A consumer app can launch with whatever stack is quickest. A telehealth service in Dubai cannot. Here are the technical rules to give your developers or vendor on day one.
The standard sets these rules for platforms:
Storing, developing or transferring health data outside the UAE is not permitted, except in the cases in Article 2 of Ministerial Decision 51 of 2021. The word "developing" matters. If your developers, analytics tools, support desk or AI services sit abroad, check how they touch patient data before you sign with them.
Facilities providing telehealth must make sure they have:
The soundproof workspace applies wherever your clinicians consult from. It is worth asking how that works for anyone who plans to consult from home, and getting DHA's view if that is your model.
Your record system has to integrate with NABIDH, Dubai's health information exchange. All telehealth encounters must be turned into written documentation, including telephone consultations. For each one, the physician records at least:
Telehealth information must be kept securely for at least 25 years from the last health encounter, or as DHA specifies. Build storage costs and export formats around that, because DHA can also ask for your data in a required format.
Pharmareg UAE has a separate guide to NABIDH integration for telehealth.
Consent has to be built into the workflow and stored in the record. Electronic consent is acceptable if it meets the same requirements as manual consent, identifies the patient and can be audited. Consent for treatment must be documented at each encounter.
Your product also needs consent for audio recording, monitoring, storing data and passing it to another provider. Any active or passive tracking in the service needs consent too, which may affect analytics tools and advertising pixels.
If you record video for quality or training, DHA expects a documented purpose, a named responsible person, security measures, written consent, a retention period and a breach plan.
Version 4 of the standard addresses AI directly:
Check where any AI model actually runs. Many popular services process data outside the UAE, which brings you back to the hosting rule.
Remote patient monitoring must use DHA-approved platforms and MOHAP-approved medical devices. A DHA-licensed physician leads it, and decides who is eligible after an in-person assessment or a teleconsultation. Devices must be tested with the patient before use, and faults reported to MOHAP.
When buying, the standard asks you to consider safety alerts, accuracy, infection control, ease of use, durability and data security, including authentication and the ability to fix weaknesses in the device.
These questions are our view of what to ask, based on the rules above:
HealthcareSetup UAE can take the technology decisions as part of its telemedicine business setup.
Generally no. DHA's standard says it is not permitted to store, develop or transfer health data outside the country, except in the cases in Article 2 of Ministerial Decision 51 of 2021. Check any exception with DHA.
At least 25 years from the date of the last health encounter, or as otherwise specified by DHA, according to the standard.
They must be written up. The standard says all telephonic consultations must be reduced to writing in the patient's electronic record.
The standard allows ambient AI with patient consent, provided the treating physician reviews the content before it enters the permanent record, and the tool follows DHA's AI requirements.
HealthcareSetup UAE builds telehealth businesses including their systems, and Pharmareg UAE handles NABIDH and DHA licensing. Both are brands of the same company and publish this guide.
The licence, clinical team, platform, records and supply chain, run as one project and handed over ready to trade.
healthcaresetup.ae ↗Regulatory affairs in the UAE: DHA telehealth licensing, NABIDH, accreditation support, and pharmaceutical and medical device registration.
pharmareguae.com ↗