Privacy Policy

Last updated: 2 November 2026

This policy explains what personal data the TubaPay app and website collect, why, who receives it, and the choices you have. Please read it before you use TubaPay.

1. Who we are

TubaPay is operated by شركة وريد للتقية المعلومات, commercial registration 1010000000, Abdulrahman bin Awf Street, Al Manar district, Riyadh ("TubaPay", "we", "us"). We decide how and why your personal data is used.

TubaPay lets you pay participating healthcare providers in Saudi Arabia through payment requests they send you, at a discounted customer price.

2. The data we collect

What we hold depends on how you use TubaPay.

Identity and contact: your mobile number, which identifies your account. Your name, only if you give it. Your email address and date of birth, only if you choose to add them. Your preferred language.
National ID or Iqama number: entered by the provider's staff when they create an order for you. We use it to decide whether VAT applies and to match orders to the right customer. Provider staff enter it but cannot see it afterwards; only authorised TubaPay staff can.
Orders and payments: the provider, the services on each order, prices, VAT, your saving, the order status, and the payment date, reference and result.
Health-related information: service names may reveal something about your health. We use them only to provide the service, and we never put them in SMS messages.
Refunds, support and ratings: refund requests and their reasons, messages you send to support, and the ratings you give.
Device and login: a device name, your app's notification token, the device platform, and login and session records.
Location: your device location, only if you allow it and only while you use the app. See section 4.

3. What we do not collect

Card details. You enter card details directly with our payment provider, or pay with Apple Pay. We never see or store your full card number or security code.
Face ID or fingerprint data. Biometric unlock is handled by your device, and we never receive it.
Advertising or tracking data. The app contains no advertising, no analytics and no third-party tracking, and we do not sell your personal data.

4. App permissions

Location, while using the app: shows the nearest providers first and places you on the map. It is sent with your search and is not saved to your account. You can refuse it and still use the app.
Notifications: tells you about payment requests, orders and refunds. You can turn them off in your device settings.
Face ID or fingerprint: lets you unlock the app on your phone if you choose to.

5. How we use your data

We use your data to provide the service you asked for, to meet our legal obligations, and, where the law requires it, with your consent. Specifically, we use it to:

Create your account and verify your number with a one-time SMS code.
Send you payment links and show you your orders, payments and savings.
Process payments and refunds, and apply VAT correctly.
Let providers manage the orders they create for you, and settle what is due to them.
Send service notifications, and answer support requests.
Keep the service secure, and prevent fraud and misuse.
Meet our accounting, tax and other legal duties.

7. Where your data is kept

Our servers are located in Dammam, Saudi Arabia (Google Cloud me-central2). Some service providers, including Google, may process data outside Saudi Arabia. Where that happens, we follow the safeguards that apply under Saudi personal data protection law.

8. How long we keep your data

Your profile: until you delete your account.
Login codes: valid for 5 minutes. Code records are removed when you delete your account.
Login sessions: end after 180 days without use, when you log out, or when you delete your account.
Orders, payments, refunds and accounting records: kept for as long as you have an account. If you delete your account, we keep them for as long as the law and our accounting require, as section 9 explains.

9. Deleting your account

You can delete your account at any time, in the app under Account, or on our website using a code sent to your mobile number.

Your account is deleted immediately. This cannot be undone.

We delete your profile (mobile number, name, email, date of birth, ID number and card code), your devices and your login records.

We keep your orders, payments, refunds, ratings, support messages and notification history, including the mobile number and service names on old orders. We keep them for legal and accounting reasons, and because they are also the provider's records.

You cannot delete your account while a payment or a refund is in progress. Please try again when it has finished.

If you log in later with the same number, a new, empty account is created, and your old orders appear again because they are linked to your mobile number.

Delete your account

10. Your rights

Under the Saudi Personal Data Protection Law you may ask to be told how your data is used, to access it, to receive a copy, to have it corrected, to have it destroyed where we are not required to keep it, and to withdraw any consent you gave.

You can update some details yourself in the app. For anything else, contact us at product@tubahealth.com. You may also complain to the competent authority in Saudi Arabia.

11. Security

We encrypt data in transit, keep your login details in your device's secure storage, and restrict access to staff who need it. No system is perfectly secure, so please keep your phone locked and never share your login code.

12. Children

TubaPay is meant for adults who manage their own payments. It is not directed at children under 18.

13. Changes to this policy

We may update this policy. We will change the date at the top of this page, and tell you in the app when a change is significant.

14. Contact us

شركة وريد للتقية المعلومات, Abdulrahman bin Awf Street, Al Manar district, Riyadh. Email: product@tubahealth.com. Phone: +966 9200 33518.