Privacy notice

Who holds your data

Healthpass360 is a brand of Edpass LLC FZ, a company registered in Dubai, United Arab Emirates. Edpass LLC FZ is the controller of the personal data described here.

If you want to reach a person about anything on this page, use the contact details on our contact page. You will get a person, not a ticket number.

What we collect, and when

We collect only what we need to assess your eligibility and represent you to employers. Nothing on this site collects anything passively.

When you apply

Your name, email, phone number, country of residence, profession, specialty, qualification, years of experience, the licences you hold, your availability, and your CV if you attach one.

If you add more detail

Nationality, current status and availability, education history, professional registration and licensing status, employment history, certifications, languages, and anything you choose to tell us. All of it is optional.

Automatically, with your submission

The page you applied from, your browser user agent, and your IP address. These are kept as evidence of the consent you gave and to protect the form from abuse.

Your consent itself

We store the exact wording you agreed to and when, rather than a reference to it, so that if this page changes we can still show precisely what you consented to.

What we deliberately do NOT collect

We do not ask for your passport number on the public form. Our own internal screening form has a field for it and the paper version of our application form asks for it, but nothing in the process needs it before we have spoken to you, and holding it makes our database materially more attractive to steal. Your team will request documents at the point they are actually needed.

There is no mechanism anywhere on this platform to take a payment from a candidate. That is a structural fact, not a policy: the code contains no payment integration at all.

Why we hold it, and on what basis

The basis is the consent you give when you submit the form, and our legitimate interest in operating a recruitment service you asked us to perform. You can withdraw consent at any time, and we will tell you plainly what that means for an application already in progress.

• To assess your eligibility for UAE healthcare roles and give you an honest answer.
• To represent you to prospective employers, which we do with your knowledge.
• To prepare your file for licensing, including verification through DataFlow.
• To meet record-keeping obligations that apply to us as a recruiter.

Where your data physically lives

Our database and file storage run in Amazon Web Services in the ap-south-1 region, which is Mumbai, India.

We say this plainly because it matters and because most of our candidates are in India while our employers are in the UAE, so your data crosses a border either way. There is currently no serverless-friendly managed Postgres in a UAE region: we checked Supabase, Neon and Aiven before choosing. If that changes, or if you would rather not proceed on that basis, tell us.

Who else sees it

Prospective employers

Your professional profile, when we present you for a role. Your contact details stay hidden from employers until offer stage, which is enforced by the system rather than by anyone remembering.

DataFlow and licensing authorities

Documents required for Primary Source Verification and for your DHA, DOH or MOHAP application.

Our own team

Access is scoped by role and enforced per collection and per field. Our content editors cannot read a single candidate record.

Nobody else

We do not sell data, we do not share it with advertisers, and we do not run analytics or advertising trackers on this site.

How it is protected

• Encrypted in transit on every connection, and encrypted at rest by the storage provider.
• Role-scoped access, enforced per collection and per field rather than by convention.
• Every change to a record is written to an audit log that is append-only, enforced by the database itself. It cannot be edited or deleted, including by us.
• That audit log deliberately contains no personal data, so it can be kept indefinitely without becoming something we can never erase.
• Uploaded files are checked by their actual content rather than by their filename, and are never publicly readable.

How long we keep it

Every candidate record carries a retention review date set 24 months ahead. At that point a person reviews whether we still have a reason to hold it. Records are flagged for review, never deleted automatically, because silently destroying someone’s file is its own failure.

Your rights, and how to use them

You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it.

Every such request is logged with a due date 30 days out, so the clock is visible to our team rather than depending on someone remembering.

Deletion anonymises your record while preserving the audit trail, which by design carries no personal data of yours. That means we can honour an erasure request without breaking the integrity of our own records.

• Email us using the address on our contact page, with the subject "Data request".
• Tell us which of the four things you want: a copy, a correction, deletion, or to object.
• We will verify it is really you before acting, which protects you rather than us.

Changes to this notice

When this is replaced by the counsel-reviewed notice, the date at the top changes and the previous version remains available on request. Because we store the consent wording you agreed to at the time, a change here never retroactively alters what you consented to.