1. Scope
This addendum applies to clinics operating in the Kingdom of Saudi Arabia that use Enamela, in addition to the Terms of Service, Privacy Policy, and Data Processing Agreement. Where this addendum conflicts with those documents on a matter specific to Saudi Arabia, this addendum controls for that matter.
2. Personal Data Protection Law (PDPL)
The Kingdom's Personal Data Protection Law (PDPL) and its implementing regulations, issued and overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA), govern the collection, processing, and transfer of personal data relating to individuals in Saudi Arabia, including patient health data, which the PDPL and its regulations treat as a sensitive category of data requiring heightened care.
As between a clinic and Enamela, the clinic remains the controller of patient personal data (as described in the Data Processing Agreement) and is responsible for identifying and meeting its own obligations as a controller under the PDPL, including lawful basis for processing and any notices owed to patients.
3. Lawful basis for processing
Enamela processes patient personal data solely as a processor, on the clinic's documented instructions, to provide the scheduling, records, odontogram/treatment charting, billing, and messaging functionality described in the Terms of Service. The clinic is responsible for establishing and documenting the lawful basis (such as consent or another basis recognized under the PDPL) for its own collection and use of patient data through Enamela.
4. Cross-border transfer
Data hosted outside the Kingdom, including in Enamela's current hosting region, may be considered a cross-border transfer of personal data under the PDPL. The PDPL and SDAIA's implementing regulations set conditions under which such transfers may occur, including in some cases a requirement to demonstrate an adequate level of protection or to rely on specific safeguards.
Enamela is reviewing, with counsel, what cross-border transfer mechanism applies to Saudi clinic and patient data given its current hosting location, and will update this addendum once that review is complete [confirm transfer mechanism with counsel].
5. Health-data hosting expectations
Sector-specific guidance in Saudi Arabia may set additional expectations for hosting or localizing health-related data, beyond the general PDPL cross-border transfer rules. Clinic and patient data is currently hosted in the ap-southeast-1 (Singapore) region with our database provider, as described in the Subprocessors page. Enamela does not currently offer in-Kingdom hosting.
Whether in-Kingdom hosting is required for Saudi dental clinics using Enamela is under review with counsel before Enamela is offered to clinics for whom this is a hard requirement. Clinics with specific in-Kingdom hosting obligations should confirm their requirements with Enamela and with their own counsel before onboarding sensitive patient data.
6. No compliance claim
This addendum is a general description of the PDPL and related Saudi regulatory bodies for context. It is not legal advice, and it is not a representation or certification that Enamela or a clinic's use of Enamela complies with the PDPL, SDAIA's implementing regulations, or any other Saudi law. Clinics should seek their own legal advice on compliance.
7. Contact
Questions about this addendum can be sent to legal@enamela.app [confirm address]. [Company legal name]; [registered address].