Privacy Policy

Last updated: 30 May 2026

1. Who we are

Saudi Medical Port (SMP) is a Saudi-registered company selling medical supplies and personal-care products through leading e-commerce marketplaces in the Kingdom. We are based in the Kingdom of Saudi Arabia. All data is processed and stored in compliance with the Saudi Personal Data Protection Law (PDPL) and our marketplace partners' data protection requirements.

2. Information we collect

Order data: order ID, order date, products ordered, amount paid.
Buyer data: name, phone, email, shipping address, billing address — received from the marketplace at the time the order is placed.
Account data (staff only): email, hashed password, MFA secret, session log.
Access logs: IP address, request time, browser type — retained for security purposes only.

3. How we use the data

Fulfill and ship customer orders.
Communicate about the order (confirmation, shipping, returns).
Issue VAT invoices (Saudi ZATCA compliance).
Prevent fraud and secure our systems.
Comply with Saudi regulations and marketplace partner requirements.

We never use buyer data for direct marketing, never sell it to third parties, and never combine it with any external analytics service.

4. Who we share data with

We share data only with service providers strictly required to fulfill the order:

Logistics partners: name, phone, shipping address — for order delivery only.
Email service provider: email address — for order confirmation only.
Hosting / database provider: all order data — stored encrypted at rest.
Marketplaces where we list our products: order status and shipping updates via their official APIs.

We do not share any personal data with marketing platforms, analytics vendors, or any party outside the fulfillment chain.

5. Storage and security

We store data on secure servers and databases with strong encryption at rest and in transit.
All connections to our site and systems use encrypted channels (TLS 1.2 or higher).
Encryption keys are managed by a dedicated key-management system with periodic rotation.
Data access is controlled by strict role-based permissions; every access is recorded in an audit log.
Multi-Factor Authentication (MFA) is mandatory for any user who can view personal data.
Backups are encrypted and held in geographically separated locations.

6. Retention

Buyer personal data (name, phone, email, address): automatically deleted 90 days after order shipment.
Order records (order ID, amount, products): retained 6 years for VAT compliance (ZATCA requirement).
Audit log: 18 months.
Authentication logs: 90 days.

7. Your rights

Under the Saudi Personal Data Protection Law, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion (subject to legal retention requirements).
Object to processing.
File a complaint with the Saudi Data and AI Authority (SDAIA).

To exercise any of these rights, contact privacy@smp.sa.

8. Security incidents

In the event of an incident affecting your data, we will notify affected customers within 72 hours of detection, in accordance with the Saudi PDPL and National Cybersecurity Authority requirements.

To report a security incident: security@smp.sa

9. Changes to this policy

We review this policy at least every 6 months. Material changes will be notified to active accounts via email.

10. Contact

Saudi Medical Port
Email: privacy@smp.sa
Security: security@smp.sa