Privacy Policy — “My Ocean” app

“My Ocean” is the employee self-service app of the Ocean group of companies (Ocean Medical Company and its sister companies in Saudi Arabia). It is used only by employees who have an account in the company’s HR system. This policy explains what data the app collects, why, who can see it and how it is protected, in line with the Saudi Personal Data Protection Law.

1. Data the app collects

• Login data: username and password, sent over an encrypted connection only to sign in; the password is not stored on the device. A sign-in token is kept in the device’s secure storage.
• Employment data: the app shows and submits your HR data held by the company (name, job title, company, branch, national ID/Iqama number, phone, email, joining date, leave balance, payslips, evaluations, letters and the requests you submit).
• Precise location: when you check in/out and when you start/end a customer visit. Background location only for employees classified as field representatives or sales supervisors, and only while their shift is open (from check-in until check-out), roughly once per minute, including when the screen is locked. Tracking stops automatically at check-out, and a persistent notification is shown on Android while it runs.
• Camera: photos/videos you take yourself during a customer visit or for a license renewal, only when you press the capture button.
• Microphone: a voice note you record yourself when ending a customer visit, only when you press record.
• Attachments: files (e.g. PDF) or a photo you pick yourself through the system file/photo picker. The app does not access any other files or photos.
• Device information: device type, operating system and IP address, recorded with each check-in/out.

The app contains no ads and no analytics or marketing trackers, and does not access contacts, messages or your whole photo library.

2. How we use the data

• Attendance recording and work-location verification.
• Following the routes of field representatives and sales supervisors during working hours and documenting customer visits.
• Providing HR services: leave, payroll, letters, requests and evaluations.
• Account security and legal compliance.

3. Who can see the data

• Within the company: the HR department and authorized managers/supervisors (e.g. a supervisor with tracking permission sees only their team’s locations and routes).
• Technical service providers: data is stored on servers managed by the company. In-app maps are loaded from OpenStreetMap servers, which receive only your IP address and the area being viewed. If you choose “Open in Google Maps”, the coordinates are sent to Google under its own policy.
• Authorities: where required by Saudi law.

We do not sell data or share it for advertising or marketing.

4. Security and retention

• All traffic between the app and the server is encrypted (HTTPS); the sign-in token is kept in the device’s secure storage.
• Access inside the company is controlled by per-account permissions.
• Data is kept for the duration of employment and as required by law and company policy. When employment ends, the account is deactivated.

5. Your rights

You may request access to, correction of, or deletion of your data where the law allows, through your company’s HR department. You can turn off location, camera or microphone permissions at any time in your device settings; some services (such as attendance) need location to work.

6. Children

The app is for company employees only and is not directed at anyone under 18.

7. Changes and contact

We may update this policy and will publish any update on this page with its effective date. For any privacy question, contact your company’s HR department.