Privacy and Personal Data Protection Policy

This policy sets out the general rules governing the collection, processing, use, disclosure, retention and protection of personal data when using the ATHLENIXS® website, platform and digital services.

This policy applies to the website, the platform and the related digital services, and to employees, contractors and service providers according to their roles. The company's responsibilities as a controller or as a processor are determined by the nature of the service and the relevant agreements.

The company is committed to specifying the purposes of processing, minimising data to what is necessary, data accuracy, restricting access, retaining data only for as long as necessary, protecting data, and respecting the rights of data subjects, in accordance with the laws and regulations in force in the Kingdom of Saudi Arabia.

The data processed through the platform may include:

• Account, identity, contact, subscription and billing data, and usage logs.
• Athlete data relating to age, performance, training and attendance, and location data where it is enabled.
• Injury data or health information uploaded by the client.
• Analysis outputs and risk indicators.

Sensitive data is collected only for a legitimate purpose, on a lawful basis, and with appropriate controls.

Data is processed to create accounts, manage subscriptions, operate the platform, provide analytics and reports, support athlete development, analyse performance and risk, secure the service, provide technical support, and meet legal and contractual obligations.

Processing is carried out under the Saudi Personal Data Protection Law and its regulations, on the lawful basis applicable to the case. A privacy notice is provided before data is collected, and consent is requested where the law requires it. Corporate clients must ensure they have the authority and the lawful basis to share athlete data.

Where data of minors, health data or other sensitive data is processed, the relevant legal requirements apply, including the required consents, access controls, data minimisation, purpose limitation and retention periods.

The platform may produce indicators, analyses and explanatory recommendations that support decision-making. These outputs do not constitute a medical diagnosis, a guarantee of outcomes, or a binding insurance underwriting decision, unless stated otherwise within a service that is legally authorised and covered by a written agreement. Final professional decisions remain with the authorised parties.

Data is shared only with authorised parties and for legitimate purposes, including the corporate client, hosting, support and integration providers, and competent authorities where there is a lawful justification. The roles and obligations of service providers are set contractually, and data processing agreements are concluded where needed.

Transferring data outside the Kingdom, or making it available there, is subject to the applicable legal requirements and safeguards.

Data is kept for as long as necessary for the stated purposes and for legal and contractual obligations, then deleted, destroyed or de-identified under approved procedures, unless the law requires it to be retained.

Data subjects exercise their rights under the law and as applicable. These may include:

• The right to be informed.
• The right to access their data and obtain a copy of it.
• The right to correction or updating.
• The right to destruction where its conditions are met.
• The right to withdraw consent where consent is the lawful basis for processing.

Requests are submitted through the approved contact channel, after appropriate identity verification.

Appropriate organisational and technical measures are applied to protect data. Security incidents are handled under response procedures and the applicable legal reporting and notification requirements.

The policy owner reviews this policy when services, systems or processing practices change, and any material update is announced when it is published.