How Dr Expat collects and uses personal information. Mainly this is information about doctors, nurses, dentists and allied health professionals who apply to us or register their interest in working in the UAE and the wider GCC. It also covers visitors to our websites and our contacts at hospitals and clinics.

Version 1.0 · Last updated 1 October 2026

1. Who we are 

We are Dr Expat FZE LLC trading as Dr Expat, a healthcare recruitment and medical licensing company registered in the United Arab Emirates. We operate drexpat.com, our campaign website apply.drexpat.com and Dr Expat Connect (connect.drexpat.com). We help doctors, nurses, dentists and allied health professionals obtain professional licences and find work in the UAE and the wider GCC.

For the purposes of the UK GDPR, we are the data controller for the personal information described in this policy.

Data controller: Dr Expat FZE LLC trading as Dr Expat, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates

UK GDPR Representative (where Dr Expat is required to appoint a representative under UK GDPR): Mr Kulvinder Hira, 88 Hagley Road, Birmingham, B16 8LU, United Kingdom

Data protection contact: [email protected]

If you are in the United Kingdom, you may contact our UK GDPR Representative. Wherever you are, you can contact us directly at the email address above.

2. What information we collect

We collect information you give us when you:

• respond to one of our advertisements or posts;
• complete a lead form in one of our adverts, for example on LinkedIn, Facebook, Instagram or Google;
• submit an application, enquiry or onboarding form on one of our websites;
• contact us by email, telephone or messaging app.

Depending on how far your application progresses, this may include:

• Contact details: your name, email address, telephone number and the country and city where you live.
• Professional background: your CV, employment history, job titles, clinical specialty, procedural experience and dates of employment.
• Qualifications and registration: your degrees and postgraduate qualifications, professional registration body and registration or PIN number, licence status, and continuing professional development records.
• Eligibility and matching information: your nationality, right-to-work status, notice period and availability, and your gender where a vacancy requires it. Some employers and visa processes have requirements that depend on these.
• Preferences: the roles, locations and salary levels you are interested in.
• Profile photograph: if you provide one.
• References and verification: referee details, reference letters and the results of qualification and employment checks.
• Our correspondence with you: emails, messages, call notes and interview records.

We also receive information about you from other sources:

• professional contact databases such as Apollo.io;
• public professional profiles such as LinkedIn;
• referees you name;
• verification providers and regulators during licensing.

If we contact you first, our first message links to this policy and lets you opt out.

We do not need information about your health, or any other sensitive personal information we have not asked for, to assess your application, so please leave it out of your CV. If a licence or visa application you have asked us to handle requires health information, we will explain why and ask for your explicit consent before collecting it.

3. Why we use it, and our legal basis

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and you may object at any time (see section 7).

4. Who we share it with

Recruitment only works if we can put your details in front of employers. We share your information with:

• Hospitals, clinics and healthcare groups in the UAE and the wider GCC that are hiring. We send your CV to employers with suitable vacancies.
• Registered employers on Dr Expat Connect. If you have signed a CareerBoost agreement with us, we list your profile on Connect, our portal for registered hospitals and clinics. Your contact details are never shown there. When an employer registers interest, our team reviews the request and sends them your CV.
• Healthcare regulators where this is needed for your licence application. These include the Dubai Health Authority, the Department of Health Abu Dhabi, the UAE Ministry of Health and Prevention and the Saudi Commission for Health Specialties.
• Verification providers, including DataFlow, which carry out primary source verification of your qualifications, registration and employment history.
• Your professional regulator where a certificate of good standing or confirmation of registration is required: for example the General Medical Council, the Medical Council in Ireland, the Health and Care Professions Council or the Nursing and Midwifery Council.
• Our service providers, who act on our instructions under contract: our customer relationship management system, e-signature, email and file storage providers, website hosting and payment processing. We do not store your full card details.
• Our professional advisers (lawyers, accountants and auditors) where necessary.

Apart from the website cookies you choose to accept (section 8), we do not sell your personal information or share it with anyone for their own marketing.

5. Sending your information outside the UK

We want to be clear about this, because it is the part candidates are most often not told.

Your information is transferred to the United Arab Emirates. We are established there, our recruitment and licensing teams work there, and most of the employers and regulators we deal with are there. It may also go to:

• other GCC countries, such as Saudi Arabia and Qatar, where an employer or regulator considering you is based;
• countries where our service providers operate, including the United States.

The United Arab Emirates is not covered by a UK adequacy decision. That means additional safeguards are required for these transfers.

We are putting formal transfer safeguards in place with the parties who receive your information, using the UK International Data Transfer Agreement. If you would like to know what protections apply to your information before then, please contact us and we will tell you.

6. How long we keep it

We keep personal information for as long as it is needed for the purpose we collected it for, and no longer.

Recruitment and licensing run over years rather than months. Doctors often come back to us long after a first enquiry, licensing and visa histories stay relevant across a career, and a candidate who is not right for one vacancy is often right for another much later. For that reason we do not apply a single fixed period to candidate and enquiry records. We decide how long to keep your information using these criteria:

• whether you remain, or may reasonably remain, interested in roles, licensing or relocation support in the UAE and the wider GCC;
• whether your profile is still relevant to the vacancies, specialties and licensing routes we work on;
• whether you have asked us to keep you on file, or have engaged with us, for example by applying, enquiring, replying to us or signing a CareerBoost agreement;
• whether we still need the record to show what was agreed with you, what was submitted on your behalf, or what a licensing authority or employer required at the time;
• any minimum retention periods we must observe under applicable law, and any period in which a legal claim could still be brought.

Where we hold a record so that we can tell you about future opportunities, we review it periodically. If it has been dormant for an extended period, we will contact you to ask whether you would like us to keep it. If you do not reply, or you tell us you are no longer interested, we will delete it or keep only anonymised statistical information that cannot identify you.

Some records are governed by periods set by law or contract rather than by us. Where we placed you, or you bought one of our services, we keep the agreement and the records supporting it for the duration of the engagement and for as long afterwards as tax, accounting and limitation rules require. Where documents were submitted to a licensing authority on your behalf, we keep a copy for as long as that authority or the employer may reasonably need us to show what was submitted.

You can ask us to delete your information at any time, and we will unless we are required to keep it (see section 7).

7. Your rights

Wherever you live, you can:

• ask for a copy of the information we hold about you;
• have inaccurate or incomplete information corrected;
• ask us to delete your information in certain circumstances;
• ask us to restrict how we use it while a concern is resolved;
• receive the information you gave us in a portable format, or have it sent to someone else;
• object to our use of your information where we rely on legitimate interests, and object to direct marketing at any time;
• withdraw your consent where we rely on it, without affecting anything done beforehand.

In the UK these are legal rights. Many other countries give similar rights, and we handle every request the same way, wherever you live.

We do not make decisions about candidates by automated means alone. Every shortlisting decision is made by a member of our team.

To exercise any of these rights, email us at [email protected]. We will respond within one month. There is no charge.

8. Cookies on our websites

Cookies needed to run our websites, such as the one that remembers your cookie choice, are always on. The following only run if you accept them in our cookie banner:

• Google Analytics (analytics) counts visits and shows which pages are used, so we can improve our websites.
• Microsoft Clarity (analytics) records how visitors move around our pages, including session recordings and heatmaps, so we can find and fix problems.
• Google Ads (advertising) shows whether our Google adverts lead to enquiries and applications, and helps us show our adverts to relevant people.
• Meta Pixel (advertising) shows whether our Facebook and Instagram adverts lead to visits and applications, and helps us show our adverts to relevant people.

Not every part of our websites uses all of these. Where a site uses any of them, its cookie banner lists, or links to, the cookies used there and how long they last.

If you accept, Google, Microsoft and Meta receive information about your visit and may process it outside the UK, including in the United States. Meta may also use it for its own advertising purposes, under its own privacy policy.

You can change your choice at any time with the cookie settings button, which appears on every page where these cookies are used.

9. Hospitals, clinics and other business contacts

If you work for a hospital, clinic or other organisation we deal with, we use your name, job title, business contact details and your activity on Dr Expat Connect to:

• manage our relationship with your organisation;
• respond to your vacancies;
• tell you about our services.

Our legal basis is our legitimate interests in running our business, and you can object at any time. We keep these details while we work with your organisation and for up to 6 years afterwards, for contractual, tax and legal reasons.

10. Complaints

If you are unhappy with how we have handled your information, please tell us first at [email protected] so we can put it right.

You also have the right to complain to a data protection regulator:

• United Kingdom: Information Commissioner’s Office, ico.org.uk, 0303 123 1113
• Elsewhere: the data protection authority in the country where you live, if there is one.

11. Changes to this policy

We review this policy regularly and will update it when our practices or the law change. The current version is always on this page with the date it was last updated. If a change materially affects how we use your information, we will tell you directly where we can, and place a notice on our website.