance of the agreement with your clinic | Life of the agreement, then 90 days |
| Clinical data entered by the clinic | To deliver the service the clinic has asked us to deliver | The clinic's instruction, under the clinic's own legal basis | The clinic's retention policy and the legal requirements for medical records |
| Access logs — time of access, type of event, account involved | To protect accounts, detect unauthorised use, and answer questions about who saw what | Our legitimate interest in securing the service, and legal obligation | 12 months |
| Where we rely on your consent you may withdraw it at any time. Withdrawing consent does not affect processing that already took place while it was given. | |||
Sharing data
We do not sell personal data, rent it, or use it for advertising.
We rely on a small number of sub-processors to run the service. Each works under a contract requiring it to protect the data and process it only on our instructions. We will name the current providers on request, and we tell clinics before adding a new one that handles their data.
We may also disclose data to a competent authority where there is a binding legal request.
| Category | What it does | Where data is held |
|---|---|---|
| Infrastructure and hosting | Runs the application and its databases | As set out in your clinic agreement |
| Transactional email | Sends account and notification email | As set out in your clinic agreement |
| Error and performance monitoring | Reports faults so we can fix them | As set out in your clinic agreement |
| The named list current at any time is available from privacy@dhat.sa and is attached to each clinic agreement. | ||
Where data is held and transferred
Hosting arrangements and the location where data is held are set out in the agreement with each clinic.
Data is not transferred outside the agreed scope except as permitted by applicable law and with appropriate safeguards in place.
Automated processing and AI
DHAT uses AI to help clinicians document their work. It drafts session notes and summaries from information already in the record.
Every AI output is an unsigned draft. It does not enter the medical record until a clinician has reviewed it, edited it if needed, and signed it. The final content is what the clinician writes.
The AI does not make diagnostic decisions, does not decide treatment, and does not produce any decision that has a legal or similarly significant effect on a patient without a clinician acting on it.
We do not use clinic or patient data to train general-purpose AI models, and we do not share it with any provider for that purpose.
How we protect it
- Access is limited by role and need, and every account belongs to one named person.
- Each clinic's data sits in a logically separated scope, and every request is scoped to a single clinic.
- Encrypted in transit and at rest.
- Every view, edit, and export is recorded in an access log.
- Sessions expire automatically, and access is revoked immediately when an account is stopped.
Your rights
Under the Personal Data Protection Law of Saudi Arabia, you have the right to:
- Be informed how your data is processed and why.
- Access your data and obtain a copy of it.
- Receive your data in a readable, commonly used format, and ask us to transfer it where that is technically feasible.
- Request correction of data that is inaccurate or incomplete.
- Request destruction of your data once it is no longer needed.
- Withdraw your consent to processing.
- Complain to the Saudi Data and AI Authority (SDAIA) if you believe your data has been handled improperly.
Write to privacy@dhat.sa to exercise any of these. We reply within one business day and complete the request within 30 days. If your data sits inside a clinic's account, we will pass the request to that clinic, which is the controller, and support it in answering you.
If something goes wrong
If a breach affects personal data we hold, we notify the Saudi Data and AI Authority without undue delay and within the period the Personal Data Protection Law requires.
Where the breach affects a clinic's data, we notify that clinic as soon as we are aware, with what we know and what we are doing about it, so the clinic can meet its own obligations to its patients.
Data about minors
Where care involves a minor, the clinic obtains guardian consent as required by applicable law.
We do not collect data about minors directly through this website.
Cookies
This website sets no cookies at all — no analytics, no advertising, no tracking. Fonts are served from our own servers, so your address is never disclosed to a third party. Full details are on the Cookies page.
Updates to this policy
We may update this policy as our services or legal requirements change. The last updated date appears at the top of this page, and we notify clinics of material changes before they take effect.
Contact us
Privacy questions and data-rights requests are handled by our Privacy Officer.
Write to privacy@dhat.sa and we will reply within one business day.
For any question about this page, write to us at privacy@dhat.sa