1. Who we are
- Scrub Valley operates a platform connecting healthcare professionals with employers in the Gulf, and facilitates credential verification and professional examination booking.
- The data controller is Wadi Al Khobar, the registered legal name, operating under the commercial name Scrub Valley. It is registered in the Kingdom of Saudi Arabia under commercial registration number 205123561, at 4922, 4th, Althaqba, 8360, Al-Khobar, Kingdom of Saudi Arabia.
- For any questions about this policy or your data, contact info@scrubvalley.com.
- Our data protection contact is info@scrubvalley.com.
2. Scope
- This policy explains what personal data we collect, why, how we use it, who we share it with, and what rights you have.
- It applies to candidates, employers, website visitors, and anyone who contacts us.
- It applies across our website, web application, and our communications with you by email, WhatsApp, SMS, and telephone.
3. What data we collect
3.1 Data you give us, candidates
- Identity: full name, date of birth, gender, nationality, country of residence, passport or national identity details.
- Contact: email address, telephone number, WhatsApp number, postal address.
- Professional: profession, specialty, sub-specialty, years of experience, current and previous employers, job titles, employment dates.
- Credentials: degrees, diplomas, certificates, professional licences, registration numbers, issuing institutions, dates of issue and expiry.
- Documents: copies of certificates, licences, transcripts, identity documents, experience letters, good standing certificates, CV.
- Examination: examination history, booking details, examination dates, and where you share it with us, results.
- Preferences: target countries, desired roles, salary expectations, availability.
- Communications: messages you send us by any channel, and notes from calls with our team.
3.2 Data you give us, employers
- Organisation: institution name, type, location, license or registration details, size.
- Contact person: name, role, work email, work telephone.
- Commercial: subscription tier, billing contact, payment details processed by our payment provider.
- Vacancies: job descriptions, requirements, locations, and any information you publish on the platform.
3.3 Data we collect automatically
- Usage: pages visited, features used, searches run, jobs viewed, applications submitted, time and duration of visits.
- Technical: IP address, browser type, operating system, device type, language settings.
- Communications: whether an email was delivered, opened, or clicked, and whether a message was delivered on WhatsApp.
- Cookies and similar technologies: see our Cookie Policy.
3.4 Data we receive from others
- DataFlow Group: status and outcome of verification applications submitted on your behalf.
- Examination providers: booking confirmations, examination dates, and where applicable, eligibility results.
- Employers: application status, shortlisting, and hiring decisions relating to you.
- Payment providers: confirmation of payment, without full card details.
3.5 Sources of personal data
We collect personal data directly from candidates and other users.
We receive personal data from employers, verification agencies, professional or regulatory bodies, service providers, and the website itself.
We may also receive personal data from examination providers, payment providers, and communications service providers where needed to provide the services.
4. Sensitive data
- Some of the data we handle is professional credential data relating to your qualifications and licensing status.
- We handle identity documents, including passport and national identity data, where required for verification.
- We do not seek health information about you as a patient. We collect information about you as a healthcare professional.
- We apply additional safeguards to these categories, including restricted internal access and encryption in transit and at rest.
5. Why we use your data, and our legal basis
| Purpose | Data used | Legal basis |
|---|
| Create and manage your account | Identity, contact | Performance of a contract |
| Match you to jobs and show your profile to employers | Professional, credentials, preferences | Performance of a contract |
| Submit and manage DataFlow verification on your behalf | Identity, credentials, documents | Performance of a contract |
| Book and manage examinations on your behalf | Identity, examination | Performance of a contract |
| Send service messages about your account, applications, verification, and examinations | Contact, status | Performance of a contract |
| Take payment | Contact, payment | Performance of a contract |
| Send job alerts, offers, and marketing updates | Contact, preferences | Your consent |
| Improve the platform and understand how it is used | Usage, technical | Legitimate interest |
| Prevent fraud, misuse, and document forgery | All categories | Legitimate interest, legal obligation |
| Comply with legal and regulatory obligations | As required | Legal obligation |
- Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
- Where we rely on legitimate interest, we have assessed that our interest does not override your rights, and you may object at any time.
6. Marketing communications
- We send service messages about your account, applications, verification status, and examinations. These are necessary to provide the service and are not marketing.
- We send job alerts, offers, and updates only where you have given consent.
- Consent is separate for each channel. Consenting to email does not consent you to WhatsApp, and the reverse.
- You may withdraw consent at any time:
- In your account settings, under communication preferences
- By clicking unsubscribe in any marketing email
- By replying STOP to any WhatsApp marketing message
- By contacting info@scrubvalley.com
- We will process withdrawal requests without undue delay and in accordance with applicable law.
- Withdrawing marketing consent does not stop service messages, which are necessary for the service you have requested.
7. Who we share your data with
7.1 The DataFlow Group
- Where you request DataFlow Services, we share your identity data, credentials, and documents with the DataFlow Group so that verification can be carried out.
- The DataFlow Group processes this data as an independent controller under its own privacy policy.
7.2 Examination providers
Where you request Examination Services, we share the identity and eligibility data required to make a booking.
7.3 Employers
- Where you apply for a vacancy, we share your profile and application with that employer.
- Where you have made your profile visible to employers, employers subscribed to the platform may view it and contact you.
- You control profile visibility in your account settings.
- Employers are contractually required to use your data only for recruitment and not to share it further.
7.4 Others
- Regulators, licensing authorities, or law enforcement, where required by law.
- Professional advisers, where necessary.
- A purchaser, in the event of a sale or restructuring of our business, subject to equivalent protection.
We do not sell your personal data.
8. International transfers
- Our users are located in multiple countries, including Egypt, India, Pakistan, the Philippines, Indonesia, Jordan, and Sudan, and our employer clients are located across the Gulf.
- Providing the service necessarily involves transferring your data across borders, including to the country where you are seeking employment.
- Where data is transferred outside your country of residence, we take steps to ensure an appropriate level of protection, including contractual safeguards with recipients.
- By applying for a role in another country, you understand that your data will be transferred to that country so the application can be considered.
9. How long we keep your data
| Data | Retention period |
|---|
| Active account data | For as long as your account is open |
| Closed account data | 24 months after closure, then deleted or anonymised |
| Verification documents | 24 months, or as required by the DataFlow Group process |
| Payment and transaction records | 10 years, or as required by tax and accounting law |
| Marketing consent records | For as long as consent is held, plus 24 months as proof |
| Suppression and unsubscribe records | Indefinitely, so we do not contact you again in error |
| Support and call records | 24 months |
| Usage and analytics data | 26 months |
10. Your rights
Subject to applicable law, you have the right to:
- Access: obtain a copy of the personal data we hold about you.
- Correction: have inaccurate or incomplete data corrected.
- Deletion: ask us to delete your data, where we have no overriding legal reason to keep it.
- Withdraw consent: stop marketing communications at any time.
- Object: object to processing based on legitimate interest.
- Restriction: ask us to limit processing while a concern is resolved.
- Portability: receive your data in a structured, commonly used format.
- Complain: lodge a complaint with the relevant data protection authority.
To exercise any right, contact info@scrubvalley.com. We will handle your request within the applicable statutory periods and requirements. We may ask you to verify your identity first.
If you have a complaint, please contact us first at info@scrubvalley.com so we can review and try to resolve it internally. This does not affect any right you may have to complain to the relevant authority. If you are in Saudi Arabia, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA). If you are in the United Arab Emirates, you may complain to the UAE Data Office. If you are elsewhere, you may complain to your local authority.
11. Security
- We use encryption in transit and at rest for personal data and uploaded documents.
- Access to personal data is restricted to staff who need it for their role.
- We maintain access logging and review permissions periodically.
- We require our service providers to maintain equivalent security standards.
- We have a procedure for identifying, containing, and reporting data breaches, and will notify affected users and regulators where required by law.
- No system is completely secure. You are responsible for keeping your password confidential.
12. Children
- The platform is not intended for anyone under 18.
- We do not knowingly collect data from children. If we learn that we have, we will delete it.
13. Automated decision making
- We use automated matching to suggest jobs to candidates and candidates to employers, based on specialty, experience, location, and preferences.
- These are suggestions. No hiring, verification, or eligibility decision is made automatically by us.
- All hiring decisions are made by employers. All verification decisions are made by the DataFlow Group.
14. Cookies
See our Cookie Policy for details of the cookies we use and how to control them.
15. Changes to this policy
- We may update this policy from time to time.
- We will notify registered users of material changes by email or through the platform.
- The "Last updated" date at the top shows when this policy was last changed.
- Previous versions are available on request.