Our data principles
We collect only what the stated purpose needs. The sign-up form asks for contact details only and no medical information.
Analytics cookies run only after you accept them; declining has no effect on browsing.
Your data is never sold or shared for marketing.
At launch, nobody sees your health record without your consent, a defined role and purpose, with an access log.
In place on the website today
HTTPS everywhere with HSTS.
Restricts where scripts load from and connect to, limiting injection attacks.
Anti-framing, no MIME sniffing and a strict referrer policy.
Google Analytics consent mode defaults to "denied" until you accept.
The assistant does not ask for health data and directs emergencies to 997.
SPF and DMARC are enabled for healtrip.co.
Commitments before launch
Completing the Personal Data Protection Law requirements, including records of processing, impact assessments, a data protection officer and registration where applicable.
Building the platform in line with the relevant National Cybersecurity Authority controls.
Hosting beneficiaries' health data inside Saudi Arabia as regulations require.
No medical service is offered before the required licences are obtained.
Current providers for the informational website
- Vercel: hosting and the automated assistant.
- Web3Forms: delivers the interest form to our inbox.
- Google Analytics: traffic measurement, only after consent.
- Microsoft 365: official email.
Your rights
You may ask how your data is processed, access it, request correction or deletion, and withdraw consent by emailing info@healtrip.co. See the privacy notice and terms of use.
Reporting a vulnerability
Found a security issue? Please report it responsibly to info@healtrip.co with the subject "Security report" and steps to reproduce. Please do not access other people's data or disrupt the service while testing.