Privacy & Data Protection

AcedrA Pharmaceutical Company LLC ("AcedrA") is aware of the importance of your privacy and personal data; therefore, we commit to keeping all critical information and data of all Users safe, secure, and confidential.

The privacy policy and procedures of AcedrA is governed by the Personal data protection law (Royal Decree No. (M/19) dated 1443/2/9 AH), the Main Principles of Personal Information Protection, and the Main Principles and General Rules for Sharing Data issued by the Saudi Data and Artificial Intelligence Authority (SDAIA) and National Data Management Office (NDMO).

The Personal Data Protection Law and its executive regulations set the legal basis for the protection of your rights regarding the processing of personal data by all entities in the Kingdom, as well as all entities outside the Kingdom that process personal data related to individuals residing in the Kingdom using any means, including online personal data processing.

The fundamental principles of our data protection policy include:        

• Accountability by the head of the entity (or his designee) for the Data Controller's privacy policies and procedures.

• Transparency through Privacy Notice indicating the purposes for which personal data is collected.

• Choice and Consent are obtained through implicit or explicit approval regarding the collection, use, and disclosure of personal data before collection.

• Limiting Data Collection to minimum data that enables fulfillment of purposes.

• Use, Retention, and Destruction strictly for the purpose, retained as long as necessary to achieve intended purposes or as required by laws and regulations, and destroyed safely, preventing leakage, loss, theft, misuse, or unauthorized access.

• Access to data by which any Data Subject can review, update and correct their personal data.

• Data Disclosure Limitation approved by Data Subject restricts third parties to the purposes provided in Privacy Notice. 

• Data security by protecting personal data from leakage, damage, loss, theft, misuse, modification, or unauthorized access; according to the controls issued by the National Cybersecurity Authority and other relevant authorities.

• Data quality after verification of its accuracy, completeness and timeliness.

• Monitoring and Compliance with Data Controller's privacy policies and procedures, and any privacy-related inquiries, complaints, and disputes.

The National Data Management and Personal Data Protection Standards cover 15 Data Management and Personal Data Protection domains. The Standards apply to all data regardless of form or type, including paper records, emails, data stored in electronic form, voice recordings, videos, maps, photos, scripts, handwritten documents, or other recorded data. The application of the provisions of the Personal Data Protection Law and its executive regulations is without prejudice to the competencies and tasks of the National Cyber Security Authority as a competent security authority for cybersecurity and its affairs in the Kingdom.

​

​

Agreement on the privacy and data protection

As a User of AcedrA website and its application, you accept the privacy and data protection policies and regulations applied in the Kingdom of Saudi Arabia; that control the Platform and its application. This agreement becomes effective immediately upon first using or accessing the Platform. If you disagree with this policy, you should not use any of AcedrA website and application services.

​

Users Data Collection

The purpose of collecting personal data is directly related to the purposes of AcedrA services and shall not conflict with any prescribed provision. The methods and means of collecting personal information be appropriate to the owner's circumstances, direct, transparent and secure, and free from deception, misinformation, or extortion. If it turns out that the personal data collected is no longer necessary to achieve the purpose of its collection, AcedrA will stop hoarding it and destroy the previously collected data immediately.

AcedrA will ensure fulfillment of the following criteria before collecting your personal data:

1. The justification for collecting your personal data.

2. The purpose of collecting your personal data, whether all or part of its collection, is mandatory or optional, with further information about processing the data which is not contrary to the purpose of its collection or otherwise provided by the Law.

3. The identity and reference address of the collector of personal data where appropriate, unless it is for security purposes.

4. The entity or entities to which the personal data will be disclosed, described, and whether the personal data will be transferred, disclosed, or processed outside the Kingdom.

5. Possible effects and risks of non-compliance with the personal data collection procedure.

6. Your privacy and data protection rights as stipulated in the Law.

7. Other elements as determined by the regulations depend on the nature of the activity exercised by this entity.

In case personal data is collected from the non-owners, the following conditions will be met: 

1. If the owner of personal data agrees to do so, by the provisions of the Law.

2. If personal data is publicly available or collected from a publicly available source.

3. If the entity is a public entity, and the collection of personal data is not directly owned or processed for a purpose other than the one for which it was collected, is required for security purposes or to implement another system, or to meet judicial requirements in accordance with the provisions specified by the regulations.

4. If compliance with this prohibition may harm the owner of personal data or affect his vital interests, by the provisions specified by the regulations.

5. If the collection or processing of personal data is necessary to protect the health or public safety or the life or health of a particular individual or individuals. 

6. If the personal data will not be recorded or stored in a format that makes it possible to identify and identify its owner directly or indirectly. 

What data do we collect  

When you visit AcedrA website and application, our servers automatically gather your IP address and collect information about the user's browser and search engine, geolocation, and the URL's date and time. AcedrA retrieves your personal data. The personal data, whatever its source or form, would expressly identify the individual or make it possible to place it directly or indirectly, and includes name, personal identification number, addresses, contact numbers, license numbers, records, personal property, bank account, and credit card numbers, fixed or moving images of the individual, and other data of a personal nature. 

It includes any process performed on personal data by any means, whether manual or automated, including collection, recording, preservation, indexing, arrangement, coordination, storage, modification, updating, integration, retrieval, use, disclosure, transmission, publication, data sharing or interconnection, blocking, scanning, and destruction.

Cookies are files saved on your phone, tablet, or computer when visiting www.acedrarx.com

​

Why we need your data 

Using the IP address helps us solve any technical problems arising on our servers, including statistics about the utilization of the Platform (such as the number of visitors, the language of the computer used, etc.). Identifying users' geolocation will benefit from the availability of specific services on its platform and application. We use cookies to collect and store information about how you use the website and application. The cookies enhance your use of the platform and better understand your need.

How we process and store personal data Your personal data will not be processed without taking sufficient steps to verify its accuracy, completeness, novelty, and relevance to the purpose for which the provisions of the regulations collected it. AcedrA applies the highest security standards to protect data and information. The sensitive data and any data that should be kept confidential under legal requirements are encrypted and subject to additional controls and procedures. Sensitive data includes an individual’s ethnic or tribal origin, religious, intellectual, or political belief, or indicates membership in civil associations or institutions, as well as criminal and security data, biometric data that identifies genetic data, insurance data, health data, location data, credit data and data indicating that the individual’s parents are anonymous or one of them. Our technical staff is only permitted to handle this information to provide such services of AcedrA platform that are consistent with your needs. We never let any party other than the technical team of the AcedrA platform know your IP address. Your information may be made available to government officials in the exceptional circumstances that this need should arise; however, it will never be made available to the public without your prior consent. Further, this information will not be circulated, exchanged, or sold to any third party without your prior consent.

Your personal data will be disclosed only in the following circumstances:

1. If you agree to disclose it in accordance with the provisions of the Law.

2. If your personal data has been collected from a publicly available source.

3. If the entity requesting the disclosure is a public entity, for security purposes, to implement another system, or to meet judicial requirements per the provisions specified by the regulations.

4. If disclosure is necessary to protect the public health or safety, the life of a particular individual or individuals, or their health. 

5. If the disclosure will be limited to its subsequent processing in a manner that does not lead to the identification of the owner of the personal data or any other individual specifically. 

AcedrA shall not disclose your personal data whenever the disclosure is characterized by any of the following:

1. It represents a threat to security, harms the reputation of the Kingdom, or conflicts with its interests

2. It affects the Kingdom’s relations with other countries

3. It prevents the disclosure of a crime or infringes on the rights of an accused to a fair trial, or affects the integrity of existing criminal proceedings.

4. It endangers the safety of an individual or individuals

5. It entails a violation of the privacy of an individual other than the owner of personal data as determined by the regulations

6. It is contrary to an incomplete or incapable interest

7. It violates established professional obligations

8. It involves a breach of an obligation, proceeding or court ruling

9. It discloses a confidential source of information that the public interest should not disclose.

AcedrA will destroy your personal data as soon as the purpose of collecting it has expired. However, it may retain such data after the purpose of collecting it has expired if everything that leads to the owner's specific knowledge has been removed per the controls specified by the regulations.

AcedrA will destroy your personal data as soon as the purpose of collecting it has expired. However, it may retain such data after the purpose of collecting it has expired if everything that leads to the owner's specific knowledge has been removed per the controls specified by the regulations.

This platform shall retain personal data even after the purpose of collecting it has expired in the following cases only:

•    If there is a systemic justification that must be retained for a specified period, in which case it shall be destroyed after the end of this period or the expiry of the purpose of its collection, whichever is longer.

•    If the personal data is closely related to a case before a judicial body and its retention is required for this purpose, in which case it is destroyed after the completion of the judicial proceedings of the case.