Privacy Policy

Introduction & Scope

We are Ina Alhaditha Establishment (Commercial Registration (Unified National No.) 7041568580), with our main headquarters in Makkah, Kingdom of Saudi Arabia. This policy explains how we process your personal data when you use:

• Our website eeina.com and application site app.eeina.com
• EEINA applications on iOS and Android
• Communication channels via WhatsApp and email lists
• Integrations with grocery delivery and licensed merchant partners

This policy applies to all personal data we collect or process about you in the context of using our services, whether you are an individual consumer or a business representative.

Data We Collect

We collect only the data necessary to provide and improve the service, in accordance with the principle of data minimization. The main categories include:

1. Personal Information & Location

• Basic Info: First name, last name, email, phone number, date of birth (dob), gender, and a short bio.
• Authentication IDs: Google ID for social login.
• Location details: Zip code, city, street address, and country.

2. Profile Media

• Images: Profile picture and cover photo.

3. Health Profile

• Basic Measurements: Height and weight.
• Body Composition: Body fat percentage, muscle mass, and BMI.
• Conditions & Advice: Existing health conditions, doctor's advice, restricted nutrients, and recommended nutrients.
• Cholesterol & Blood Sugar: Total cholesterol, LDL, HDL, triglycerides, glucose, insulin, and HOMA-IR.
• Liver Function: AST, ALT, ALP, and GGT.
• Kidney Function: Urea, creatinine, eGFR, and uric acid.
• Vitamins & Minerals: Vitamin D, Vitamin B12, iron, and ferritin.
• Thyroid Function & Inflammation: T3, T4, TSH, and CRP.

4. Authentication, Security & Status

• Security: Hashed password, locked status, and login attempts tracking.
• Verification: Email and phone verification status.
• Account State: Role, status, last login time, and last password change time.
• Referrals: The user's unique referral code and who referred them.
• Onboarding: Profile completion percentage.

5. Diet Preferences

• Diet Types: Preferred diet categories and religious restrictions (e.g., halal, kosher).
• Restrictions: Allergies and food intolerances.
• Tastes & Ingredients: Preferred taste profiles (e.g., spicy, savory), favorite ingredients, disliked ingredients, and preferred cuisines.
• Cooking: Preferred cooking methods.

6. Cooking Context

• Cooking Abilities: Cooking skill level (e.g., beginner).
• Resources: Time available for cooking, budget constraints, and currently available ingredients.

How We Collect Your Data

• Directly from you: during registration, completing the quiz, or contacting support
• Automatically: via cookies (see the Cookies section) and server logs
• From grocery and delivery partners: when integrating your shopping list with them (with your consent)
• From other users: during comments, reviews, or referrals

How We Use Your Data

We use your data for the following legitimate purposes:

1. Providing the service (account creation, verification, displaying recipes and plans)
2. Personalizing content and improving recommendations based on your preferences
3. Sending service notifications (order confirmation, medicine reminders, plan updates)
4. Aggregated analytics (without identifying you) to understand user behavior
5. Sending marketing newsletters · only with your separate consent, and you can unsubscribe at any time
6. Complying with legal and regulatory obligations in the Kingdom

Parties We Share With

We do not sell or trade your personal data. We share it only to the extent necessary to provide the service, with the following categories:

• Technical service providers: such as cloud hosting, analytics, and Google sign-in; they process data on our behalf, under our instructions and data-processing agreements.
• Licensed payment providers: to process subscriptions and refunds. Your full card details never reach our servers; we keep only the order number, payment status, and the last four digits of the card (where applicable) for accounting purposes.
• Grocery and delivery partners: only when you choose to connect your shopping list or place an order, with your consent, and limited to the minimum needed to fulfil it.
• Government and judicial authorities: where a legal obligation or an enforceable order requires it.

We do not disclose your data to any party outside these categories.

Data Storage and Transfers

Your personal and health data is stored with a licensed cloud provider inside the Kingdom of Saudi Arabia.

Certain non-sensitive media, such as images and visual files, may be stored with hosting providers outside the Kingdom. Any such transfer is carried out only where it ensures a level of protection no lower than that required by the Personal Data Protection Law and its Implementing Regulations, including Article 29 on transfers outside the Kingdom, and is limited to the minimum necessary to provide the service.

Data Retention Period

We keep your data for as long as your account is active. When you delete your account, your personal data is deleted from our active systems within no more than thirty (30) days of the request, and any isolated backup copies are permanently erased within no more than ninety (90) days, except where the law requires retention:

• Invoices and financial and tax records: kept for the periods required by accounting and tax regulations in the Kingdom.
• Security and fraud-prevention logs: kept only as long as needed to protect the service and evidence compliance, then deleted.
• Sensitive health data: erased within the same windows and never retained for any other purpose.

Anything retained under these exceptions is isolated, limited to the minimum necessary for that legal purpose alone, and deleted once its period ends.

Securing Your Data

We apply technical and organizational measures appropriate to the nature and risks of the data, including: encryption in transit and at rest, storing passwords as irreversible hashes, restricting internal access on a least-privilege basis, and monitoring systems with periodic access reviews.

That said, no method of transmission or storage is absolutely secure, and we cannot guarantee absolute data security.

Incident notification: if a breach affecting your personal data occurs, we notify the competent authority (SDAIA) within the statutory periods and inform affected users without undue delay — and within 72 hours of confirming an incident that poses serious harm — describing its nature and the measures taken.

Your Rights Under PDPL

The Saudi system grants you the following rights, which you can exercise by emailing our Data Protection Officer:

1. Right to be informed of the purposes of processing and its legal basis
2. Right of access to your data stored with us
3. Right to rectification or update of inaccurate data
4. Right to destruction (deletion) when the purpose for its collection ceases to exist
5. Right to restrict processing in cases of objection or dispute
6. Right to data portability to another service provider (to the extent technically possible)
7. Right to object to processing for unlawful purposes
8. Right to withdraw consent at any time, without affecting the lawfulness of previous processing

We commit to responding to your request within 30 business days. If you are not satisfied with our response, you have the right to lodge a complaint with SDAIA via the National Personal Data Protection Platform.

Cookies Policy

This section applies to our marketing website eeina.com. The app (app.eeina.com) contains no third-party tracking or analytics tools. On the website we use cookies and browser storage (Local/Session Storage) in three categories:

• Necessary & Functional cookies (consent not required): used for login sessions, storing your cookie consent preference, and remembering UI states (like dismissed banners, personal health goals, or article voting).
• Analytics cookies (opt-in consent): to measure performance and improve the site via Google Analytics.
• Marketing cookies (opt-in consent): for retargeting via Meta and Google.

Protection of Minors

Our services are for users aged 13 or older; users under 18 need guardian consent. We do not knowingly collect data from children under 13, and if we discover such an account we delete it immediately and contact the guardian.

Policy Updates

When we update our policy, we will notify you via email.