Start with the organization that holds your record
For a ConnectX website enquiry or a direct business relationship with us, contact ConnectX. For a patient record, call or service interaction with a business using ConnectX, that organization normally determines how the record is used. Your clinic, employer or service provider is often the best first contact.
If you are unsure, you can still contact us. Tell us which organization or interaction the request concerns, without including sensitive documents. We can help identify the responsible organization and coordinate the next step.
What you can request
You can ask how your information is used, request access or a readable copy, ask for inaccurate information to be corrected or completed, request deletion where applicable, or withdraw consent for processing that relies on it. If you act for someone else, tell us that relationship so the appropriate authority can be verified.
Deleting information and closing an account are different actions. A request here does not immediately close a customer account, cancel an organization's agreement or erase a clinical record. Applicable retention duties and the rights of other people must be considered.
Personal data requests
How can we help?
A short description is enough to start. Fields marked required help us route the request and reply.
What happens next
First, identify the request. The team establishes which records and organization are involved. If something is unclear, we may ask for a narrower description.
Then, verify appropriately. Before providing records or changing information, we may need to verify identity and, where relevant, authority to act for another person. We will explain any additional information needed and the appropriate way to provide it. Do not attach identity documents or patient records to an initial public-form request.
Finally, explain the outcome. The responsible organization reviews the request, applies relevant legal requirements and responds with the action taken or an explanation of any limitation. Where information must be retained, the response should explain the reason rather than describe the record as deleted.
Saudi PDPL implementing rules generally require controllers to act on rights requests within 30 days. A permitted extension can add up to 30 days with advance notice and reasons. Verification and routing are part of handling a request; submitting this form is not confirmation that the requested change has already happened. See the official implementing regulation.
Another way to reach us
You can email support@connectai.sa with the subject “Personal data request”. Describe the type of request and the organization involved. Please keep sensitive records and identity documents out of the initial email.
Read our Privacy policy for the wider explanation of website information and customer workspace records. If your concern remains unresolved, you can contact the Saudi Data & AI Authority through its data governance platform.