Effective Date: July 22, 2026
- Introduction
Alhayek Medical Academy (AMA) is strictly committed to protecting the privacy of the users of the Academy’s website and learning platform (which is fully owned, operated, and managed by the Academy). We process all personal data lawfully, fairly, transparently, and securely. This Privacy Policy has been carefully prepared with direct reference to the Jordan Personal Data Protection Law No. 24 of 2023 and any mandatory data protection regulations applicable in the user’s country of residence.
- Scope of this Policy
This Policy applies strictly to the Academy’s website, its learning management system (LMS), student accounts, courses, question banks (Q-banks), recorded lectures, mock examinations, live sessions, official support channels, payment and invoicing activities, and Academy-managed student communities. Third-party websites, tools, integrations, and services operate under their own independent privacy policies.
- Data Controller and Contact Details
The legal data controller is Alhayek Medical Academy (AMA), an independent medical training entity registered in Jordan. All privacy enquiries, data-subject access requests, or compliance questions must be submitted to our designated privacy channel Support@alhayekacademy.com. The Academy’s official communication channels are listed in Section 20.
- Personal Data We Collect
Depending on the specific services utilized, the Academy may collect and process the following categories of personal data:
Account Data: Including full legal name, professional email address, telephone number, country of residence, secure login credentials, purchased courses, and active subscription plans.
Learning & Academic Data: Including overall course progress, quiz results, exam attempts, lecture-viewing metrics, and educational enquiries.
Technical & Security Data: Including IP addresses, device types, browser specifications, login timestamps, linked devices (for session control), error logs, password-recovery tokens, and logs of suspected unauthorized activity.
Payment & Invoicing Data: Including transaction amounts, currency, timestamp, reference numbers, payment status, and metadata required for secure payment processing and compliance with applicable electronic invoicing laws and tax regulations.
Support & Communication Data: Including historical emails, WhatsApp messages, official complaints, refund requests, and direct support-related correspondence.
- Payment Card Information
All credit/debit card information and billing credentials are processed directly by securely integrated payment gateways or accredited financial institutions. The Academy does not capture, receive, view, or retain complete card numbers or card security codes (CVV/CVC). Payment providers process this sensitive financial metadata under their own independent security frameworks and privacy terms.
- Dynamic Watermarking and Anti-Piracy Measures
Course videos display a dynamic, translucent and non-obstructive watermark showing the registered e-mail address of the account and an internal tracking identifier uniquely linked to it; lesson PDFs carry the tracking identifier. The watermark moves around the screen and stays visible in full-screen mode. The account’s phone number is never displayed. These watermarks and the related access records are processed strictly to investigate unauthorised recording, redistribution, illegal account sharing or copyright infringement. A watermark match will not, by itself, be treated as absolute or conclusive proof of intentional misconduct without a thorough human review of the surrounding evidence.
- Purposes of Processing
The Academy processes personal data to create and maintain secure student accounts; deliver purchased courses and subscriptions; monitor academic learning progress; administer live sessions; process payments and issue statutory invoices; provide technical and educational support; prevent fraud, software piracy, and illicit account sharing; investigate policy and copyright violations; send service notices; optimize platform performance and curriculum content; comply with legal, corporate, and tax obligations; and manage refund requests or payment disputes.
- Educational Disclaimer and Limitation of Liability
The primary purpose of the services provided across the platform is to offer preparation materials and test-taking simulations to assist users in preparing for the Prometric exams. The Academy provides these tools for educational purposes only. The Academy does not guarantee, explicitly or implicitly, that any user will pass the official licensure exams. The Academy accepts no responsibility or legal liability for the user’s official exam results, subsequent employment status, or any professional decisions made based on the platform’s content.
- Legal Bases for Processing
Depending on the specific context, our data processing activities are based on the performance of the user agreement (Terms of Service), compliance with binding legal obligations, the user’s explicit consent where required, the protection of our legal rights, and the Academy’s legitimate interests in operating, securing, and improving its educational services—provided those interests do not override the user’s fundamental privacy rights. Consent may be withdrawn by the user at any time without affecting the lawfulness of processing carried out prior to withdrawal.
- Cookies and Tracking Technologies
The platform utilizes essential cookies, local browser storage, and similar technologies to maintain active login sessions, remember user preferences, facilitate secure checkout functions, analyze platform performance metrics, and detect unauthorized security breaches. Consent will be explicitly requested for non-essential cookies (such as analytics or marketing) where mandated by applicable law.
- Third-Party Service Providers and Data Sharing
The Academy does not sell, trade, rent, or lease personal data to third parties. Data is shared only to the extent reasonably necessary with external entities to facilitate service delivery, including web hosting and LMS infrastructure providers, payment gateways, electronic invoicing providers, competent tax authorities (where legally mandated), automated email/messaging engines, virtual classroom platforms, cyber-security systems, professional corporate advisors, and public or judicial authorities acting under a valid legal order. All service providers are bound to process data strictly for authorized purposes and under strict confidentiality safeguards.
- External Communication Platforms (WhatsApp / Telegram)
When users opt to communicate with the Academy or participate in student communities via WhatsApp, Telegram, or other external communication channels, those independent networks process data under their own respective privacy policies. Users are strictly advised not to post sensitive medical, financial, or state-issued identification data within public or group community channels.
- International Data Transfers
Certain cloud service providers and infrastructure utilities utilized by the Academy may process or store data outside the borders of Jordan. Where personal data is transferred internationally, the Academy enforces legally appropriate safeguards and takes all reasonable administrative measures to ensure an adequate level of data protection in alignment with applicable regulations.
- Data Retention Framework
Personal data is retained only for the duration necessary to fulfil the specific purposes outlined in this Policy. Account and academic learning records are preserved while the user account or subscription is active, and for a reasonable, statutory period thereafter to address technical enquiries or legal claims. Transaction and invoicing data are strictly retained for the periods mandated by applicable statutory and tax laws. Security and system logs are kept for a duration reasonably necessary to detect, audit, and investigate system misuse. Data is permanently deleted or irreversibly anonymized when a continuing legal, contractual, or operational necessity no longer exists.
- Technical Security Measures
The Academy applies proportionate administrative, technological, and organizational safeguards designed to protect personal data. These measures include strict database access controls, robust account password protection frameworks, real-time monitoring of suspicious access patterns, secure data backups, encrypted communication protocols (SSL/TLS), and restricted access permissions for staff and third-party vendors. While no electronic transmission or cloud system is completely secure, the Academy maintains reasonable precautions to reduce foreseeable risks.
- Automated Monitoring and Administrative Decisions
Automated systems may flag anomalies such as simultaneous logins from distinct geographical locations, suspected account sharing, attempted financial fraud, or unauthorized video recording/scraping. A final administrative decision producing a material adverse effect—such as the permanent termination of an account or suspension of a paid subscription—will never be executed solely based on an automated alert without direct human intervention and thorough review. Affected users have the right to request a formal human review by contacting our support email.
- User Rights
Subject to the limitations of applicable local law, users possess the right to request access to their personal data, receive a portable copy of their records, demand the correction of inaccurate data, request deletion where no lawful ground for retention exists, restrict specific processing parameters, object to eligible processing actions, withdraw previously given consent, opt out of direct marketing, and lodge a formal complaint with a competent data protection authority. The Academy reserves the right to request reasonable documentation to verify the identity of the requester prior to executing data right requests.
- Age Restrictions (Adults Only)
The platform is designed and intended exclusively for adult users aged 18 or older who are pursuing professional medical licensure. The Academy does not knowingly collect personal data from minors. Any account discovered to be created in violation of this requirement will be closed immediately and its data deleted, subject to mandatory statutory retention laws.
- Marketing Communications
Marketing and promotional updates will only be transmitted where permitted by law or with the user’s explicit consent. Users can choose to opt out of promotional communications at any time. Opting out of marketing channels will not halt essential operational, transactional, security, or account-related notices.
- Data Breaches and Policy Updates
In the event of a verified personal data breach, the Academy will investigate, contain, and fully document the incident, and will notify the competent supervisory authority and affected users where explicitly mandated by law. This Policy may be periodically updated to reflect evolving legal, technological, or service developments. Material changes will be communicated transparently through prominent platform announcements or registered email addresses within an appropriate period before taking effect.
- Official Contacts
- Privacy and Data Subject Requests: Support@alhayekacademy.com
- GCC WhatsApp Support: +966 56 796 1168
- Jordan WhatsApp Support: +962 7 9080 7575
- Language and Controlling Version
This Policy may be published in both Arabic and English. The English version shall be the controlling and governing version in the event of any interpretive ambiguity or conflict between the translations. Nothing in this Policy operates to limit or waive any mandatory consumer protection or privacy rights that cannot be lawfully waived in the user’s jurisdiction of residence.