1. Purpose and scope
The Saudi Spine Society (SSS, “Society”) respects the privacy of website visitors, members, healthcare professionals, researchers, conference participants and other users. This policy describes how the Society, as data controller for its own services, collects, uses, discloses, stores and protects personal data in accordance with the Saudi Personal Data Protection Law (PDPL), its Implementing Regulations and other applicable requirements. The Society also observes relevant governance obligations applicable to nonprofit organizations.
2. Categories and sources of data
Depending on the service, we collect information you submit directly: name, email, phone, professional title, specialty, institution, qualifications, membership applications, conference registrations, scientific abstracts, author affiliations, attendance and certificate details, inquiries and correspondence. We may retain payment amount, date, reference, status and refund information. Technical records may include IP address, browser/device information, access logs and cookies. Required fields will be identified at collection. We collect only information reasonably necessary for a specified purpose.
3. Purposes and lawful bases
We process data to manage membership; administer scientific events, registrations, abstract review and certificates; respond to inquiries; reconcile payments and refunds; provide service communications; protect and improve the website; and comply with legal, financial and regulatory obligations. Processing relies on the applicable lawful basis, such as consent, contractual necessity, legal obligation or legitimate interests where permitted under the PDPL. Optional promotional messages require an appropriate basis and consent where required. You may withdraw consent through the unsubscribe mechanism or Admin@saudispine.org without affecting earlier lawful processing.
4. Payments and Saudi-based provider
Electronic payments for membership, conferences and other Society services are handled through a Saudi-based payment service provider operating under applicable Saudi legal and regulatory requirements. The provider processes payment information through its payment infrastructure and is responsible for its own regulatory duties. SSS may retain limited transaction records needed for administration, accounting, reconciliation and refunds. The Society will verify the provider’s actual handling of card data, subcontractors and storage arrangements before publication of this policy; no statement here should be read as a guarantee that SSS never accesses card data until this has been confirmed.
5. Saudi data storage and international access
All personal data stored by or on behalf of the Society through its website and related electronic services, including relevant databases and backups, will be maintained on servers physically located within the Kingdom of Saudi Arabia. The Society will not authorize storage of such data outside the Kingdom. Saudi-based storage does not necessarily exclude access or processing from abroad; any such activity must be separately assessed and handled in accordance with applicable Saudi requirements. Service providers must be contractually and technically assessed against this commitment.
6. Disclosure and service providers
We do not sell personal data. Where necessary and lawful, limited information may be shared with Saudi-based hosting and maintenance providers, membership or event administrators, payment and communications providers, authorized scientific reviewers, and competent authorities. We restrict access to the purpose and apply appropriate confidentiality, security and contractual safeguards. Sponsors or commercial partners do not receive personal data for their independent marketing without an appropriate legal basis and any required consent.
7. Research and patient confidentiality
Scientific abstracts and research submissions may be reviewed by authorized scientific committees and reviewers. General website forms must not be used to submit identifiable patient records, clinical images or sensitive health data. Authors are responsible for appropriate anonymization, ethics approvals and patient consent where applicable. Any dedicated service collecting identifiable health data will require a separate assessment, notice and appropriate safeguards.
8. Professional directory
If the website offers a public professional directory, the Society will publish only specified professional fields under an appropriate lawful basis and will provide a method to request correction, updating or removal, subject to applicable requirements. The directory section applies only while such a service is operated.
9. Cookies and analytics
The website may use necessary cookies for functionality and security and, if enabled, optional preference or analytics cookies. Where legally required, optional cookies will be activated only with appropriate consent. The Society will disclose actual cookie providers, purposes and retention periods through its website controls or cookie notice. Users may manage preferences using available controls or browser settings.
10. Security and incidents
We use proportionate technical and organizational controls, including access restrictions, secure authentication, encryption where appropriate, monitoring, backups and confidentiality obligations. No internet service can guarantee absolute security. We assess personal data incidents and notify the competent authority and affected individuals when required by applicable law.
11. Retention and disposal
Personal data is retained only for the purpose and duration necessary, or for longer where required or permitted by law. The Society will document retention periods or criteria for membership, event attendance, abstracts, financial transactions, inquiries, subscriptions and security logs. At the end of the applicable period, data will be securely destroyed or anonymized unless lawful retention continues; backup copies are subject to controlled deletion schedules.
12. Individual rights
Subject to statutory conditions and exceptions, individuals may be informed about processing; access their data; obtain a readable copy; request correction, completion or updating; request destruction in applicable cases; and withdraw consent where consent is the legal basis. Submit requests to Admin@saudispine.org. The Society may verify identity and will respond within applicable statutory time limits, explaining any lawful refusal.
13. Complaints
Privacy requests and complaints may be directed to Admin@saudispine.org. Individuals may also complain to the competent Saudi personal data protection authority through applicable procedures; information is available at https://dgp.sdaia.gov.sa.
14. External links and children
External sites and platforms may have independent privacy policies; users should review them. The general website is not directed specifically to children. If children’s data is processed for a particular activity, the Society will apply the required safeguards and obtain guardian consent where legally required.
15. Changes and contact
This policy is reviewed at least annually and when services, processing or legal requirements materially change. The current version and effective date will be published on saudispine.org and notices provided where legally required. Contact: Saudi Spine Society, Admin@saudispine.org.