Privacy Policy

Medical Regulations Gate ("MRG", "we", "us") is a healthcare regulatory consultancy with offices in Riyadh, Dubai and Cairo. This Privacy Policy explains how we collect, use, store, share and delete personal data obtained through mrg.com.sa and through related enquiries by email or phone.

Effective date: 12 November 2026.

MRG is the controller of this personal data. Our registered details are Medical Regulations Gate, Office 409, 4th Floor, Al Nemar Center Office 1, Building 14, Musa Ibn Nasair Street, Al Olayah District, Riyadh 12611, Kingdom of Saudi Arabia.

This policy applies to visitors to our website, people who contact us, and people who apply for a job with us.

It does not cover personal data we handle on behalf of clients while delivering regulatory services. That data is governed by our agreement with the client concerned.

We handle personal data in line with the laws that apply to our offices and to the people we deal with. These include the Saudi Personal Data Protection Law and its Implementing Regulations, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.

We collect only the personal data we need for the purposes in section 4. Most of it comes directly from you.

Giving us your data is voluntary. Without your contact details, however, we cannot reply to an enquiry or consider an application.

We do not ask for sensitive personal data such as health, religious or biometric information. Please do not include it in messages or CVs. We do not buy personal data from third parties.

We use personal data only for the purposes below, and we do not use it in ways that are incompatible with them.

You can withdraw consent at any time by contacting us (section 11). Withdrawal does not affect processing carried out before it.

We do not sell personal data, and we do not make decisions about you based solely on automated processing.

Our website uses a small number of cookies and similar technologies.

• 1

  Essential. These keep the website working, for example by remembering your language choice. They cannot be switched off.

• 2

  Security. Our forms are protected by Google reCAPTCHA. Google's Privacy Policy and Terms of Service apply to the data reCAPTCHA collects.

• 3

  Analytics. We use Google Analytics 4 to measure visits to the website. We set analytics cookies only with your consent, and you can change your choice at any time.

You can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the website from working.

We share personal data only with the recipients below, and only as far as each purpose requires.

• 1

  MRG offices. Your enquiry may be handled by our team in Riyadh, Dubai or Cairo, depending on the market it concerns.

• 2

  Service providers. Companies that host our website, run our email and store our records act on our instructions under contract. Our website is hosted by Vercel.

• 3

  Google. As the provider of reCAPTCHA and Google Analytics.

• 4

  Authorities and courts. Where the law requires it, or where needed to establish or defend legal claims.

• 5

  Professional advisers. Lawyers, auditors and insurers bound by confidentiality.

• 6

  A successor business. If MRG is merged, sold or reorganised, under the same protections as this policy.

We do not publish candidate details, and we do not share your data with third parties for their own marketing.

Because MRG operates in Saudi Arabia, the UAE and Egypt, and some of our service providers are located elsewhere, your data may be processed outside the country where you live.

We transfer personal data across borders only where the applicable law allows it. We limit each transfer to the minimum data needed and require the recipient to protect it to a standard at least equal to this policy. Where the law requires your consent or a regulator's approval for a transfer, we obtain it first.

We keep personal data only as long as the purpose requires, then securely delete or anonymise it.

Your data is stored electronically on secured systems operated by MRG and our service providers.

We protect it with technical and organisational measures. These include encrypted connections to our website, access limited to staff who need the data, confidentiality obligations for employees and providers, and regular review of our systems.

No system is completely secure. If a breach is likely to harm you or your rights, we will notify you and the competent authority as the law requires.

Subject to the law that applies to you, you have the right to:

• Be informed about how and why we process your data, which is the purpose of this policy.

• Access the personal data we hold about you and receive a copy in a readable format.

• Correct data that is inaccurate, incomplete or out of date.

• Delete data we no longer need, or ask us to destroy it.

• Withdraw consent at any time, where we rely on consent.

• Object to or restrict certain processing, including direct marketing.

To exercise a right, email us using the details in section 11 and tell us which right you wish to use. We may ask for proof of identity before acting on a request.

We respond within 30 days, or sooner where the applicable law requires. If a request is complex we may extend this period where the law permits, and we will tell you why. Requests are free of charge unless they are repetitive or clearly excessive.

For any question about this policy or your personal data, contact:

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the data protection authority where you live:

Our website and services are intended for businesses and professionals. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

Our website links to third-party sites such as LinkedIn, Google Maps and our clients' websites. Those sites have their own privacy policies, and we are not responsible for their content or practices.

We may update this policy when our practices or the law change. The current version is always published on this page with its effective date. If a change materially affects how we use your data, we will give notice on the website before it takes effect.