Privacy Policy

TIME (“TIME”, “we”) is a Saudi platform for booking appointments with salons, clinics, restaurants, sports venues and other service providers. The controller of your personal data is:

When you book with a provider, that provider receives the booking details it needs to serve you and is responsible for how it uses them in its own business. Where providers use the TIME dashboard to manage their customers, we process that data on their behalf and under their instructions.

We collect only what we need to run the service (data minimisation). Most data comes from you directly; some is generated as you use TIME.

Additional data for providers

• Business details, commercial registration or freelance document, municipal and health licences, branch address and national address verification.
• Owner name and national ID number, and the bank IBAN for payouts. These are encrypted at field level and only the last 4 digits are displayed.
• Staff names, emails, roles and schedules entered by the provider.

Booking with a clinic, laboratory or other healthcare provider may reveal information about your health. We treat these bookings as sensitive personal data and apply stricter rules:

• No medical records: we do not ask for or store diagnoses, test results, prescriptions, medical files or a free-text “reason for visit”.
• The service name and specialty of medical bookings are encrypted at field level, and access by TIME staff is restricted to a need-to-know basis and logged.
• Screenshots are blocked on screens that show medical booking summaries in the app.
• We never use health-related booking data for marketing, advertising, profiling or ranking, and we never transfer it outside the Kingdom.
• We ask for your explicit consent before your first healthcare booking, and you may withdraw it at any time (this stops future healthcare bookings, not past records required by law).

We do not use your data for automated decisions that produce legal or similarly significant effects on you without human review.

Where we rely on consent we ask for it clearly and separately, and we record when and how you gave it. You can withdraw consent at any time from Account → Privacy & data in the app, by unsubscribing from a message, or by emailing [email protected].

Withdrawing consent does not affect processing that took place before, and it may limit features that depend on it (for example, healthcare bookings).

We never sell personal data and we do not work with advertising networks. We share the minimum necessary with:

We use trusted service providers to host and protect the platform, and some of them may store or process data outside the Kingdom.

Any such transfer follows the PDPL and its Regulation on Personal Data Transfer outside the Kingdom: it is limited to what is necessary to run the service, protected by appropriate safeguards (encryption in transit and at rest for backups, access restricted to authorised staff, and contractual commitments from our providers), and recorded. TIME only stores appointment details (service, time and provider); it does not collect medical records, diagnoses or health information.

Under the PDPL you have the right to:

• Be informed about how and why your data is processed (this notice).
• Access your personal data and obtain a copy in a readable, commonly used format.
• Correct inaccurate or incomplete data, mostly directly from your account.
• Request deletion (destruction) of data we no longer need. See Delete your account.
• Withdraw consent at any time where processing is based on consent.
• Object to marketing at any time.
• Complain to the Saudi Data & AI Authority (SDAIA), the competent authority, through its official channels.

Send requests from your registered email to [email protected]. We will verify your identity and reply within 30 days; where the law allows an extension we will tell you why. Requests are free of charge unless they are manifestly repetitive.

TIME accounts are for adults aged 18 and over. Parents or legal guardians may add children as family members to book for them, and are responsible for the data they enter. We do not knowingly collect data directly from children; if we learn that we have, we delete it.

• Encryption in transit (TLS only) and at rest, with field-level AES-256-GCM encryption for national ID numbers, IBANs and medical booking details.
• Tokens are stored in the device’s secure storage (Keychain / Keystore) and never in the browser; web sessions use encrypted HttpOnly cookies.
• Two-factor authentication for providers and administrators, least-privilege access and append-only audit logs.
• Bot protection, rate limits, strict security headers, regular reviews aligned with the National Cybersecurity Authority controls.
• Confidentiality obligations for all staff and contractors.

Found a vulnerability? Please report it privately to [email protected] before disclosing it.

If a breach affects your personal data we will notify SDAIA within 72 hours of becoming aware of it, as required by the PDPL Implementing Regulations, and notify affected users without undue delay when the breach may harm them, explaining what happened and what we are doing about it. We keep a register of incidents and the measures taken.

Our website uses only strictly necessary cookies (security, session and language). We do not use advertising or cross-site tracking cookies. Details are in our Cookie Policy.

We will update this notice when our practices change. For material changes we will notify you in the app or the dashboard before they take effect. The date at the top shows the latest version.

If you are not satisfied with our response you may complain to the Saudi Data & AI Authority (SDAIA).