1. What does this notice cover?

This Privacy Notice explains how Saaya Health (“we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal data in connection with the wellbeing support services made available to contractors on behalf of Aramco.

Saudi Arabian Oil Company (“Aramco”) is the data controller for the personal data processed under this service. Saaya Health acts as an authorized service provider processing personal data on behalf of Aramco and, where applicable, in accordance with applicable contractual and legal obligations.

Saaya Health delivers these services as part of the wellbeing support program administered by Bureau Veritas on behalf of Aramco.

2. What personal data do we collect?

2.1 Information collected during initial contact

When contacting Saaya Health, the following information may be collected:

• Preferred language;

• Start date of employment/project assignment;

• Contractor company name;

• Nationality;

• Age;

• Number of years in the Kingdom of Saudi Arabia;

• Job description;

• Project name;

• Project city; and

• City of residence.

This information is collected to support service delivery, case management, trend analysis, and appropriate routing of the request.

2.2 Case information and wellbeing information

During counselling sessions or consultations, the counsellor may collect information relating to the issue raised by the contractor, this may include sensitive personal data such as health issues.

Sensitive personal data will only be processed where permitted under applicable law and based on your explicit consent where required.

2.3 Optional identity disclosure

You may choose to remain anonymous throughout the process.

However, where you wish to escalate a matter to Aramco for assistance, you may voluntarily choose to disclose your identity.

In such cases, the following additional information may be collected:

• Full name; and

• National ID/Iqama number.

Your explicit consent will be obtained before collecting and sharing this information with Aramco.

3. How we collect your data?

We collect this information directly from you when you contact us via:

• Telephone helpline services; and/or

• Video consultation services.

4. Why do we process your data? (Lawful Basis)

5. Who will your data be shared with?

Your Personal data may be shared with:

• Authorized personnel within Saaya Health and its business partners involved in service delivery

• Authorized personnel within Aramco responsible for case resolution, investigations, wellbeing management, or compliance activities

• Emergency services, if our counselors identify a risk of harm to yourself or others

Aramco and Saaya Health are committed to protecting the confidentiality of contractors using the service. You may access the service anonymously without disclosing your identity.

Where you choose to remain anonymous:

• No direct identifiers will be shared with Aramco;

• Case follow-up will be conducted using the assigned case reference number; and

• Information shared with Aramco will be limited to the details necessary to address the issue raised.

If you choose to disclose your identity for escalation purposes, Aramco may use the disclosed information to contact your employer solely for investigating and resolving the reported matter.

6. How do we protect your data?

Aramco and Saaya Health maintain appropriate security measures to prevent personal data from being lost accidentally or used or accessed unlawfully. We limit access to your personal data to those who have a genuine need to access it. Those persons processing your personal data on our behalf are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected or identified data security breach and we will notify you and any applicable regulator of such a breach where we are legally required to do so.

7. Will your data be transferred outside the Kingdom?

To provide wellbeing support services, personal data may be accessed and processed by authorized Saaya Health personnel located within and outside the Kingdom of Saudi Arabia, including in other Gulf Cooperation Council (GCC) countries and other jurisdictions where qualified counsellors and support personnel are located.

Personal data may therefore be transferred outside the Kingdom of Saudi Arabia for the purposes described in this Privacy Notice. Such transfers will only take place with your explicit consent and where necessary to provide the requested wellbeing support services, counselling, case management, and follow-up activities.

You may withdraw your consent at any time. However, withdrawal of consent may affect our ability to provide certain wellbeing support services where international access or transfer of personal data is required to deliver those services.  

8. How long will we keep your data?

Personal data will be retained only for as long as necessary to fulfill the purposes described in this Privacy Notice.

At the end of the applicable retention period, personal data will be securely deleted, anonymized, or destroyed in accordance with Aramco’s retention requirements and applicable law.

9. Your rights under the PDPL

Under the Data Protection Laws, you have certain rights in relation to your personal data. Responses to exercise your rights will be provided within 30 days, and there is no fee for making these requests. If your request is particularly complicated, we may extend the deadline for responding by a further 30 days.

Your rights include the following:

• A right to be informed: You have the right to be informed about the legal basis and the purpose of the collection of your personal data, which is the information this privacy notice provides.

• A right of access: You have the right to ask us for a copy of your personal data;

• A right to correction and restriction: You have the right to ask us to correct any inaccurate or incomplete personal data that we hold about you. You also have the right to ask us to restrict the processing of your personal data if you contest the accuracy of the data.

• A right to destruction: You have the right to ask us to destroy your personal data depending on the circumstances.

• A right to withdraw consent: Where we have asked for your consent, you may withdraw consent at any time.

These rights may be limited, for example, if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. If you have unresolved concerns, you have the right to complain to a data protection authority.

You may request to exercise these rights by sending us a message via WhatsApp to 0966535590617

10. Contact us

If you have questions regarding this Privacy Notice or wish to contact us for any reason in relation to our personal data processing, please contact us by sending us a message via WhatsApp to 0966535590617

11. Updates to this privacy notice

We reserve the right to update or amend this Privacy Notice from time to time to reflect changes in legal, regulatory, operational, or service requirements.

The latest version of this Privacy Notice will be made available through the applicable service channels.

Last updated: May 2026

‍