Let’s talk
GUIDE

Can a clinic in Dubai use an AI chatbot with patient data under UAE law?

Yes, but where the data goes matters. UAE Federal Law No. 2 of 2019 says health information and data related to health services in the UAE may be stored, processed, generated or transferred outside the UAE only in the cases a health authority decision allows, and the Dubai Health Authority’s AI policy requires AI tools in healthcare to follow that law.

In practice, a clinic chatbot that only answers hours, location, prices and booking questions handles little health data. Once patients describe symptoms or treatments, the conversation holds health data: ask where it is stored and processed, keep clinical questions with your staff, and check with your health authority or a lawyer before going live. This guide is not legal advice.

Updated Oct 8, 2026

How it works

  1. Ask where every part runs

    The chatbot has three places that can hold patient messages: the server it runs on, the model provider that writes the replies, and where conversations are stored. Article 13 applies wherever health data is stored or processed.

  2. Keep the chatbot to non-clinical work

    Hours, location, prices, insurance and booking. Questions about pain, symptoms or treatment go to your team with a summary, so less health data passes through the chatbot.

  3. Tell patients it is automated

    The DHA policy asks AI solutions in healthcare to disclose which functions are AI-enabled and the role of the healthcare professional in the final decision.

  4. Keep a person able to override it

    The DHA policy asks that solutions able to affect people’s lives significantly can be overridden or reversed by designated users, and that they are supervised.

  5. Plan how long records are kept

    The same federal law sets a retention period for health information and data of no less than 25 years; agree with your provider what the chatbot keeps and where.

What it costs to run

This guide is about rules, not prices. What a WhatsApp assistant costs to run in the UAE is on the clinics in Dubai page.

When it is not worth it

  • If your provider cannot tell you where conversations are stored and which model provider sees them, do not connect it to patients yet.
  • If the chatbot would mainly discuss symptoms or treatment choices, it is a clinical tool, with stricter rules than this guide covers.

Questions

Is booking an appointment health data?

A name, a phone number and a time can become health data once tied to a clinic visit or a treatment. Treat the booking conversation with the same care as the rest.

Does the data have to stay in the UAE?

Article 13 allows storage or processing outside the UAE only in the cases a health authority decision sets, made in coordination with the Ministry of Health. Ask your health authority which cases apply to you.

Does the DHA have its own AI rules?

Yes: its Policy for Artificial Intelligence in the Healthcare (DHA/HISHD/PP-09) covers ethics, accountability, transparency, safety and privacy, and requires compliance with Federal Law No. 2 of 2019.

Is this legal advice?

No. It is a plain summary of the texts listed below, read on 8 October 2026. Check with your health authority or a lawyer for your clinic.

Sources

Want a WhatsApp assistant for your clinic that keeps clinical questions with your team?

See the service: AI receptionist and WhatsApp chatbot for clinics in DubaiLet’s talk

All guides