AREN
Book an appointment

Avant Clinics

Privacy Policy

Last updated: 15 July 2026 — Version: 1.1

Introduction

Avant Clinics (“the Clinic,” “we”) is committed to protecting your personal data and processing it in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its Implementing Regulations, under the supervision of the Saudi Data & AI Authority (SDAIA). This policy explains what data we collect, how we use, share, and protect it, and your rights regarding it.

Data Controller

Avant Clinics — legal name: SkinClinic (Limited Liability Company). Commercial Registration No. 1010208479, VAT No. 300047211300003. National Address: Building 7324, Unit 24, King Abdul Aziz Road, Ar Rabi District, Riyadh 13315, Additional No. 4790, Kingdom of Saudi Arabia. Domain: avantclinic.sa. Privacy requests: privacy@avantclinic.sa.

1. Scope

This policy applies to personal data we collect when you visit our website or contact us through it. In its current version the website is informational and does not include online booking or payments.

2. Data We Collect

  • Technical data collected automatically when you visit the site: IP address, browser and device type, and pages visited — kept in server logs for a limited period for security and operations.
  • Information you choose to send us if you contact the clinic directly (e.g. by the phone number or email shown on the site) — processed only to respond to you.

With your consent via the cookie banner, we use analytics and advertising measurement tools that collect anonymised usage events only (pages visited and random event identifiers that do not reveal your identity) — never your name, phone number, email, or any health details (see Sections 5 and 6).

3. Purposes and Legal Bases of Processing

  • Responding to your enquiries and contact requests — basis: consent / legitimate interest in replying to you.
  • Operating the website and ensuring its security and stability — basis: legitimate interest.
  • Complying with laws and legal requirements — basis: legal obligation.

4. Sensitive Health Data

Given the nature of our services, we may receive health-related data (e.g. if you describe the reason for your enquiry), and we commit to:

  • Obtaining your explicit consent when processing it.
  • Minimising data to what is necessary to respond to you or provide the service.
  • Restricting access under the principle of least privilege, with audit logging enabled.
  • Not publishing any identifiable images, testimonials, or results without separate, explicit consent.

5. Sharing Data with Third Parties

We do not sell your data to anyone. In the current version:

  • Hosting & infrastructure: Google Cloud — me-central2 (Dammam), in-Kingdom; website data and logs are hosted inside the Kingdom.
  • Marketing measurement (only after your consent): Google (Tag Manager / Analytics / Google Ads), Meta, TikTok, and Snap — these receive anonymised usage events only, relayed through our own in-Kingdom measurement server, and never receive any personal or health data.
  • Beyond that, we do not share your data with any other third party.

6. Cookies and Tracking Tools

The website uses two kinds of cookies:

  • One essential cookie (avant_consent) that stores your consent choice for 180 days — it contains no personal identifier.
  • Optional analytics and advertising cookies that activate only after your consent via the banner shown on your first visit. You can withdraw or change your choice at any time via the “Cookie preferences” link in the website footer.

Language selection is determined by the page address, not by a cookie.

7. Data Location and Cross-Border Transfers

Your personal data is stored and processed inside the Kingdom of Saudi Arabia on Google Cloud infrastructure in Dammam. If you consent to measurement tools (Section 6), anonymised usage events — carrying no personal identifiers — are sent to the measurement providers listed in Section 5 and may be processed on their infrastructure outside the Kingdom; this never includes personal or health data. Beyond that we do not transfer your data outside the Kingdom; where this becomes necessary in future, it will be done in line with the statutory transfer controls (including SDAIA-approved Standard Contractual Clauses, or transfer to a country with an adequate level of protection) and after carrying out the required risk assessment.

8. Data Retention

We retain your data only for as long as necessary to fulfil the purpose of collection:

  • Contact and enquiry data: up to 24 months from last contact, then deleted or anonymised, unless a legal obligation or an ongoing relationship requires otherwise.
  • Server and security logs (including IP address): up to 90 days, then deleted.
  • Cookies: the essential consent cookie lasts 180 days; optional cookies last as stated for each cookie and are only set after your consent.

9. Data Security

We apply appropriate technical and organisational measures to protect your data from unauthorised access, disclosure, or alteration, including encryption, access controls, and audit logs.

10. Your Rights

Under the PDPL, you have the right to:

  • Be informed about how your data is processed.
  • Access your data and obtain a copy of it.
  • Request correction or updating of your data.
  • Request destruction of your data.
  • Object to the processing of your data.
  • Data portability (obtain your data in a structured, machine-readable format where applicable).
  • Withdraw consent at any time (without retroactive effect on prior processing).

To exercise any of these rights, contact us via privacy@avantclinic.sa or the “Contact Us” page on the website. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).

11. Children's Privacy

Our services are not directed at children below the statutory age without guardian consent, and we do not knowingly collect children's data without the required safeguards.

12. Data Breach Notification

In the event of a breach that may affect your data, we commit to notifying the competent authority (SDAIA) within (72) hours of becoming aware of it, and notifying you without undue delay where required.

13. Changes to This Policy

We may update this policy from time to time. Any update will be posted on this page with the “Last updated” date revised.

14. Contact

For any privacy enquiry or to exercise your rights: privacy@avantclinic.sa, or via the “Contact Us” page on the website.