Privacy policy.
Your data. Your rights. Our responsibility. Wraqah operates on a sovereign, zero-knowledge architecture in compliance with Saudi PDPL and global research standards.
Questions about your data or regulatory compliance?
dpo@wraqah.netIntroduction and identity
Wraqah ("we," "us," or "our") operates a sovereign research lifecycle management, ethical review, and publishing platform. This Privacy Policy explains how we collect, use, store, protect, and share your personal data when you use our platform at wraqah.net ("Platform").
Riyadh, Kingdom of Saudi Arabia
This policy is strictly aligned with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), National Cybersecurity Authority (NCA) essential controls, and the National Committee of BioEthics (NCBE) guidelines.
Data we collect
We collect only what is necessary to provide our services. The categories of personal data we process are:
Identity & Contact
- • Full name & Academic Credentials
- • Professional role & Institutional Affiliation
- • Email & Phone
- • ORCID iD
Authentication
- • Encrypted passwords
- • MFA records
- • Session tokens
- • SSO integration data (e.g. Nafath)
Research Metadata
- • Protocol titles & Abstracts
- • IRB submission records
- • Peer review assignments
- • Audit trails
Compliance Logs
- • Document hashing events
- • Timestamp creation
- • Certificate issuance
- • System access history
Wraqah does not sell your personal data. Research data submitted for IRB review or publishing remains strictly confidential and under the exclusive control of the principal investigator or the authorizing institution.
Legal basis for processing
| Processing Activity | Legal Basis |
|---|---|
| Account registration and platform access | Contractual necessity |
| IRB protocol submissions & ethical review | Contractual necessity / Legal obligation |
| Compliance log maintenance & audit trails | Legal obligation (PDPL / NCBE) |
| Platform analytics and security monitoring | Legitimate interest |
Data residency and sovereignty
In accordance with SDAIA's PDPL and NCA CCC-1:2020:
Local Storage
Primary data processing and storage occurs exclusively within certified, sovereign data centers located geographically within the Kingdom of Saudi Arabia.
Global Transfers
International data sharing (e.g., for multi-center global clinical trials or journal indexing) is governed by SDAIA-approved standard contractual clauses and explicit user consent.
Zero-knowledge architecture
The Wraqah platform is designed on a zero-knowledge principle, meaning sensitive research content is encrypted in a way that our staff cannot access without explicit user or authorized institution permission.
- AES-256 encryption for data at rest
- TLS 1.3 for data in transit
- Institution-managed encryption keys
- Immutable audit logs
Compliance log
Wraqah maintains comprehensive, secure, immutable compliance logs for all key data processing events. These logs are used to support regulatory audit requirements, SDAIA/NCBE audit processes, and data breach investigations if required.
Logged events include: account creation, protocol submission, ethics approval, data export, and document hash events.
Data retention
Your rights
Under the Saudi PDPL, you have the right to:
- Right to be Informed: Know how your data is used.
- Right to Access: Request a copy of your personal data.
- Right to Correction: Update inaccurate or incomplete information.
- Right to Destruction: Request deletion when data is no longer needed.
- Right to Withdraw Consent: Revoke consent for specific processing activities at any time.
To exercise these rights, contact our Data Protection Officer at dpo@wraqah.net. We respond to all requests within 30 days.