​​

1        Introduction

A governmental body with an independent legal authority established under the Cabinet Resolution No. (71) dated 27/4/1420 AH and the Royal Decree No. M10 dated 01/05/1420 AH, which stipulated the establishment of a council with the aim of supervising the implementation of the cooperative health insurance system. Our purpose is the governance and regulation of the private health insurance sector by enhancing the effectiveness and efficiency of health services for beneficiaries and enabling stakeholders to achieve fairness, transparency, and excellence in performance.

2        Contact Information

Department: Data Management Office
Address: King Fahd Road, Al Melqa, Riyadh 13524
Email Address: dmo@cchi.gov.sa
Phone Number: 920001177

3        Date of last update

Changes to Our Privacy Notice

This privacy notice was last updated on 30/10/2024. You can view the history of updates that were made on the privacy notice:

4        What Personal Data is Collected?

We obtain information about you when you engage us to deliver our services or when you use our website or mobile application.

A.    Information you give us:

We collect from you directly the following data as part of providing our e-services on our Digital Channels (Website, Mobile Application, or CHI current or future digital portals)

1. Account Data: Information collected from you to create your profile, such as Name, ID Information, Email, Mobile Number, etc.
2. Complaints and Inquiries Data: Information collected upon submitting a complaint or an inquiry that may include but not limited to: Name, ID Information, Email Address, Mobile Number, Passport Number, Job Title, City, supporting documents that might contain your personal data
3. Representative Verification Data: Information collected from individuals requesting to become representatives of health care providers or health insurance companies that may include but is not limited to: Name, National ID or Residence Number, Job Title, Nationality, Mobile Number, Email Address, Signature
   
    

B.    Information collected automatically:

We automatically collect certain non-personal information that your browser sends whenever you visit our website or mobile application.

The personal data that we automatically collect includes:

Location Data: Live coordinates of your location (for mobile application only)

C.    Social Media Widgets and External Links

The Council's website and/or application may include links to social media platforms such as Facebook, X (previously Twitter), as well as external links to other websites. These platforms and websites may collect information about users by way of cookies or using other tracking technologies. Any interactions you have with these sites or platforms are subject to the privacy policies provided by their service providers, and we recommend reviewing them carefully to ensure you understand how your personal data is collected and used by them.

​

5        How do we collect your Personal Data?

CHI will generally collect your personal information directly from you. This may be achieved through your interactions with CHI's Digital Channels.

A.    We collect personal data directly from you through the following:

1. Website: Our website offers a variety of e-services which require that we collect your personal data to provide you with the services you need
2. Email: We collect personal data sent to us via e-mail to respond to your requests and provide assistance
3. Mobile Application: Our mobile application offers a variety of e-services which require us to collect your personal data

B.    We collect personal data indirectly from you through the following:

1. Third parties: The Council may receive data about users from third-party sources, such as Insurance/medical providers, government entities, or judicial authorities.
   

6        How do we use your Personal Data?

CHI uses your data that was collected directly or indirectly from you for performing our duties and responsibilities as a regulator of the health insurance sector, such as:

1. Giving you access to the various e-services provided on the website and mobile application
2. Processing requests to become representatives of health care providers or health insurance companies, allowing access to specific e-services for such representatives.
3. Addressing your submitted complaints, which may necessitate that your personal data is shared with the customer support teams of the healthcare providers and/or health insurance companies involved in resolving your complaint.
4. Responding to your inquiries and offering additional assistance.
5. Providing you with insurance details by submitting your ID Number, this is applicable to different insurance types such as but not limited to medical insurance, travel insurance, visitor insurance, etc.
6. Providing you with a list of eligible heath care providers and health insurance companies
7. Providing you with the location of the closest health care provider or health insurance company
8. Performing quality checks and enhancing the services we provide
9. For authentication purposes when you login using Single Sign-on (Nafath) through any of our digital channels
   

7        How do we disclose your personal data?

The Council is committed to not sharing users' data with other entities or third parties for marketing purposes, and not transferring any personal data outside the Kingdom.
 

Third parties having access to your information:

• Health Care Providers and Health Insurance Companies: The customer support teams of Health Care Providers and Health Insurance Companies may access the personal data you shared with us when lodging a complaint. This access is strictly for the purpose of resolving the complaint and is limited to only the necessary data.

CHI reserves the right to disclose your personal information in the following cases:

1. You have agreed to disclose your personal data, such as using one of CHI's e-services.
2. The personal data is collected from a publicly available source
3. The entity requesting disclosure is a public entity and the request is for security purposes, to implement another law, or to meet judicial requirements in accordance with the provisions set out by the regulations
4. The disclosure is necessary to protect public health or safety, or to protect the life or health of a particular individual(s)
5. The disclosure will be limited to processing it later in a way that does not lead to the identification of your personal data or any other individuals specifically (Anonymized)
   

8        Legal Basis for Collecting and Processing your Personal Data

In accordance with the Personal Data Protection Law, the legal basis on which we rely for processing your personal data includes:

1.     Your explicit consent: We will process your personal information when you provide consent for a specific purpose that we communicate to you. .

We may process your personal data without obtaining your consent in the following cases:

1. If processing is necessary to protect your interests and contacting you is difficult. If it is in your interest and contacting you is difficult
2. If processing is according to an initial agreement with you, or in accordance with other laws
3. Processing is required for judicial and/or security purposes by public entities

2.     In fulfillment of a Statutory Obligation: We process your personal data to comply with various regulations and royal decrees applicable to CHI, including:

Royal Decree No. M10 dated 01/05/1420

Decision of the Council of Ministers No. 71 dated 27/04/1420

3.     Maintaining Vital Interests: We may process your personal data to protect the vital interests of individuals in emergencies related to life, health, or public safety.

4.     Achieving Public Interest: We may process your personal data to achieve public interest objectives or in response to an official request from a public authority, as required by law.

5.     Achieving Legitimate Interests: We process your personal data based on our legitimate interest in improving our services, provided that these interests do not override your rights.

9        How do we store your Personal Data?

The Council recognizes the importance of your personal data being stored on its systems and therefore works on safeguarding that data as well as deleting it securely when no longer required. Please Note:

1. Personal data collected from the website and/or mobile applications are being stored on our servers located within the Kingdom of Saudi Arabia governed by appropriate security techniques to protect and preserve the data.
2. We will destroy the personal data immediately upon the completion of the purpose of its collection through secure methods and techniques.

However, the Council may find it necessary to retain personal data even after the purpose of its collection has ended in the following cases:

1. If there is a legal justification for us to keep it for a specified period by law, regulation, or for security reasons.
2. If the personal data is closely related to a case before a judicial authority and its retention is required for this purpose
3. If all personal elements have been anonymized
   

10    Your Rights Regarding Processing of your Personal Data

The Council is committed to providing high-quality services while ensuring your rights under the Personal Data Protection Law and applicable regulations. Your rights include:

• Right to Be Informed: You have the right to know how the Council collects your personal data, the legal basis for collection and processing, and details on processing, storage, destruction, purposes, retention periods, and disclosures. Access these details by reviewing the privacy notice or emailing: dmo@chi.gov.sa.

• Right of Access to your Personal Data: You have the right to access your personal data held by the Council. To exercise this right, visit: https://www.chi.gov.sa/en/ServicesDirectory or email dmo@chi.gov.sa. Your request will be reviewed within 30 days, and you will be notified via email.
  
   
• Right to request Access to your personal data: You are entitled to request access to your Personal Data held by the Council in a readable and clear format. To exercise this right, visit: https://www.chi.gov.sa/en/ServicesDirectory or email dmo@chi.gov.sa. Your request will be reviewed within 30 days, and you will be notified via email.
• Right to Request Correction of your Personal Data: You can request corrections to any inaccurate or outdated personal data by emailing: dmo@chi.gov.sa. Your request will be reviewed within 30 days, and you will be notified via email.
  
   
• Right to Request Destruction of your Personal Data: You can request the destruction of your personal data under certain circumstances by emailing dmo@chi.gov.sa . Your request will be reviewed within 30 days, and you will be notified via email.
  
   
  
  Please note, the Council may retain certain records to fulfill its duties as a regulator. This retention would be necessary to comply with legal and regulatory obligations granted to the Council.
  
   
• Right to Withdraw Consent: You can withdraw your consent for the processing of your personal data at any time, unless legal requirements dictate otherwise.

The Council respects and upholds the rights of users regarding their personal data. However, specific exemptions may apply where these rights do not fully extend, as outlined in the Personal Data Protection Law. These exemptions may include:

• Compliance with legal and regulatory obligations granted to the Council
• Security purposes or compliance with other laws
• Threats to national security or the Kingdom's reputation
• Effects on international relations
• Prevention of crime detection or rights of the accused
• Protection of the data owner or others
• Endangerment of individual safety
• Violation of privacy of others
• Conflicts with the interests of incapacitated individuals
  

11    How to Exercise your Rights?

Users may exercise their rights by contacting the Council of Health Insurance's Data Management Office by emailing:

 dmo@chi.gov.sa

Unless otherwise stipulated by the law, you will not be required to pay any fees in return for exercising this right. In case of submitting a request for exercising these rights, you will receive a response within 30 as of the request receiving date.

12    Complaints and Inquiries

If you have any concerns or inquiries, you can file a complaint to the Data Management Office by emailing:

dmo@chi.gov.sa.

Our data management team will work closely with you to address any questions or issues that you have with respect to the collection and processing of your personal information.

13    Council of Health Insurance Address

Kingdom of Saudi Arabia
King Fahd Rd. Al Melqa, Riyadh 1352
Website: https://www.chi.gov.sa​
 

​