Privacy Policy

1. Introduction

CME Gallery ("we," "us," or "our") is committed to protecting your personal data in compliance with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) (Royal Decree M/19, issued 9/2/1443H) and the EU General Data Protection Regulation (GDPR) for international users. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform.

2. Data Controller

CME Gallery operates as the data controller for personal data processed through this platform. For inquiries, contact us at info@cmegallery.com.

3. Data We Collect

We collect the following categories of personal data:

We do not collect sensitive health data, patient records, medical history, or any Protected Health Information (PHI). CME Gallery is an event directory — not a clinical platform.

4. Legal Basis for Processing

Under the PDPL (Article 5) and GDPR (Article 6), we process data based on:

• Consent — You provide explicit consent when creating an account or submitting events.
• Contractual necessity — Processing required to provide our services (e.g., account management, event listings).
• Legitimate interest — Analytics and service improvement, balanced against your privacy rights.

5. How We Use Your Data

• To create and manage your user account
• To display and manage event listings you submit
• To send relevant notifications about events matching your specialty (with your consent)
• To improve our platform, features, and user experience
• To comply with legal obligations under Saudi law

6. Data Sharing & Transfers

We do not sell your personal data. We may share data with:

• Service providers — Cloud hosting and authentication services that process data on our behalf, under strict contractual obligations.
• Legal authorities — When required by Saudi law or a valid court order.

Per PDPL Article 29, any cross-border data transfers are conducted only to jurisdictions with adequate data protection standards or under appropriate safeguards (e.g., Standard Contractual Clauses for GDPR compliance).

7. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy, or as required by Saudi law. Account data is deleted within 30 days of account deletion request. Event submission data may be retained in anonymized form for statistical purposes.

8. Your Rights

Under the PDPL and GDPR, you have the right to:

To exercise any of these rights, email info@cmegallery.com. We will respond within 30 days as required by law.

9. Data Security

We implement industry-standard technical and organizational measures to protect your data, including: encryption in transit (TLS/SSL), encrypted storage, access controls, and regular security assessments. In the event of a data breach, we will notify affected individuals and the Saudi Data & Artificial Intelligence Authority (SDAIA) within 72 hours as required by the PDPL.

10. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies. By using our platform, you consent to essential cookies necessary for service functionality.

11. Children's Privacy

CME Gallery is intended for healthcare professionals. We do not knowingly collect data from individuals under 18 years of age. If we become aware of such collection, we will delete the data immediately.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or a prominent notice on our platform. Continued use of CME Gallery after changes constitutes acceptance of the updated policy.

13. Governing Law & Supervisory Authority

This policy is governed by the laws of the Kingdom of Saudi Arabia. The competent supervisory authority is the Saudi Data & Artificial Intelligence Authority (SDAIA). For EU/EEA users, you may also lodge a complaint with your local data protection authority under the GDPR.