Privacy policy.
How this website handles your data — what it loads, what it stores, and what you can ask me to do about it.
Who is responsible
The controller for this website is:
- Name
- Dr. Yousef Muhammad
German Board Certified Orthopaedic Surgeon - Address
- Dr Sulaiman Alhabib Hospital, Al Sahafah, Alyasmin, Riyadh 13325, Saudi Arabia
- Telephone
- +966 11 522 2222
- ywr.muhammad@gmail.com
- Website
- www.dryousefmuhammad.com
What this website loads before you agree
Nothing that is not needed to show the page. The four typefaces of the design are served from this server, not from Google, so no font request reveals your IP address. There is no analytics tool, no advertising pixel and no social media tracker on any page.
Two things do come from third parties, and both wait for your consent: the map on the contact page and the videos. Until you agree, they are replaced by a placeholder and no request leaves your browser.
Appointment requests and email
When you send the form on the contact page, the details you enter — your name, your contact details, your preferred date and what you write in the message field — are sent to me by email so that I can answer you.
That mailbox is hosted by Google (Gmail). Google therefore processes the contents of your message on its own servers, under its own privacy terms. If you would rather not have your message pass through Google, please call instead.
Legal basis
Where your request concerns treatment, processing is based on the performance of a contract or the steps leading to it (Art. 6 (1)(b) GDPR); otherwise on my legitimate interest in answering enquiries (Art. 6 (1)(f) GDPR). Under the Saudi Personal Data Protection Law, your submission of the form is the consent on which the processing rests.
Health information
Information about your health is a special category of personal data (Art. 9 GDPR) and sensitive data under the PDPL. It is used only to answer your enquiry and to prepare your consultation, and it is not passed to anyone outside the treatment relationship.
Cookies and local storage
Two cookies are set without asking, because the site cannot work without them: one remembers your chosen language, the other remembers your cookie decision so that you are not asked again on every page. Neither identifies you.
Everything else — the map and the videos — is only loaded once you agree. You can change or withdraw that decision at any time through Cookie settings in the footer. A full list of cookies is in the cookie policy.
Google Maps
The contact page can show the location of the hospital on a map from Google Maps. The map is blocked until you accept it. When you do, Google receives your IP address and information about your use of the map, and may transfer that data to servers in the United States. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
YouTube videos
Surgical and explanatory videos are hosted on YouTube in its privacy-enhanced mode. A video is only requested from YouTube when you click play and have accepted marketing cookies; before that, no connection is made. When you play a video, Google receives your IP address and viewing data. Provider: Google Ireland Limited, address as above.
Hosting and server logs
This website is hosted by Hostinger. Like every web server, it writes a log entry for each request: the page requested, the time, your IP address, the referring page and your browser identification. These entries keep the site secure and let faults be traced. They are deleted or shortened after a few weeks and are not combined with anything else.
How long data is kept
Enquiries are kept for as long as needed to deal with them and, where a treatment relationship follows, for as long as medical documentation duties require. Server logs are deleted after a few weeks. Your cookie decision is stored for one year, after which you are asked again.
Your rights
You can ask me at any time, free of charge, to:
- confirm what data about you is held, and receive a copy of it;
- correct anything inaccurate or complete anything missing;
- delete your data, where no legal duty requires me to keep it;
- restrict processing while a dispute is being resolved;
- receive your data in a portable form;
- object to processing based on legitimate interests;
- withdraw consent you have given, with effect for the future.
Write to ywr.muhammad@gmail.com. I answer within one month.
Complaints
If you are not satisfied with how your data has been handled, you may complain to the supervisory authority. In Saudi Arabia this is the Saudi Data and Artificial Intelligence Authority (SDAIA). If you are in the European Union, you may also complain to the data protection authority of your country of residence.
Changes to this policy
This policy is amended when the website changes — a new embedded service, a new form, a new mailbox. The date at the top of the page tells you which version you are reading.