Teryaqترياق
ع Get the app

Teryaq (ترياق)

Privacy policy

What information the Teryaq app and patient portal handle, why, where it is kept, who can see it, and how you stay in control — in language as plain as we can make it.

Effective date:
Applies to:
the Teryaq mobile app, the patient portal and this website
  • We don’t sell your information, show ads, or track you across other apps and websites.
  • Your medical record is created by the hospital and seen by authorised staff according to their role.
  • Crash reports and usage statistics contain no health records, and you can turn them off in Settings.
  • You can delete your account in the app or the portal at any time; the hospital keeps your medical record, as the law requires.

Who we are

Teryaq (ترياق) is a management system for hospitals and clinics. It includes a mobile app, a web portal for patients and a dashboard for hospital staff. Teryaq is provided by Save Points (“we”, “us”), based in Unaizah, Al-Qassim Region, Saudi Arabia.

In this policy, “the hospital” means the hospital or clinic that treats you and uses Teryaq. The hospital creates and manages your medical record; Teryaq is how you see it.

Under the Personal Data Protection Law (PDPL), the hospital is the controller of your medical record and of the information it creates while treating you: it decides what that information is used for, and we process it on the hospital’s behalf and on its instructions. For your Teryaq account and the data that runs the app — such as your sign-in details, notifications and crash reports — we are the controller.

This policy covers the Teryaq mobile app, the patient web portal and this website.

The information we handle

Your account

  • Your name, email address, mobile number and preferred app language.
  • Your password — never stored as you typed it. The server keeps only a salted hash, from which the password cannot be recovered.
  • The link to your hospital file: when you create a patient account you enter your file number (MRN) and date of birth, so the system can check the file is yours and connect your account to it.
  • If you turn on two-step verification: its secret key and your recovery codes.
  • For hospital staff: the role and permissions the hospital assigns.

Your health and hospital records

The hospital creates these while treating you. They are shown to you in the app and the portal, and to authorised staff according to their role:

  • Appointments, visits and their summaries, diagnoses, prescriptions and referrals.
  • Lab results, imaging reports, vitals and documents.
  • Invoices, payments and insurance details.
  • File details such as date of birth, address and emergency contact — you can update the contact details yourself.
  • Chat messages between you and your doctor in video consultations.

We treat health information as sensitive data and protect it accordingly.

The video call itself: when you tap “Join call”, it opens outside the app through the link the hospital sends, and runs on the video-call service the hospital chooses for each consultation — Zoom, Twilio or Agora, or another service the hospital uses — under that service’s own privacy policy. The Teryaq app does not record the call.

Security information

  • A security log: sign-ins and sensitive actions — such as password resets, changes to records and account deletion — are recorded with the IP address and browser or app details, for security and audit.
  • When your account last signed in, and the IP address it signed in from.
  • Password-reset codes sent to your email. They expire quickly and are deleted once used.

Technical data through Firebase

A device token for notifications, crash reports and usage statistics — explained under Google Firebase services.

What is stored on your phone

  • Your sign-in token, in the phone’s encrypted secure storage: the Android Keystore on Android, the Keychain on iPhone.
  • Your preferences, in the app’s local storage — such as language, appearance and your choice about crash reports and usage statistics — and a copy of your basic account details (name, email, role) so the app opens quickly.
  • When you save or print a document — an invoice, a prescription or lab results — the PDF is created on your phone, and leaves it only if you choose to print or share it, going to the printer or app you pick.
  • The sign-in token and the copy of your account details are removed from the phone when you sign out or delete your account.
  • Backup of the app’s data is turned off on Android, so none of this goes into the phone’s backups.

Why we use it

  • To run your account, confirm who you are and connect you to your hospital file.
  • To show you your health records, appointments and bills, and let you book, cancel and message your doctor.
  • To let the hospital team give care, run departments and bill, each within their permissions.
  • To send notifications: in the app, as push notifications on your phone, and by email — for example password-reset codes, appointment reminders and changes, and results being ready.
  • To protect accounts and systems: spotting unauthorised sign-in attempts and auditing sensitive actions.
  • To find crashes and improve the app, through crash reports and usage statistics — which you can turn off.
  • To meet legal obligations, such as keeping medical and financial records.

We do not use your information for advertising, we do not sell it, and we do not build marketing profiles from it.

Where it is stored

  • Account data and records are kept on Teryaq’s servers, which the app and the portal reach over an encrypted connection (HTTPS). We rent these servers from the hosting provider Hostinger, and they are in the United Kingdom — so your information is transferred outside the Kingdom of Saudi Arabia and processed there, under the PDPL’s rules and regulations for transferring personal data abroad.
  • On your phone: as described in “What is stored on your phone”.
  • Data for the Firebase services is processed by Google on its servers, which may be outside the Kingdom of Saudi Arabia.

Google Firebase services

We use three services from Firebase, a platform provided by Google, which processes this data as a service provider acting for us. We do not use Firebase for sign-in, databases or file storage, and your health records are not sent to it.

ServiceWhat it collectsWhyYour choice
Firebase Cloud Messaging
Push notifications		A device token for notifications (push token).To deliver notifications to your phone. The text carries no clinical values: a result notification says only that your results are ready. Appointment notifications show the doctor’s name, date and time, and payment notifications the amount — on your lock screen too, unless your phone hides notification content.Turn notifications off in your phone’s system settings.
Firebase Crashlytics
Crash reports		Technical details of the crash (a stack trace), device model, operating system and version, app version, and an installation identifier. No health records.To find and fix crashes.Turn it off in the app’s Settings.
Google Analytics for Firebase
Usage statistics		Usage events such as the screens you open, device and operating-system details, an approximate location derived from your IP address, and an app-instance identifier. Advertising-ID collection is disabled and no health records are sent.To understand how the app is used and improve it.Turn it off in the app’s Settings.

More on how Google handles this data: Google Privacy Policy and Privacy and security in Firebase.

Who we share it with

  • Authorised hospital staff: each person sees what their job needs, according to their role and permissions.
  • Service providers acting on our instructions: Hostinger, for server hosting and email delivery, and Google Firebase as described above.
  • Public authorities, where the law requires it.

The hospital itself may share your information with others for your care or billing — for example your insurance company when a claim is made for your treatment, or lab and imaging systems it connects to Teryaq — under its own policies and the applicable law.

We do not sell your information, share it for advertising, use advertising identifiers, or track you across other apps or websites.

How long we keep it

  • Your account: until you delete it.
  • Your medical and financial records: kept by the hospital for as long as the law requires, even after your login is deleted.
  • Notifications you have read: deleted automatically 90 days after you read them.
  • The security log: two years, then deleted automatically.
  • Crash reports: 90 days, then deleted automatically by Firebase.
  • Usage statistics: data tied to a user or an event is deleted after 2 months, leaving only aggregated figures that identify no one.
  • On your phone: the sign-in token and the copy of your account details are removed when you sign out or delete your account.

How we protect it

  • An encrypted connection (HTTPS) between the app or portal and the server.
  • Passwords stored as salted hashes that cannot be reversed.
  • The sign-in token kept in the phone’s encrypted secure storage, and sign-in sessions that expire.
  • Role-based permissions, so staff see only what their job needs.
  • Two-step verification, and limits on repeated attempts at sign-in and password reset.
  • A security log of sign-ins and sensitive actions.

No protection is perfect, but we work continuously to keep your information safe. If an incident affects it, we will act as the law requires, including notifying where that is required.

Your rights and choices

Under the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia — and subject to its exceptions, such as records the hospital must keep — you have the right to:

  • Be informed about how your information is collected and used — which is what this policy is for.
  • Access your information. Most of it is visible to you in the app and the portal, and you can ask for a copy.
  • Correct it: update your contact details yourself under Profile, and ask the hospital to correct anything inaccurate in your file.
  • Delete your account at any time (see Deleting your account).
  • Withdraw consent: turn off crash reports and usage statistics in the app’s Settings, and push notifications in your phone’s system settings.
  • Contact us and complain: write to us (see Contact us), and you may complain to the competent authority under the PDPL.

We reply to requests within 30 days of receiving them. If a request needs longer, we may extend that once, by up to 30 more days, and will tell you so — and why — before the first 30 days are up.

Deleting your account

  • In the app: Settings (the gear icon on Home or Profile) → Delete account → enter your password → confirm.
  • On the patient web portal: sign in → Profile → Delete account → enter your password → confirm.

Deleted straight away: your sign-in (email address and password), your notifications, any password-reset codes, your sign-in sessions on every device, and your devices’ push tokens.

What the hospital keeps, and why: your medical record — visits, results, prescriptions and documents — and your invoices and payments, because the law requires the hospital to keep them and your doctors need your history to treat you safely. Appointments you have booked are not cancelled, and the security log keeps a note that the account was deleted, without your email address.

You can register again at any time with your file number and date of birth. Staff accounts are issued and closed by the hospital.

Step-by-step account deletion

Children and guardians

The hospital’s system may hold medical records for children, which the hospital manages under the applicable rules. Teryaq accounts, though, are for people aged 18 or over; for a younger patient, a parent or guardian deals with the hospital directly about their record and appointments.

If you learn that a child has created an account without a parent or guardian knowing, please contact us.

This website and the patient portal

  • This website uses no cookies and no analytics. It only remembers your language and appearance choice in your browser.
  • It is hosted on Firebase Hosting by Google. Everything on it — fonts, images and styles — is served from the site itself, with no third-party services, so only the hosting provider receives your IP address and browser details, as with any request on the internet.
  • The patient portal uses only essential cookies — to keep you securely signed in and to protect you against forged requests. It uses no advertising or analytics cookies.

Changes to this policy

We may update this policy when the app or the law changes. We will publish the new version on this page with its effective date, and tell you about significant changes in the app or by email.

Contact us

For any question or request about your privacy — including a copy of your information, a correction, or help deleting your account:

If you can, write from the email address on your account, so we can more easily confirm the request is yours.

Email us about your privacyHow to delete your account

For questions about your medical record or appointments, please contact the hospital directly.