Security and your data

Every page and form is served over an encrypted connection (HTTPS/TLS), and the database and file storage behind it are encrypted on disk by our hosting provider.

Licence and verification documents go into private storage. They are never linked publicly: only you and our verification team can open them, through a short-lived link that expires.

Passwords must be at least 10 characters and are stored only as a one-way hash. Repeated failed attempts are locked out for a while, and you can switch on two-step login so a code is emailed to you after your password.

Your profile page appears only after you review both the Arabic and English versions and approve them. Administrators can record licence verification, but they cannot publish, rewrite or change the content of your profile.

Administrative actions are written to an audit record – who did what and when – and your consent is logged with its date and policy version, so there is always a trail.

The database enforces row-level rules: you can only read and change your own record, and the public website reads a restricted view that excludes licence numbers, emails, phone numbers and unpublished drafts.

The database and the file storage (photos, clinic logos and licence documents) are hosted in a managed cloud region in Asia Pacific (Singapore, ap-southeast-1). Transfers outside the Kingdom rely on the conditions permitted by the PDPL, with contractual safeguards equivalent to the protection described in our Privacy Policy.

You can unpublish or delete your profile whenever you want. Your public page comes down immediately, and deletion requests are completed within 30 days. Your data is never sold and never shared for anyone else's marketing. Security questions are welcome at privacy@daleelkcare.com.