Privacy Policy

1. Introduction

The Scientific Center for Autism & Developmental Disorders ("SCADD", "we", "our", or "us") is committed to protecting the privacy, confidentiality, dignity, and personal information of individuals who interact with SCADD.

This Privacy Policy explains how SCADD collects, uses, stores, discloses, transfers, protects, and manages personal data obtained through:

• www.scadd.jo;
• SCADD website forms;
• appointment and consultation requests;
• training registration forms;
• WhatsApp communications initiated through SCADD;
• email communications;
• telephone inquiries;
• social-media inquiries;
• advertising campaign landing pages;
• event and course registrations;
• website analytics;
• recruitment forms where applicable; and
• other SCADD digital channels that refer to this Privacy Policy.

SCADD provides behavioral therapy, autism and developmental services, speech and language services, occupational therapy, psychology services, assessments, consultations, education, clinical training, workforce development, and related professional services.

This Privacy Policy primarily governs website and digital-contact information.

Once an individual formally becomes a SCADD clinical client, additional clinical consent forms, confidentiality requirements, record-management policies, service agreements, professional standards, and legal obligations may also apply.

2. Data Controller

For personal data collected through the SCADD website and SCADD-controlled digital channels, the data controller is:

Scientific Center for Autism & Developmental Disorders – SCADD
Amman, Hashemite Kingdom of Jordan
Website: www.scadd.jo
Privacy Email: privacy@scadd.jo

SCADD determines why and how personal data under its control is processed.

3. SCADD Data Protection Officer

SCADD maintains a designated Data Protection Officer ("DPO") responsible for overseeing personal-data-protection matters within the organization.

The DPO's responsibilities include, as applicable:

• overseeing compliance with applicable personal-data-protection requirements;
• advising SCADD management on privacy obligations;
• overseeing processing involving sensitive personal data;
• monitoring processing involving children and persons represented by parents or legal guardians;
• maintaining records of relevant processing activities;
• reviewing privacy risks;
• supporting Data Protection Impact Assessments where appropriate;
• overseeing responses to data-subject requests;
• reviewing processors and subprocessors;
• supervising personal-data breach procedures;
• reviewing international data transfers;
• monitoring marketing-data use;
• reviewing new systems that process personal information; and
• acting as a point of contact for privacy-related matters.

Contact the DPO

Data Protection Officer
Scientific Center for Autism & Developmental Disorders – SCADD
Amman, Jordan
Email: privacy@scadd.jo

A person does not need to be a SCADD client to contact the DPO or make a privacy request.

4. Categories of Personal Data We Collect

The information SCADD collects depends on the nature of the individual's interaction with us.

4.1 General Contact Data

We may collect:

• full name;
• mobile telephone number;
• landline telephone number;
• email address;
• country;
• city;
• preferred method of communication;
• organization or employer;
• professional position;
• language preference;
• source of inquiry; and
• content of the communication.

4.2 Service Inquiry Data

Where someone contacts SCADD regarding therapy, assessment, consultation, school support, or another service, we may collect:

• requested service;
• relationship of the person making the inquiry to the prospective client;
• prospective client's name;
• child's or client's age;
• general reason for seeking the service;
• preferred appointment arrangements;
• referral source;
• previous interaction with SCADD; and
• other information voluntarily submitted.

SCADD seeks to minimize the amount of sensitive information collected during an initial website inquiry.

5. Sensitive and Clinical Personal Data

SCADD may process sensitive personal data when required for the provision of legitimate clinical, therapeutic, assessment, educational, administrative, or professional services.

Such information may include:

• physical or mental health information;
• developmental information;
• autism-related information;
• disability-related information;
• behavioral information;
• psychological information;
• diagnostic information;
• therapy history;
• assessment results;
• speech and language information;
• occupational therapy information;
• educational and developmental needs;
• treatment recommendations;
• clinical progress information; and
• other health-related information.

Unless SCADD specifically requests them through an appropriate process, users should not submit through a general website contact form:

• full diagnostic reports;
• medical reports;
• psychological reports;
• therapy notes;
• identification documents;
• detailed treatment histories;
• video recordings of a child;
• assessment reports; or
• other extensive sensitive documentation.

SCADD may direct the individual to an appropriate channel when additional information is required.

6. Children and Legally Represented Individuals

A substantial part of SCADD's services concerns children.

Where information concerns a child or another individual who requires legal representation, information should be submitted by or with the authorization of an appropriate:

• parent;
• legal guardian; or
• legally authorized representative.

Where appropriate, SCADD may verify the requesting individual's authority before:

• opening a clinical record;
• providing sensitive information;
• providing copies of records;
• modifying information;
• deleting information;
• transferring information; or
• acting on a data-subject request.

7. Information Collected for Training and Professional Education

Participants in programs offered through the SCADD Behavioral Institute for Education & Clinical Training may provide:

• full name;
• telephone number;
• email address;
• nationality or country of residence;
• academic qualifications;
• profession;
• employer;
• professional certification information;
• course registration details;
• attendance;
• assessment results;
• competency assessment information;
• certification status;
• payment information;
• invoices;
• receipts; and
• communications concerning the course.

This information may be processed to:

• administer courses;
• communicate with trainees;
• record attendance;
• conduct assessments;
• manage competency requirements;
• issue certificates;
• maintain training records;
• comply with accreditation or certification requirements;
• process payments; and
• provide relevant educational administration.

Training information is maintained separately from clinical records where appropriate.

8. Why SCADD Processes Personal Data

SCADD processes personal information only for identified and legitimate purposes.

These may include:

8.1 Responding to an Inquiry

To respond to a person's request concerning a SCADD service, program, course, employment opportunity, partnership, consultation, or other legitimate matter.

8.2 Arranging Services

To arrange:

• appointments;
• assessments;
• consultations;
• therapy;
• training;
• meetings;
• school support; or
• other requested services.

8.3 Providing Services

To provide clinical, educational, administrative, training, consulting, or professional services.

8.4 Communication

To communicate regarding the specific relationship or inquiry through an appropriate channel such as:

• telephone;
• WhatsApp;
• email;
• SMS; or
• another communication platform.

8.5 Administration and Finance

To manage:

• registration;
• attendance;
• scheduling;
• invoicing;
• payments;
• receipts;
• financial records;
• certificates;
• contracts;
• service documentation; and
• other legitimate administrative matters.

8.6 Legal and Professional Compliance

To satisfy applicable:

• legislation;
• regulatory requirements;
• professional obligations;
• accreditation requirements;
• court orders;
• contractual obligations; and
• lawful governmental requests.

8.7 Safety and Security

To protect:

• clients;
• children;
• trainees;
• personnel;
• information systems;
• SCADD facilities;
• digital infrastructure; and
• personal information.

8.8 Website Operation and Improvement

To maintain website functionality, security, analytics, technical performance, and user experience.

8.9 Marketing

To communicate information about SCADD services, courses, programs, events, or activities only where SCADD has an appropriate lawful basis and, where required, the individual's specific marketing consent.

9. Service Communication Is Separate From Marketing Consent

SCADD distinguishes between:

A. Service or inquiry communications

Communications necessary to answer an individual's request or manage an existing relationship.

Examples include:

• responding to a therapy inquiry;
• confirming an appointment;
• sending course registration information;
• communicating an invoice;
• following up on an assessment request;
• advising a registered trainee about a course; or
• contacting a parent regarding an existing service.

B. Marketing communications

Communications intended to promote additional or unrelated SCADD services, courses, events, offers, or activities.

An individual may withdraw marketing consent at any time.

Withdrawal from marketing does not prevent SCADD from sending necessary communications concerning an active service, appointment, contractual relationship, financial obligation, training registration, or other legitimate operational matter.

10. Marketing Consent

Where SCADD relies on consent for marketing, consent will be sought separately from ordinary service-processing authorization.

Marketing consent must not be made a condition for receiving therapy, assessment, consultation, training, or another SCADD service unless marketing is genuinely integral to the particular service.

SCADD may maintain records showing:

• when consent was obtained;
• the source of consent;
• the wording presented;
• the communication channels authorized;
• the purposes authorized;
• subsequent changes to consent; and
• withdrawal or opt-out requests.

Individuals may withdraw marketing permission through:

privacy@scadd.jo

or through any unsubscribe or opt-out mechanism provided in the communication.

11. Meta, Social Media and Custom Advertising Audiences

SCADD may use digital advertising platforms, including Meta technologies, where appropriate.

SCADD will not intentionally upload the following information to Meta or another advertising platform for audience targeting:

• autism diagnosis;
• disability status;
• medical conditions;
• psychological information;
• behavioral records;
• assessment results;
• treatment information;
• therapy notes;
• clinical progress records;
• child clinical records;
• speech or occupational therapy records; or
• other sensitive health information.

Where SCADD intends to use identifiable contact information, such as an email address or telephone number, for advertising-platform audience matching, SCADD will only do so where there is an appropriate legal basis and any required specific consent has been obtained.

SCADD will maintain records sufficient to identify the authorized marketing source of contacts used in such advertising activities.

Contacts whose information originates solely from clinical or sensitive-data systems must not be transferred into advertising audiences merely for convenience.

SCADD may maintain separate marketing datasets specifically designed for authorized advertising use.

12. WhatsApp and Messaging Platforms

A visitor may choose to contact SCADD through WhatsApp, Instagram, Facebook, or another external messaging platform.

When an individual chooses such a platform, the platform operator may process information according to its own terms and privacy practices.

SCADD may retain relevant communications where required to:

• answer the inquiry;
• arrange services;
• document instructions;
• provide services;
• maintain operational records; or
• satisfy legal or professional requirements.

Users should avoid sending extensive clinical documentation through social-media direct messages.

Where detailed sensitive information is required, SCADD may direct the user to a more appropriate communication or record-management process.

13. Cookies and Tracking Technologies

The SCADD website may use cookies and similar technologies.

These may include:

Essential Technologies

Used for:

• website operation;
• cybersecurity;
• forms;
• navigation;
• session management; and
• essential functionality.

Analytics Technologies

Used to understand website performance and user interaction.

Advertising Technologies

Where enabled and appropriately authorized, these may be used to:

• measure advertising effectiveness;
• understand campaign attribution;
• measure conversions; or
• support authorized digital advertising.

Where required, non-essential analytics or advertising technologies will be subject to an appropriate consent mechanism.

Users should be provided with reasonable controls to manage available cookie preferences.

14. Processors and Service Providers

SCADD may appoint third-party organizations to process personal data on SCADD's behalf.

Depending on the systems actually used by SCADD, processors may provide functions including:

• website hosting;
• cloud infrastructure;
• website forms;
• email;
• messaging;
• cybersecurity;
• data storage;
• clinical information systems;
• customer or contact management;
• training administration;
• accounting;
• payment processing;
• analytics;
• digital advertising;
• document management; and
• information technology support.

SCADD maintains a Processor and Subprocessor Register identifying relevant providers and the personal data they process.

Before introducing a material system that processes personal or sensitive data, SCADD should assess:

• the purpose of processing;
• categories of information involved;
• affected individuals;
• hosting or processing location;
• international transfer implications;
• security arrangements;
• processor obligations;
• retention;
• access rights;
• deletion arrangements;
• subprocessors; and
• the level of privacy risk.

Access by providers should be limited to information reasonably necessary for the services being supplied.

15. Disclosure of Personal Data

SCADD does not sell its patient, client, trainee, or website contact databases as commercial contact lists.

Personal data may be disclosed where reasonably necessary to:

• authorized SCADD employees;
• clinicians;
• clinical supervisors;
• training personnel;
• administrative personnel;
• finance personnel;
• management;
• authorized technology personnel;
• contracted processors;
• professional advisers; or
• competent governmental, judicial, regulatory, or legal authorities where disclosure is lawfully required.

Access within SCADD should follow role, purpose, confidentiality, and need-to-know principles.

16. International Data Transfers

Some SCADD technology providers may operate or host infrastructure outside Jordan.

This may include providers of:

• cloud computing;
• communications;
• messaging;
• analytics;
• advertising;
• cybersecurity;
• training technology; or
• other digital infrastructure.

Before making applicable international personal-data transfers, SCADD will consider:

• the purpose of the transfer;
• identity or category of recipient;
• information being transferred;
• applicable legal requirements;
• security safeguards;
• contractual arrangements;
• sensitivity of the information;
• appropriate authorization or consent where required; and
• whether the transfer is necessary and proportionate.

SCADD will maintain appropriate records of relevant data transfers.

Sensitive clinical information receives additional review before international transfer.

17. Data Retention

SCADD applies retention periods according to the purpose and category of information.

General Website Enquiries

Normally retained for up to 24 months after the last meaningful interaction, unless a shorter or longer period is justified.

Marketing Records

Retained while the marketing relationship remains valid and subject to periodic review.

Where a person opts out, SCADD may retain minimal suppression information necessary to continue honoring the opt-out.

Website Security Records

Maintained only as reasonably necessary for:

• cybersecurity;
• technical operations;
• fraud prevention;
• investigations; or
• system integrity.

Training Records

May be retained for longer periods where necessary for:

• attendance evidence;
• competency records;
• certification;
• accreditation;
• payment records; or
• professional education history.

Clinical Records

Clinical records are subject to SCADD's clinical record-retention policy and applicable professional, contractual, accreditation, and legal requirements.

They are not governed solely by the general website enquiry period.

Financial and Contractual Records

Retained as required by applicable accounting, taxation, contractual, audit, and legal requirements.

At the end of the applicable retention period, information should be securely:

• deleted;
• destroyed;
• anonymized;
• concealed; or
• otherwise rendered inaccessible,

subject to applicable legal obligations.

18. Personal Data Rights

Subject to applicable law and relevant limitations, individuals may request to:

• know whether SCADD processes their personal information;
• access applicable personal information;
• obtain a copy of applicable data;
• correct inaccurate information;
• modify, complete, or update information;
• restrict processing;
• request deletion, erasure, concealment, or anonymization where applicable;
• withdraw prior consent;
• object to applicable processing;
• object to inappropriate profiling;
• request applicable data portability; and
• obtain legally required information relating to a personal-data breach.

Requests may be submitted to:

privacy@scadd.jo

SCADD may verify identity and legal authority before fulfilling a request.

Where a request concerns a child, SCADD may require verification of parental or legal-guardian authority.

Some information may need to be retained notwithstanding a deletion request where SCADD has a lawful obligation or legitimate legal basis requiring continued retention.

19. Withdrawal of Consent

Where processing is based upon consent, individuals may withdraw consent applicable to future processing.

Withdrawal does not automatically invalidate lawful processing performed before withdrawal.

Marketing consent is treated separately from authorization necessary to administer an existing clinical, contractual, financial, or training relationship.

Requests may be sent to:

privacy@scadd.jo

20. Security

SCADD applies reasonable administrative, technical, organizational, and physical controls appropriate to the nature and sensitivity of personal information.

Controls may include:

• role-based access;
• password and authentication controls;
• access logging;
• staff confidentiality obligations;
• information-security procedures;
• restricted clinical access;
• backup procedures;
• secure storage;
• cybersecurity controls;
• staff training;
• processor assessment;
• incident-response procedures; and
• secure disposal procedures.

Personnel should have access only to information reasonably required for their duties.

No electronic environment can guarantee absolute security; however, SCADD seeks to continuously assess and reduce information-security and privacy risks.

21. Data Protection Impact Assessment

SCADD may conduct a Data Protection Impact Assessment or other documented privacy-risk assessment before introducing or materially changing processing that may create significant privacy risks.

Particular consideration should be given to projects involving:

• sensitive health information;
• children;
• persons requiring legal representation;
• large databases;
• systematic monitoring;
• behavioral profiling;
• automated decision-making;
• artificial intelligence;
• new clinical technologies;
• biometric information;
• large-scale advertising matching; or
• significant international transfers.

22. Personal Data Breaches

SCADD maintains procedures for responding to suspected or confirmed personal-data security incidents.

Where an incident occurs, SCADD may:

1. identify and contain the incident;
2. determine the information affected;
3. identify affected individuals;
4. assess potential risk and harm;
5. take corrective measures;
6. document the incident;
7. review whether notification is legally required; and
8. notify affected individuals and/or competent authorities where required.

23. Automated Decision-Making and Profiling

SCADD does not intend to make significant clinical decisions solely through advertising profiles or automated website systems.

Clinical assessment, treatment planning, therapeutic recommendations, eligibility decisions, and professional judgments should be conducted through appropriate professional processes.

Where automated technologies are used for analytics, communications, administration, or marketing, SCADD will assess their privacy implications and apply applicable rights and safeguards.

24. Separation of Clinical and Marketing Databases

SCADD's operational principle is:

Where practicable, SCADD maintains logical or system-level separation between:

1. clinical records;
2. ordinary administrative records;
3. training records; and
4. marketing/contact datasets.

Information such as:

• diagnoses;
• health conditions;
• autism status;
• disability;
• treatment history;
• assessment results;
• behavioral data;
• therapy outcomes;
• psychological records; and
• clinical notes

must not be used as advertising audience characteristics merely because such information is available to SCADD.

25. Privacy Complaints

An individual who believes SCADD has handled personal data incorrectly may contact:

SCADD Data Protection Officer
Email: privacy@scadd.jo

The request should preferably identify:

• the person's name;
• contact information;
• nature of the concern;
• relevant service or interaction; and
• sufficient information for SCADD to investigate.

SCADD will review the matter in accordance with its privacy procedures and applicable law.

Nothing in this policy limits any right an individual may have to approach the competent Jordanian data-protection authorities.

26. Changes to This Privacy Policy

SCADD may amend this Privacy Policy because of:

• legal changes;
• regulatory requirements;
• new services;
• new technologies;
• changes to data-processing activities;
• new service providers;
• security requirements; or
• organizational changes.

The current version will be published at:

www.scadd.jo

A revised policy will display an updated version number and revision date.

Where a material change requires a new consent or additional notice, SCADD will obtain or provide this as required rather than relying solely on publication of the amended policy.

27. Governing Framework

SCADD processes personal information in Jordan in accordance with applicable laws and regulatory requirements of the Hashemite Kingdom of Jordan, including applicable personal-data-protection legislation, regulations, and instructions.

Different or additional requirements may apply where SCADD operates or provides services in other jurisdictions.

28. Contact SCADD About Privacy

For:

• personal-data access;
• correction;
• updating;
• deletion or anonymization;
• restriction;
• objection;
• portability;
• withdrawal of consent;
• marketing opt-out;
• complaints;
• questions concerning processors;
• questions concerning international transfers; or
• general privacy concerns,

please contact:

SCADD Data Protection Officer
Scientific Center for Autism & Developmental Disorders – SCADD
Amman, Hashemite Kingdom of Jordan
Email: privacy@scadd.jo
Website: www.scadd.jo

Please place "Privacy Request" in the subject line where possible.

Scientific Center for Autism & Developmental Disorders – SCADD
Privacy Policy Version 1.1
Effective Date: 2 September 2026