Patient data in the UAE: what to check before you automate

Under Article 13 of Federal Law No. 2 of 2019, health data related to health services provided in the UAE may not be stored, processed, generated or transferred outside the country, except in cases set by a decision of the health authority in coordination with the Ministry of Health and Prevention.

Ministerial Decision No. 51 of 2021 lists those cases. According to the CMS summary, they include treatment or sample testing abroad, scientific research, insurance, pharmacovigilance, online health services, personal health devices and requests from the patient. Most come with conditions such as the patient's consent, encryption, limiting who sees the data, and keeping a copy in the UAE.

What this means in practice: most automation tools, AI APIs and messaging platforms run on servers outside the UAE. If identifiable patient data passes through them, you either need to fit an exception and meet its conditions, or design the workflow so identifiable health data stays on systems hosted in the UAE. In-country hosting is available, for example the AWS Middle East (UAE) Region, and self-hosted tools such as n8n can run there.

When a workflow sends text to a language model API, that text goes to the provider's servers, which are usually outside the UAE. Treat a prompt that contains patient data as a transfer of that data.

• Remove names, phone numbers, Emirates ID numbers and record numbers before text is sent to a model, where the task allows it.
• Keep the identifiable record in your UAE-hosted system and send the model only what the task needs.
• Check each provider's data retention and training terms, and whether it offers in-region processing.
• Don't let staff paste patient details into consumer chat apps. That is the most common leak we see, and it bypasses every control you build.
• Where the AI's output affects care or a patient record, keep a person approving it.

For US clinics the parallel question is whether each vendor signs a business associate agreement; our guide on whether n8n is HIPAA compliant covers that.

WhatsApp. Messages pass through Meta's platform. Keep message content to what the patient needs to act: date, time, branch, and a confirm or reschedule button. Leave diagnoses, test names and treatment details out of templates. See our WhatsApp pricing guide for how templates work.

Call recording. Article 431 of the UAE Penal Code (Federal Decree-Law No. 31 of 2021) makes it an offence to record private phone conversations without consent outside cases permitted by law. If an AI receptionist records or transcribes calls, tell callers at the start of the call and give them a way to continue without recording, or confirm with your lawyer how consent should work for your clinic.

Telling callers it's AI. We recommend the agent says it is an automated assistant at the start of every call. It builds trust and avoids complaints, whatever the regulation requires.

Article 20 of Federal Law No. 2 of 2019 is read by law firms as requiring health data to be kept for at least 25 years from the last procedure. Decide early whether call transcripts, WhatsApp threads and automation logs form part of the medical record. If they do, they inherit that retention period; if they don't, keep them only as long as you need and delete them on a schedule.

1. List every system in the workflow: phone, AI platform, model API, automation tool, messaging, calendar, CRM and database.
2. For each one, write down where it stores and processes data (country and region) and who can access it.
3. Mark which steps carry identifiable health data. Try to remove it from as many steps as possible.
4. Where identifiable data must leave the UAE, identify the exception under Ministerial Decision No. 51 of 2021 and its conditions, or redesign the step.
5. Confirm what your regulator (DHA, DoH or MOHAP, or a free zone authority) expects, including any security standard such as ADHICS.
6. Set consent wording for WhatsApp opt-in and for call recording.
7. Decide retention for recordings, transcripts and logs, and turn on automatic deletion where they are not part of the record.
8. Restrict access by role and keep an audit log of who changed what.
9. Have a UAE health lawyer review the design before go-live.