AREN
Book an appointment

Avant Clinics

Privacy Policy

Last updated: 15 August 2026 — Version: 1.2

Introduction

Avant Clinics (“the Clinic,” “we”) is committed to protecting your personal data and processing it in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its Implementing Regulations, under the supervision of the Saudi Data & AI Authority (SDAIA). This policy explains what data we collect, how we use, share, and protect it, and your rights regarding it.

Data Controller

Avant Clinics — legal name: SkinClinic (Limited Liability Company). Commercial Registration No. 1010208479, VAT No. 300047211300003. National Address: Building 7324, Unit 24, King Abdul Aziz Road, Ar Rabi District, Riyadh 13315, Additional No. 4790, Kingdom of Saudi Arabia. Domain: avantclinic.sa. Privacy requests: privacy@avantclinic.sa.

1. Scope

This policy applies to personal data we collect when you visit our website or contact us through it. In its current version the website lets you request and book appointments — via the booking form, the doctor pages, or the AI chat — and also lets you pay online for certain published offers.

2. Data We Collect

  • Technical data collected automatically when you visit the site: IP address, browser and device type, and pages visited — kept in server logs for a limited period for security and operations.
  • Information you choose to send us if you contact the clinic directly (e.g. by the phone number or email shown on the site) — processed only to respond to you.
  • Appointment request data you choose to send via the booking form or the AI chat: name, mobile number, email (optional), the service wanted, your preferred date and time, and a requested doctor (optional) — processed to contact you and confirm the appointment, with the record held inside the Kingdom. When sent through the chat, your details also pass through the chat provider described in Sections 5 and 7.
  • Online purchase details you choose to enter at checkout: name, mobile number, and email address (optional). The email address is used for one purpose only — sending your order confirmation, order number and redemption code — and leaving it blank does not prevent you from completing the purchase. We never hold your card details at any point.
  • Job application data you choose to send via the “Join Us” page: name, mobile number, email (optional), role of interest, and an experience summary — processed only to evaluate your application, stored inside the Kingdom, and never shared with any third party.

With your consent via the cookie banner, we use analytics and advertising measurement tools that collect anonymised usage events only (pages visited and random event identifiers that do not reveal your identity) — never your name, phone number, email, or any health details (see Sections 5 and 6).

3. Purposes and Legal Bases of Processing

  • Responding to your enquiries and contact requests — basis: consent / legitimate interest in replying to you.
  • Evaluating job applications sent via the “Join Us” page — basis: your explicit consent when submitting the application.
  • Operating the website and ensuring its security and stability — basis: legitimate interest.
  • Complying with laws and legal requirements — basis: legal obligation.

4. Sensitive Health Data

Given the nature of our services, we may receive health-related data (e.g. if you describe the reason for your enquiry), and we commit to:

  • Obtaining your explicit consent when processing it.
  • Minimising data to what is necessary to respond to you or provide the service.
  • Restricting access under the principle of least privilege, with audit logging enabled.
  • Not publishing any identifiable images, testimonials, or results without separate, explicit consent.

5. Sharing Data with Third Parties

We do not sell your data to anyone. In the current version:

  • Hosting & infrastructure: Google Cloud — me-central2 (Dammam), in-Kingdom; website data and logs are hosted inside the Kingdom.
  • Marketing measurement (only after your consent): Google (Tag Manager / Analytics / Google Ads), Meta, TikTok, and Snap — these receive anonymised usage events only, relayed through our own in-Kingdom measurement server, and never receive any personal or health data.
  • The AI chat on the website: Chatbase — our automated assistant provider. The messages you type in the chat window, and any booking details you choose to enter there (name, mobile number, service, preferred appointment), are processed on the provider’s infrastructure outside the Kingdom. We send it no medical records, payment data, or invoices; we do not identify you to it from our side; and no booking request is recorded without your explicit consent inside the chat. Using the chat is entirely optional (see Section 7).
  • Payment processing: Moyasar — our payment gateway provider. The payment itself takes place entirely on the provider’s own page; your card details never pass through our servers and we never store them. We send the provider no health data — only the amount, the name of the service purchased, and our internal order reference, for reconciliation.
  • Email confirmation delivery: ImprovMX — our email delivery provider. If you choose to enter your email address at checkout, the confirmation message — which includes your name, the name of the service you purchased, and your order number — passes through the provider’s infrastructure outside the Kingdom for delivery only. We send it no medical records and no payment data, and nothing is sent to it at all if you leave the email field blank.
  • Beyond that, we do not share your data with any other third party.

6. Cookies and Tracking Tools

The website uses two kinds of cookies:

  • One essential cookie (avant_consent) that stores your consent choice for 180 days — it contains no personal identifier.
  • Optional analytics and advertising cookies that activate only after your consent via the banner shown on your first visit. You can withdraw or change your choice at any time via the “Cookie preferences” link in the website footer.

Language selection is determined by the page address, not by a cookie.

7. Data Location and Cross-Border Transfers

The system of record for your personal data — including booking requests and job applications — is stored and processed inside the Kingdom of Saudi Arabia on Google Cloud infrastructure in Dammam.

There are exactly three paths on which data is processed outside the Kingdom:

  • Measurement tools (only after your consent — Section 6): anonymised usage events carrying no personal identifiers, and never any personal or health data.
  • The AI chat (only if you choose to use it): chat messages — including any booking details you type into them, such as your name and mobile number — are processed on Chatbase’s infrastructure outside the Kingdom. Using the chat is entirely optional: you can always book through the website form or by calling 011 453 5050 without your data leaving the Kingdom.
  • The order confirmation email (only if you choose to give an email address): the confirmation — containing your name, the service you purchased, and your order number — passes through ImprovMX’s infrastructure outside the Kingdom for delivery only. Giving an email address is optional: leave the field blank and nothing is sent, and none of your data leaves the Kingdom.

Transfers outside the Kingdom are limited to those three paths, and both the chat and the email rest on a choice of yours: the chat on your choice to use it and your explicit consent inside it before any request is recorded, the email on your choosing to enter an address. We apply data minimisation: the chat never asks for health details or a National ID, and we send it no medical records, payment data, or invoices. Were any transfer beyond this to become necessary in future, it would be done in line with the statutory transfer controls (including SDAIA-approved Standard Contractual Clauses, or transfer to a country with an adequate level of protection) and after carrying out the required risk assessment.

8. Data Retention

We retain your data only for as long as necessary to fulfil the purpose of collection:

  • Contact and enquiry data: up to 24 months from last contact, then deleted or anonymised, unless a legal obligation or an ongoing relationship requires otherwise.
  • Job application data: up to 12 months from the application date, then deleted, unless an employment relationship is established; you may request deletion at any time before that.
  • Server and security logs (including IP address): up to 90 days, then deleted.
  • Cookies: the essential consent cookie lasts 180 days; optional cookies last as stated for each cookie and are only set after your consent.

9. Data Security

We apply appropriate technical and organisational measures to protect your data from unauthorised access, disclosure, or alteration, including encryption, access controls, and audit logs.

10. Your Rights

Under the PDPL, you have the right to:

  • Be informed about how your data is processed.
  • Access your data and obtain a copy of it.
  • Request correction or updating of your data.
  • Request destruction of your data.
  • Object to the processing of your data.
  • Data portability (obtain your data in a structured, machine-readable format where applicable).
  • Withdraw consent at any time (without retroactive effect on prior processing).

To exercise any of these rights, contact us via privacy@avantclinic.sa or the “Contact Us” page on the website. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).

11. Children's Privacy

Our services are not directed at children below the statutory age without guardian consent, and we do not knowingly collect children's data without the required safeguards.

12. Data Breach Notification

In the event of a breach that may affect your data, we commit to notifying the competent authority (SDAIA) within (72) hours of becoming aware of it, and notifying you without undue delay where required.

13. Changes to This Policy

We may update this policy from time to time. Any update will be posted on this page with the “Last updated” date revised.

14. Contact

For any privacy enquiry or to exercise your rights: privacy@avantclinic.sa, or via the “Contact Us” page on the website.

Privacy Policy