Privacy and data use

Who is responsible

Osamah Albelaikhi, Riyadh, Saudi Arabia, operates this independent professional portfolio and determines how its application data is used. Use the privacy request form below to contact him. The portfolio is not a hospital service or a medical-record system.

Public browsing

The public portfolio does not add advertising trackers, Google Analytics, fingerprinting or a persistent visitor identifier. Opening My Travel Choices takes you to a separate website with its own privacy notice.

Private project access

A recipient link is associated with an internal recipient label and one project. The application keeps the link status and expiry, counts of link openings and successful access, dates needed to manage access, and your measurement choice with its date and notice version. These records are linked to the invitation and are not anonymous. Passcodes are hashed; access cookies are signed. Owner sessions last up to 12 hours. Security and access records support the legitimate interest in protecting and operating controlled project delivery; they are not used for advertising.

Optional usage measurement

You can separately allow measurement of prototype starts, screens, predefined feature actions and document openings. This optional measurement is based on your consent and starts only after you allow it. Declining does not prevent access. Change the choice on your project page at any time; withdrawing it stops future optional events. Essential access records continue. Request deletion of earlier records below. The measurement stores a random page-session identifier and predefined event names, not typed form contents or secret-link addresses.

Demonstrations and your submissions

Use synthetic examples only. Some shared demonstrations save scenario inputs so their screens can stay in sync; do not enter real names, contact details, health information or patient records. Privacy requests collect your reply email, request type, optional message, reference and handling status to meet data-protection obligations and answer you. Providing contact information is optional unless you want a reply or help with a request. Identity may need to be verified proportionately before records are disclosed, corrected or deleted.

Cookies, security and providers

Essential cookies maintain owner or recipient access, including the recipient's measurement choice. No additional consent cookie or advertising cookie is added by the application. Hosting and authentication are provided through OpenAI Sites, with Cloudflare network and database infrastructure. These providers necessarily receive technical request information, such as IP addresses and browser headers. The application uses short-lived keyed hashes of client addresses for abuse prevention and does not write raw addresses into activity records. Provider logs and backups are separate from the application's records. Processing may occur outside Saudi Arabia; this notice makes no Saudi-only storage or regulatory-certification claim.

Retention and deletion

Detailed access and optional activity events older than 365 days are removed when activity is recorded or the owner opens the dashboard; there is no daily cleanup schedule. Link labels and cumulative access counters remain while the invitation is managed and can be erased by the owner on request. Expired owner sessions are rejected immediately and cleaned during owner authentication; request-limit hashes are cleaned after 24 hours when that protection is used. Privacy requests remain while being handled, then are deleted 365 days after closure when the owner opens the privacy inbox. These are operating retention periods, not periods prescribed by SDAIA. Shared synthetic simulation records and provider backups have separate lifecycles; ask for review if personal information was entered accidentally.

Your rights and response times

You may request information about processing, access, a readable copy, correction or deletion of your personal data, and withdraw consent for optional measurement. Requests are reviewed under the Saudi Personal Data Protection Law, including applicable exceptions and other people's rights. The response period is normally no more than 30 days; if a permitted extension is needed, you will be informed of the reason before an additional period of up to 30 days. You may also complain to SDAIA through the National Data Governance Platform.

Privacy request or contact