1. Who we are
Dr. Osama Gaballa — Stars Smile is the controller of the personal data described in this notice. This website presents the practice, the doctor's academic work and patient education, and receives enquiries from the contact form and from the practice's social-media accounts.
Data protection officer: contact us through the request form below or the practice contact details.
2. What we collect
- Messages you send us — through the website contact form (name, e-mail, phone, subject, message) or as a direct message, comment or mention on our social-media accounts (your public name, handle, profile picture and what you wrote).
- Appointment and booking requests, when you make one online.
- If you become a patient: your patient file (identity and contact details, medical history, treatment records and clinical photographs) and your consents.
- Before/after photographs or a case description are published on the website only with your explicit written consent, and never with your name unless you ask for it.
- The privacy-notice version you acknowledged and whether you agreed to receive news and offers.
- Technical data needed to run and protect the website: the address of your device in shortened (anonymised) form and your browser type. We do not use advertising trackers.
3. Why we use it and on what basis
- To answer your enquiry or message — because you asked us to.
- To provide and document your care — required by health-care regulations; health data is sensitive data and is handled only by authorised staff.
- To publish a case or photographs — only with your explicit consent, which you can withdraw at any time.
- To send you news, offers or reminders that are not part of your care — only if you opted in; you can withdraw at any time.
- To keep our systems secure, prevent abuse and meet our legal obligations.
4. Who we share it with
We do not sell your personal data. We share it only with service providers that process it on our instructions (website hosting, e-mail, SMS and WhatsApp delivery) and with authorities when the law requires it. When you write to us on a social-media platform, that platform also processes your message under its own privacy policy. Any transfer outside the Kingdom is made only as the PDPL and its regulations allow.
5. How long we keep it
- Website and social-media messages: up to two years after the last contact, then deleted.
- Patient files and treatment records: for the period required by Ministry of Health rules.
- Website statistics: about 13 months, with shortened device addresses.
- Security audit logs: one year (six years for access to patient records), then archived and deleted.
- Copies prepared for a data request: a few days, until handed over.
6. Your rights
You have the right to be informed, to access and obtain a copy of your data, to have it corrected, completed or destroyed, to restrict or object to its processing, and to withdraw your consent at any time. Medical records that the law requires us to keep cannot be destroyed early; in that case we restrict their use instead.
Use the online request form (https://gaballa.org/privacy/request) or write to the data protection officer. We will check your identity before acting and answer within 30 days. If you are not satisfied with our answer, you may complain to the Saudi Data and AI Authority (SDAIA).
7. How we protect it
Patient data is encrypted at rest, access is limited to staff who need it and every access is logged. If a breach affects your personal data we will notify SDAIA within 72 hours of becoming aware of it and inform you when it may harm you.
8. Children
Requests and consents for anyone under 18 must come from a parent or legal guardian.
9. Changes to this notice
We will publish any change on this page with a new version number. The version you acknowledged is recorded with each form you send.
Version 2026-10