Privacy Policy
Last updated: 9 July 2026
1. Who we are
This Privacy Policy explains how CuraGenex ("CuraGenex", "we", "us", or "our") collects, uses, stores, and protects your personal data when you use this website, contact us, or use our services and portals.
Our registered address is Sultan Bin Abdulaziz Humanitarian City, King Fahd Road, Banban, Riyadh 11536, Kingdom of Saudi Arabia. We act as a "data controller" in respect of the personal data described in this policy. You can reach us about privacy matters at contact@curagenex.com.
2. Scope of this policy
This policy applies to personal data we process about visitors to this website, individuals who contact us or submit support requests, and users of the CuraConnect portal. Where our clinical or laboratory services involve additional or separate processing — for example, data handled under a service agreement, informed-consent form, or clinical protocol — that processing may be governed by additional notices or agreements provided to you at the time.
3. Personal data we collect
Depending on how you interact with us, we may collect:
Information you provide directly
- Contact form: your name, email address, and the content of your message.
- Support request form: your full name, phone number, email address, company name, subject, your question or message, and any file you choose to attach.
- Attachments: files you upload to the support form may contain additional personal data. If you choose to attach a medical, laboratory, or genetic report, that file will contain sensitive personal data (see Section 4). Please only send such files where necessary.
- CuraConnect portal: the email address and password you use to register or sign in, together with other account information associated with your use of the portal.
Information collected automatically
- Technical data such as IP address, browser type, device information, and pages viewed, collected through server logs and, where used, cookies or similar technologies (see Section 7).
4. Sensitive personal data
Under the PDPL, certain categories are treated as sensitive personal data, including genetic data and data revealing health status. Given the nature of our work, personal data you send us — particularly documents attached to the support form — may fall into this category.
We handle sensitive personal data with heightened care and only where we have a valid legal basis to do so, which will generally be your explicit consent.
5. Why we use your data and our legal basis
We use personal data to:
- respond to your enquiries and support requests;
- provide, operate, and secure the CuraConnect portal and our services;
- communicate with you about your requests or our services;
- meet our legal, regulatory, and record-keeping obligations; and
- maintain the security and proper functioning of our website.
Our legal basis for each purpose will be one of those permitted by the PDPL — typically your consent, the performance of a contract or service with you, compliance with a legal obligation, or another lawful basis recognised under the law.
6. Consent and withdrawing consent
Where we rely on your consent, you may withdraw it at any time by contacting us using the details in Section 13. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and may mean we are unable to provide certain services.
7. Cookies and similar technologies
Our website may use cookies and similar technologies to operate the site, remember your preferences, and understand how the site is used. Where the law requires your consent for non-essential cookies, we will seek it. You can usually control cookies through your browser settings; disabling some cookies may affect how the site works.
8. How we share your data
We do not sell your personal data. We may share it with:
- service providers who process data on our behalf — for example, hosting, email, and IT support providers — under appropriate agreements;
- competent authorities or regulators where required by law; and
- other parties where you have given consent or where otherwise permitted under the PDPL.
9. Transfers outside Saudi Arabia
The PDPL restricts transfers of personal data outside the Kingdom and requires appropriate safeguards and, in certain cases, authorization from the competent authority. Where we transfer personal data outside the Kingdom of Saudi Arabia, we do so only in accordance with these requirements.
10. How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this policy or as required by applicable law, after which it is securely deleted or anonymised.
11. How we protect your data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or loss, including measures to control access to personal data and to maintain its confidentiality.
12. Your rights
Subject to the PDPL and its conditions, you have the right to:
- be informed about how your personal data is processed;
- access your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of your data where the legal basis no longer applies;
- withdraw consent where processing is based on consent; and
- request a copy of your data in a readable format, where applicable.
To exercise any of these rights, contact us using the details in Section 13. We will respond within the timeframes required by law.
13. Contact us
For any questions about this Privacy Policy or to exercise your rights, contact us at contact@curagenex.com, or by post at the address in Section 1.
14. Complaints
If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the competent supervisory authority in Saudi Arabia, the Saudi Data & Artificial Intelligence Authority (SDAIA).
15. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date above shows when it was last revised. Material changes will be communicated where required by law.