Clinic data is patient data. We treat it like both.

Clean reference list. Each entry: the regulation by full name, the jurisdiction it applies to, the operative articles, the version or in-force date, and a one-line plain-English statement of what it means for the clinic. Counsel can map each row to the official source; we have linked nothing here that is not separately verifiable in the official Gazette or regulator portal.

Most marketing agencies running healthcare ads in Dubai do not have a documented data-residency policy. They run patient enquiries through Google Sheets. They forward WhatsApp messages to personal phones. They use AI tools whose terms of service permit training on the data submitted to them. Most clinics signing with most agencies have no idea any of this is happening, until a vendor due-diligence questionnaire arrives, or a DHA audit request lands on the medical director's desk.

Here is what we do differently.

The rule, first. Under UAE Federal Law 2 of 2019 Article 13, identifiable patient data created by health services delivered in the UAE may not be stored, processed, generated, or transformed outside the UAE except by a resolution issued by the competent health authority in coordination with the Ministry. We design around this rule by default. Our architecture starts with the question “where is the bucket?” and works outward from there.

Primary patient-data store. Microsoft Azure UAE North (Dubai) for production. Microsoft Azure UAE Central (Abu Dhabi) for redundancy. AWS me-central-1 (UAE) is the supported secondary for clinics that prefer AWS-side architecture.

Voice agent transcripts and call recordings. Stored in UAE-resident object storage. Twilio voice telephony is region-pinned to EU or Bahrain for the carrier leg, with audio streamed to a UAE-resident bucket immediately on call completion. The bucket is the source of truth, not the carrier.

LLM inference for any prompt that touches PHI. Azure OpenAI in UAE North. The prompt and the response stay inside the region. Where Anthropic is required for KSA-side flows, we route through AWS Bedrock in Bahrain.

Marketing top-of-funnel (non-PHI). GoHighLevel US. Only marketing fields. Never PHI. Never identifiable health information. Never anything that, in counsel's reading, would engage Article 13.

KSA-side secondary. AWS me-south-1 (Bahrain) for redundancy and KSA latency. Bahrain is not UAE-onshore on a strict reading of Article 13; we say so explicitly and we do not use it as the primary store for UAE-onshore PHI.

If your IT team wants the architecture diagram and sub-processor list as a PDF, ask. We will send it the same day. Request the architecture diagram.

Most agencies will not name their sub-processors in writing. We do, with the residency limits stated. This is the table the procurement team can copy into a vendor due-diligence questionnaire. The first row is the one most often missing in the agency contracts we have read.

Encryption

• At rest: AES-256.
• In transit: TLS 1.3.
• Field-level encryption for personally identifiable information.
• Role-based access control with audit logging on read and write, retained for the duration of the engagement plus seven years.

Retention windows

• Marketing inquiry data. 24 months from last contact, by default. Extendable on written instruction from the clinic.
• Identifiable patient data under contract. At least 25 years from the patient's last health procedure, per UAE Federal Law 2 of 2019, Article 20. This is a clinic-level legal duty; we honour it as the clinic's processor, with retention controls aligned to the clinic's own clinical-records policy.
• Commercial billing records. 5-7 years per UAE commercial law.

Right to erasure

Patient right-to-erasure requests are acknowledged within 72 hours and completed within 30 days where the lawful basis permits. Erasure cannot override the Article 20 25-year retention duty for clinical records. That is a clinic-level legal obligation, not a platform choice, and we say so on the request acknowledgement.

Patient-side consent

The first message a patient receives, on any channel we operate, is a clearly worded opt-in. Marketing communications and clinical communications are channel-separated; a patient consenting to one does not, by default, consent to the other. Consent must be free, specific, informed, unambiguous, and revocable (UAE PDPL Article 5).

Withdrawing consent is one tap. The withdrawal is processed within minutes and audit-logged with timestamp. Consent records are exportable on demand by the clinic, and by the data subject on request.

The DHA pre-approval workflow

Every social-media advertisement we produce on a Dubai clinic's behalf goes through the DHA Standard ST-21 v1.1 pre-approval flow. We draft. The clinic's Medical Director reviews and approves under Section 5.3-5.5. The approval is logged before launch, with the Medical Director's digital signature held in the engagement record.

We do not run unapproved creative. We do not feature DHA-facility patients in international accounts (Section 7.4). We do not use empty-certainty language (“100%”, “assured success”, “immediate results”). We do not use government or regulator logos without written approval.

For Abu Dhabi clinics, the DoH side runs in parallel: only facilities that have completed the Training Programme on Abu Dhabi Healthcare Guidelines for Health Media and Advertising (Circular 26/2023) may log advertising materials. We confirm completion at onboarding, in writing.

What we say

We operate to HIPAA-grade controls. Encryption at rest and in transit, audit logging, role-based access, and Business Associate Agreements with US-hosted sub-processors where one is operationally relevant.

What we will not say

We are not HIPAA-compliant, because the question is not the right one for a UAE clinic.

HIPAA is a United States statute. It does not govern UAE clinics and it does not govern the patient-data flows that originate inside the UAE. The clinic's regulatory perimeter is defined by the UAE PDPL (Federal Decree-Law 45/2021), UAE Federal Law 2 of 2019, the relevant emirate's health authority (DHA, DoH, MOHAP), and, for KSA clinics, the KSA PDPL (Royal Decree M/19, as amended by M/148) and the SDAIA Personal Data Transfer Regulation (August 2024).

Anyone offering HIPAA compliance as a UAE clinic guarantee is misreading the law. Even if, in some cases, the agency means well, the framing is wrong. We are happy to put this paragraph in writing, signed, on letterhead, for any procurement officer who needs it.

Detection

Continuous monitoring across the production stack. Alerting on anomalous read patterns, failed-auth bursts, and unexpected outbound traffic. Tooling named in the architecture diagram available on request.

Containment

Target: 1 hour from detection to containment.

Notification

UAE PDPL Article 9 requires notification “without undue delay”. The specific timeline is set by the Executive Regulations, which remain in development as of this writing. Our internal target is 72 hours from confirmation, in line with the standard set by Article 24 of the KSA PDPL Executive Regulations.

Disclosure

Disclosure to the clinic and, where applicable, to affected patients, is jointly drafted by the clinic's legal counsel and our team. We do not draft notification copy unilaterally.

Post-incident report

Delivered within 14 days of containment.

Whose name is on the line

Faheem ud Din, engineering accountability. Besnik, clinic-side accountability. Both signatures appear on every breach disclosure we issue.

Any clinic on contract can request a compliance audit at any time. No charge. No notice required. We will produce, within ten business days:

• The current data-flow diagram for your engagement.
• The current sub-processor list, with versioning.
• Retention logs for the in-scope data categories.
• The breach-response runbook, version-controlled.
• Our Record of Processing Activities (ROPA) per UAE PDPL Articles 7-8, scoped to your engagement.
• The completed Data Protection Impact Assessment for the voice-AI workflow per UAE PDPL Article 21.

We will sit on a video call with your legal counsel and walk it through, line by line, until they have what they need. If they find something missing or wrong, we fix it on the call and reissue the document the same week.

Request a compliance audit. The subject line will be pre-filled.