Collecting Patient Contacts Safely at Conferences

Medical conferences and professional events generate a great deal of contact exchange, and the
handling of it is frequently casual in ways that would not survive scrutiny. The rules are not onerous;
they mostly formalise what a careful person would do anyway.

The distinction that matters most

Two categories of information get confused at events, and keeping them apart solves most of the
problem.

Professional contact details — a colleague’s name, specialty, clinic and
number, exchanged so you can refer to each other or continue a conversation. Low sensitivity, ordinary
business use.

Anything about a person’s health — a member of the public describing a symptom
at a public-facing stand, someone asking about a condition they have, a visitor filling in a screening
form. High sensitivity, and subject to both data protection obligations and professional
confidentiality.

These should never end up in the same place. A marketing contact list that has absorbed health
information about identifiable people is a genuine problem, and it happens through drift rather than
intent.

Consent has to mean something

The UAE’s data protection framework requires that consent be informed, specific and freely given. In
practice that means a person should know who is collecting their details, what will be done with them,
and how to withdraw.

Applied to an event, this rules out several common habits. A bowl of business cards at a stand is not
consent to marketing, because nobody told the card’s owner what would happen to it. A prize draw whose
real purpose is list-building is not consent unless the marketing use is stated plainly rather than
buried. Scanning a badge without saying what follows is not consent.

The compliant version is barely harder: say what you will do, and let people agree. “May I
send you a follow-up about this? I’ll only use your details for that.” Then honour it,
including the narrowness of it — consent to a follow-up about one conversation is not consent to a
quarterly newsletter for five years.

Practical handling

Collect the minimum that serves the purpose. A name and one contact route is usually enough; date of
birth, address and identification are not needed to send someone information.

Store it somewhere with access control rather than on a personal phone or an unprotected spreadsheet.
Cards accumulated in a bag and later typed up by whoever has time is a common and poor arrangement.

Act promptly and then stop. Contacts collected for a specific follow-up should be used for it and not
retained indefinitely against a future campaign.

Make withdrawal easy and honour it immediately.

And keep it separate from clinical systems entirely. Patient records live in the facility’s system,
governed by health information rules and the emirate exchanges — NABIDH in Dubai, Malaffi in Abu
Dhabi. Networking contacts do not belong there, and the traffic should never run the other way.
Your medical records and Malaffi covers how those systems work.

The exchange problem, in the other direction

The reciprocal issue is giving out your own details, and here the friction is practical rather than
legal.

Paper cards run out at exactly the point the event gets busy, and they go out of date the first time
you change clinic — which in the UAE also means a new licence if you have moved emirate, since
licences do not transfer between regulators. See
can a Dubai-licensed doctor treat you in Abu Dhabi?.

A single link you control avoids both problems: it cannot run out, and someone who saved it two years
ago sees your current clinic rather than the one you left. For a practitioner it can carry the whole
useful set — licence grade, registered field, sub-specialty focus, languages, clinic and booking
route — which is considerably more than a card holds. See
sharing your credentials with patients digitally.

It also means the people you met can find you later by searching your name, which is how most
professional follow-up actually happens — see
how doctors get more patients in Dubai.

Getting value from a conference

Beyond the mechanics, a few things separate events that produce lasting professional relationships
from those that produce a stack of cards.

Referral relationships are the durable outcome, particularly in the narrower specialties where
patients cannot find you by searching because they do not know what to search for. Meeting the GPs and
internists who would refer to you is worth more than meeting other people in your own field.

Follow up within a few days, specifically, referencing what you actually discussed. Generic
follow-ups from someone you cannot place are deleted.

And be clear about what you are looking for. “I take referrals for knee and sports injury”
is something a colleague can remember and act on. “Orthopaedic surgeon” is not.

Public-facing stands and health screening

Events aimed at the public rather than at professionals raise the stakes considerably, because
visitors arrive with symptoms and expectations.

Health screening at public events — blood pressure checks, glucose testing, skin assessments
— is a genuinely useful public health activity and also a data protection exercise. Anyone whose
reading is taken is generating health information about themselves in a semi-public setting.

Several things follow. The screening should happen with enough privacy that results are not overheard.
Results should be given to the individual with a clear explanation of what to do next, and abnormal
findings need a specific route to follow up rather than a vague suggestion to see someone. Records should
either not be retained at all, or retained under proper controls with the person’s informed agreement.

The failure mode to avoid is screening as a lead-generation exercise, where the clinical activity
exists mainly to capture contact details from people who have just been told something worrying. That is
both an ethical problem and a consent problem, and it is not rare.

If screening identifies something requiring attention, the correct outcome is that the person sees a
practitioner properly — not necessarily yours. Do you need a GP referral in the UAE?
covers the routes.

Photographs and video at events

An easily overlooked category. Photographs taken at stands and sessions frequently capture attendees
incidentally, and those images then appear in marketing material.

For professional attendees this is usually unproblematic, though notice at the event is good practice.
For members of the public at a health-related stand it is more sensitive, because context implies
something about the person: an image of someone at a screening station carries an implication about their
health regardless of what the caption says.

Ask before photographing individuals, and be particularly careful with anything showing a person
receiving a check or holding results. The consent needs to be specific to publication, not merely
tolerance of a camera being present.

Building the habit

None of this requires a compliance department. Three habits cover most of it.

Say what you will do with someone’s details before you take them, in one sentence. Keep clinical
information out of any list that is not a clinical record. And review what you hold periodically,
deleting what no longer serves the purpose it was collected for.

Done consistently, that is both compliant and simply courteous — which is generally what data
protection rules formalise. DHA advertising rules and patient reviews covers the
adjacent question of what you may publish, and the confidentiality obligations that sit alongside these.

The short version

Collect the minimum, say what it is for, get agreement, store it securely, and use it only for the
purpose stated. Keep anything clinical entirely separate from networking and marketing lists, and never
let a conference conversation about symptoms become a note in a contacts database.

For your own details, use something you can update rather than something you print, because the first
clinic move invalidates every card you have handed out and you cannot recall any of them. And treat the
referral relationships as the real return on attending — they outlast the event by years, and they
are what actually brings you patients in the specialties where patients cannot find you by searching.

Most of this is what a careful practitioner would do instinctively; the law simply makes it
explicit.

Formalised, and therefore checkable by someone other than you.