Privacy policy
Version 4.0 | Effective date: 30 July 2026
1. Who we are
Zaina is operated by Hayat Ventures Company, a company registered in the Kingdom of Saudi Arabia under commercial registration number 7052130775, with its registered office in Riyadh. Hayat Ventures Company is the data controller responsible for the personal data processed through Zaina.
The Agile Monkeys, a company established in Spain, operates the Zaina service under a service agreement with Hayat Ventures Company and acts as a data processor on its instructions.
- ●Data controller: Hayat Ventures Company, Riyadh, Kingdom of Saudi Arabia
- ●Commercial registration: 7052130775
- ●Operator: The Agile Monkeys
- ●Service: Zaina
- ●Website: https://zaina.ai
- ●Data protection contact: privacy@zaina.ai
- ●Response time: We respond to all data subject requests within 30 days.
2. Scope
This policy governs the processing of personal data through:
- ●WhatsApp conversations with the Zaina team
- ●The secure appointment form
- ●The automated assistant available on our website
- ●Any other form or interaction on zaina.ai
It applies to all users, including individuals resident in the Kingdom of Saudi Arabia, in accordance with the Personal Data Protection Law (Royal Decree M/19, as amended by Royal Decree M/148 of 2023).
3. Personal data we collect and how
3.1 WhatsApp conversations
Most people reach Zaina by responding to an advertisement and opening a WhatsApp conversation. These conversations are handled by a member of our customer success team.
What we collect: your name as you provide it, your WhatsApp number, the procedure you are interested in, the stage you are at in your decision, and any personal context you choose to share during the conversation.
Conversations are delivered to us through a messaging platform that acts as our processor. Your conversation is stored on our systems located in the Kingdom of Saudi Arabia.
You decide what you share. We ask only what is needed to understand what you are looking for and to connect you with a suitable clinic.
3.2 Appointment data
If you choose to proceed to an appointment with a partner clinic, we collect the last four digits of your national identification number through a secure web form. We do not collect or store your full national identification number, and we never ask for it through WhatsApp or any other messaging channel.
The form requires you to tick a consent box before submitting. Your consent is recorded with a timestamp and the version of this policy in force at the time.
Data submitted through this form is stored on infrastructure located in the Kingdom of Saudi Arabia and is not accessible to team members located outside the Kingdom.
We do not currently collect photographs. If this changes, photographs will be collected only through the secure form and stored in the Kingdom, never through a messaging channel.
3.3 Automated assistant on our website
An automated assistant is available on zaina.ai. Conversations with this assistant are anonymised when stored and are not linked to your identity unless you separately provide contact details.
3.4 Technical data
Standard server logs, including IP address, browser type and timestamp, collected for security and service performance.
3.5 What we do not collect
We do not collect your age, your email address, your residential address or your location. Where we ask for a city, it refers to where you are looking for a procedure, not where you live.
4. Legal basis and purposes
| Processing activity | Data involved | Legal basis | Purpose |
|---|---|---|---|
| Handling your WhatsApp conversation | Name, contact identifier, conversation content | Legitimate interest (PDPL Article 6(4)) | Understanding what you are looking for and responding to you |
| Appointment referral | Name, contact identifier, procedure, partial national ID | Explicit consent (Implementing Regulation Article 11(2)) | Arranging your appointment with a partner clinic |
| Automated assistant | Conversation content, anonymised | Legitimate interest (PDPL Article 6(4)) | Generating responses to your questions |
| Aggregated reporting to clinics | Anonymised, aggregated data only | Legitimate interest (PDPL Article 6(4)) | Understanding demand patterns by procedure category |
| Server logs | Technical data | Legitimate interest (PDPL Article 6(4)) | Security and service performance |
| Consent records | Consent records | Legal obligation | Regulatory compliance |
Conversation content may include information about your body, your health history and the procedure you are considering. We apply to this content the safeguards appropriate to sensitive personal data, regardless of how it is classified.
Reports shared with partner clinics contain only aggregated and anonymised data, such as the volume of enquiries by procedure category. Individual conversations are never shared with clinics.
5. How the service works
Zaina today is operated primarily by people. A member of our customer success team reads your messages and replies to you personally. This is not an automated service.
We also operate an automated assistant on our website. It uses a large language model provided by Anthropic to generate responses, drawing on a knowledge base of general information about aesthetic medicine and plastic surgery procedures. Conversation content is transmitted to the model provider for response generation only. It is not used to train or improve any artificial intelligence model.
Zaina provides general information. It does not diagnose conditions, prescribe treatments, or give clinical or surgical advice.
6. Who we share your data with
We do not sell, rent or trade your personal data.
| Recipient | Data shared | Basis |
|---|---|---|
| Partner clinics | Your name, contact identifier and procedure of interest, and the partial national identifier where the clinic requires it | Your explicit consent |
| Partner clinics (reporting) | Aggregated, anonymised data only | Legitimate interest |
| Messaging platform provider | Conversation content and contact identifier | Processor under a data processing agreement |
| Artificial intelligence provider (Anthropic) | Conversation content from the automated assistant, in transit only | Processor under a data processing agreement |
| Cloud infrastructure provider | Stored data | Processor under a data processing agreement |
| Regulatory authorities | As required by law | Legal obligation |
When we refer you to a partner clinic, that clinic becomes an independent controller of your data from the point of contact onwards, and its own privacy policy applies to your relationship with it.
7. Where your data is stored, and access from outside the Kingdom
All personal data is stored on infrastructure located in the Kingdom of Saudi Arabia. We use Google Cloud Platform in the me-central2 region, located in Dammam.
Some of the people who operate Zaina are located outside the Kingdom. Personnel of The Agile Monkeys in Spain, and customer success specialists who may be located in other countries, access this data remotely in order to run the service. Under the Regulation on Personal Data Transfer Outside the Kingdom, this access constitutes a transfer of personal data outside the Kingdom, even though the data itself remains stored in the Kingdom and is not copied or downloaded.
We rely on Standard Contractual Clauses issued under the template published by the Saudi Data and Artificial Intelligence Authority as the safeguard for these transfers, together with confidentiality and data processing agreements with everyone who has access.
Our messaging platform provider and our artificial intelligence provider process data on our behalf under data processing agreements incorporating appropriate transfer safeguards.
We have carried out a formal transfer risk assessment in accordance with Article 29 of the Personal Data Protection Law, the Regulation on Personal Data Transfer Outside the Kingdom of September 2024, and the Risk Assessment Guideline published by the Saudi Data and Artificial Intelligence Authority in February 2025. Document reference: TAM-ZAINA-TRA-001-v2.0, dated 30 July 2026.
Copies of the applicable contractual instruments are available on written request to privacy@zaina.ai.
8. How long we keep your data
| Data type | Retention period |
|---|---|
| Conversation content | Maximum 24 months from the date of the conversation |
| Appointment data | Maximum 24 months |
| Consent records | 3 years |
| Server logs | 90 days |
We destroy your data earlier than the maximum period when the purpose for holding it has been exhausted, for example if you decide not to proceed or if you ask us to delete it.
Deletion requests are processed within 30 days.
9. Sensitive personal data
Some of the information you share with us is sensitive. This includes the procedure you are considering when linked to your identity, the partial national identifier, and any description of your body or health history that you choose to share.
We apply the following safeguards to this data:
- ●Storage on infrastructure located in the Kingdom of Saudi Arabia
- ●Encryption in transit and at rest
- ●Access restricted to authorised personnel only
- ●The partial national identifier is not accessible to team members located outside the Kingdom
- ●Photographs are never accepted through messaging channels
- ●No use of sensitive data for marketing
- ●No collection of sensitive data from anyone under 18
10. Your rights
Under the Personal Data Protection Law you have the right to:
- ●Be informed about how your data is processed, which is the purpose of this policy
- ●Access a copy of the personal data we hold about you
- ●Request correction of data that is inaccurate
- ●Request deletion of your data
- ●Withdraw your consent at any time, without penalty, which does not affect processing carried out before you withdrew it
- ●Object to marketing communications
- ●Lodge a complaint with the Saudi Data and Artificial Intelligence Authority at https://sdaia.gov.sa
To exercise any of these rights, contact privacy@zaina.ai. We respond within 30 days.
11. Security
- ●Encryption of all data in transit and at rest
- ●Personal data stored on infrastructure located in the Kingdom of Saudi Arabia
- ●Role-based access controls, with access limited to what each person needs
- ●Authenticated administrative access
- ●Regular security review
If a personal data breach occurs that may cause you harm, we will notify the Saudi Data and Artificial Intelligence Authority within 72 hours and inform affected users without undue delay.
12. Medical disclaimer
Zaina is an informational service only. It does not provide medical diagnosis, clinical prescriptions or surgical advice. Zaina is not a medical device and is not intended for medical purposes. All decisions regarding a medical or aesthetic procedure must be taken in consultation with a qualified, licensed medical professional.
غير مخصص للأغراض الطبية
13. Children
Zaina is not directed at anyone under 18 and we do not knowingly collect personal data from minors. If we become aware that we hold personal data of someone under 18, we will delete it. Contact privacy@zaina.ai.
14. Cookies
We use only cookies that are technically necessary to operate the website. We do not use advertising or tracking cookies.
15. Changes to this policy
We may update this policy. Where a change is material, we will give notice on the website at least 15 days before it takes effect. The version number and effective date at the top of this page reflect the current version.
16. Governing law and regulator
This policy is governed by the Personal Data Protection Law of the Kingdom of Saudi Arabia. The competent supervisory authority is the Saudi Data and Artificial Intelligence Authority (SDAIA) — https://sdaia.gov.sa
17. Contact
Hayat Ventures Company, Riyadh, Kingdom of Saudi Arabia Commercial registration 7052130775 privacy@zaina.ai https://zaina.ai