If you are planning a patient app, a clinic booking app or a telehealth product for Dubai or Abu Dhabi, the code is the easy part. The hard part is the rulebook: where patient data may live, which health information exchange you must connect to, and which authority signs off. Get those wrong and a finished app can sit unused while you rebuild the backend.
This guide explains, in plain language, the rules a UAE healthcare app has to plan for in 2026, what they change in the build, what it typically costs in AED, and what we learned building health products for CITE Lifestyle and Aarogya Global. It is a planning guide for founders and clinic owners, not legal advice. Confirm the current version of every standard with the regulator or a licensed consultant before you sign a build contract.
Who Regulates a Healthcare App in the UAE
The UAE has three layers that matter for an app, and which ones apply depends on where your patients and your licensed facility are.
- **Federal level.** Federal Law No. 2 of 2019 on the use of information and communications technology in health fields (often called the ICT Health Law) and its implementing rules, Cabinet Resolution No. 32 of 2020, apply across all seven emirates. This is where the data residency rule sits.
- **Dubai.** The Dubai Health Authority (DHA) licenses facilities and professionals in Dubai and publishes the telehealth standard. It also runs NABIDH, Dubai’s health information exchange.
- **Abu Dhabi.** The Department of Health Abu Dhabi (DoH) regulates facilities in the emirate, publishes the ADHICS cyber security standard and runs Malaffi, the Abu Dhabi health information exchange. See the DoH health information exchange page.
One point surprises many founders: in most cases the app itself is not licensed, the healthcare provider is. A telehealth consultation is delivered by a licensed facility and licensed doctors. Your app is the tool that facility uses, so the facility’s licence, policies and audits shape what the app must do.
The Rule That Changes Your Architecture: Health Data Stays in the UAE
Article 13 of the ICT Health Law says, in short, that health data related to healthcare services provided in the UAE may not be stored, processed, generated or transferred outside the country unless an exception applies. Ministerial Decision No. 51 of 2021 later set out specific exceptions, such as certain scientific research and some cases involving international bodies. Law firm summaries put the fine for breaching Article 13 at AED 500,000 to AED 700,000.
What that means for a build:
- **Hosting.** The database, file storage (lab reports, prescriptions, photos) and backups should sit in a UAE data centre. AWS, Microsoft Azure and Oracle all run cloud regions inside the UAE, so this is a configuration and cost decision, not a blocker.
- **Third-party tools.** Every SaaS tool that touches patient data counts. Analytics, crash reporting, email, SMS, chat widgets, video calls and AI transcription can all quietly send data abroad. Each one needs a check, and some need replacing.
- **Logs.** Server logs that contain names, phone numbers or Emirates ID numbers are health data too if they relate to care. Strip them or keep them in the UAE.
- **Support access.** If your development team is outside the UAE, decide early how they debug production without copying patient records out of the country. Masked test data and in-country support consoles are the usual answers.
If your product serves patients outside the UAE as well, such as a medical travel service, you may end up running two data zones. Plan that in the first week, not after launch.
Dubai: The DHA Telehealth Standard and NABIDH
DHA publishes Standards for Telehealth Services. Several 2025 summaries report a new version (version 4, code ST-14) issued in September 2025 and effective from November 2025. Read the current version on the DHA site before you scope, because version numbers and dates change. The themes that affect an app build are consistent across versions:
- The service runs under a DHA-licensed facility, and the doctors on the platform hold DHA licences.
- Patient identity checks and informed consent happen before a consultation.
- Consultations, prescriptions and notes are recorded in the facility’s medical record.
- Security basics are expected: encryption in transit and at rest, strong authentication for clinicians and audit trails.
- Some activities, such as prescribing certain controlled medicines remotely, are restricted.
**NABIDH** is the Dubai exchange that links facility records so a patient’s history follows them between providers. Summaries of the latest telehealth standard say the record system behind a telehealth service must integrate with NABIDH. In practice your app rarely talks to NABIDH directly. It talks to the facility’s electronic medical record (EMR), and the EMR sends data to NABIDH. That makes your choice of EMR, and whether it is already NABIDH-connected, one of the biggest scope decisions you will make.
Abu Dhabi: DoH, ADHICS and Malaffi
In Abu Dhabi the two names to know are ADHICS and Malaffi.
- **ADHICS** (Abu Dhabi Healthcare Information and Cyber Security Standard) is DoH’s security standard for healthcare entities. It covers governance, access control, incident handling, third-party risk and cloud use. Vendors describe a version 2.0 introduced in 2024, while older DoH documents reference earlier versions, so confirm which one your facility is audited against.
- **Malaffi** is the Abu Dhabi health information exchange. The DoH ADHICS FAQ states that the Malaffi team selected a minimum set of ADHICS controls and that meeting them is a prerequisite to onboarding.
For an app this usually means your vendor, meaning us or anyone else you hire, will be asked third-party security questions by the facility, and your cloud setup will be reviewed against ADHICS controls. Have answers ready: where data is hosted, who has admin access, how access is logged, how incidents are reported and how backups are tested.
Dubai vs Abu Dhabi at a Glance
| Topic | Dubai | Abu Dhabi |
|---|---|---|
| Regulator | Dubai Health Authority (DHA) | Department of Health (DoH) |
| Health information exchange | NABIDH | Malaffi |
| Key standard for apps | DHA Standards for Telehealth Services | ADHICS security standard + DoH telehealth rules |
| Data residency | Federal ICT Health Law, Article 13 | Federal ICT Health Law, Article 13 |
| Who holds the licence | The healthcare facility and its doctors | The healthcare facility and its doctors |
| Typical integration route | App to facility EMR, EMR to NABIDH | App to facility EMR, EMR to Malaffi |
What These Rules Add to the Build
Here is how the rules turn into real work on a typical patient app with booking, records and video consultations.
- **Identity and consent screens.** Patient verification (often Emirates ID details plus phone OTP), consent text in English and Arabic, and a stored record of what each patient agreed to and when.
- **Role-based access.** Doctors, nurses, front desk, admins and patients each see different data. Every view of a record is logged.
- **UAE hosting and in-country services.** UAE cloud region, in-country file storage and backups, and a review of every third-party SDK in the app.
- **EMR integration.** Booking, consultation notes and prescriptions flow into the facility’s EMR, usually through HL7 or FHIR interfaces the EMR vendor provides.
- **Bilingual interface.** Arabic and English, with right-to-left layouts done properly. We covered this in our guide to Arabic RTL mobile apps for the UAE.
- **Audit and security evidence.** Penetration test reports, access reviews and an incident process the facility can show its regulator.
What a UAE Healthcare App Typically Costs
These ranges use the same tiers as our mobile app development cost in Dubai guide. They are planning ranges for our own builds, not a market survey, and the compliance items move most health apps up one tier.
| App type | What it includes | Typical range |
|---|---|---|
| Clinic booking app | Patient app, slot booking, reminders, payments, simple admin, UAE hosting | AED 60,000 to 150,000 |
| Patient records and follow-up app | Booking plus reports, prescriptions, care plans, role-based access, audit logs | AED 100,000 to 200,000 |
| Telehealth platform | Video consults, doctor app, EMR integration, consent, security evidence | AED 180,000 to 400,000 |
Costs outside the build to budget for: UAE cloud hosting, a video provider that can keep data in the region, EMR vendor integration fees, a penetration test, and the facility’s own licensing and compliance work. In Indian rupees, AED 100,000 is roughly Rs 22 to 23 lakh at current rates.
Proof: What CITE and Aarogya Global Taught Us
We want to be clear about what we have and have not built. Neither project below is a DHA or DoH licensed telehealth service. They are health products we designed and built, and they shaped how we scope UAE health apps.
CITE Lifestyle: sensitive family data across many roles
CITE Lifestyle is a family health and wellness ecosystem: a brand website, iOS and Android apps, an admin console and a promo video. It covers parents and kids (tasks with photo-proof verification), adults and teens (habits and GPS fitness), shared family calendars and lists, and an in-app AI assistant. The lessons that carry over to a UAE health app:
- **Roles first.** A parent, a child and a teen must see different things. Designing permissions before screens is exactly what a clinic app needs for doctors, staff and patients.
- **Photos are data.** Photo proofs and nutrition scans are personal data with storage, retention and access rules. In the UAE, that storage has to sit in-country.
- **Admin matters as much as the app.** The CITE admin console runs content and users so families never see the operations side. Clinics need the same separation.
Aarogya Global: patients from the Middle East, records before travel
Aarogya Global is a medical tourism facilitator that helps patients, many from Africa and the Middle East, access doctor-led treatment in India. We built the website and the admin console. Patients share medical history and reports to get a free consultation and a cost estimate, and the care team manages cases behind the scenes.
- **Trust has to be earned fast.** Hospital partners, clear costs and a calm path to consultation matter more than features.
- **Medical reports flow across borders.** For a UAE-licensed provider, that flow would trigger the Article 13 question, which is exactly why we now ask “where does this data live?” in the first scoping call.
Common Mistakes We See in UAE Health App Plans
- **Choosing the cloud region last.** Moving a live database into a UAE region later costs far more than starting there.
- **Ignoring the EMR.** If the facility’s EMR cannot accept your data, your app becomes a second, disconnected record. Ask the EMR vendor about its NABIDH or Malaffi connection on day one.
- **Free tools with hidden data flows.** A free analytics or chat SDK can export patient data without anyone noticing.
- **Arabic as an afterthought.** Translating at the end breaks layouts and consent text. Build bilingual from the first screen.
- **No owner for compliance.** The facility, not the developer, answers to the regulator. Agree in writing who prepares which evidence.
A Simple Plan Before You Build
- Confirm which licensed facility will run the service, and in which emirate.
- Download the current DHA or DoH standards that apply and list every requirement that touches the app.
- Pick the EMR and confirm how it connects to NABIDH or Malaffi.
- Choose a UAE cloud region and list every third-party tool that will touch patient data.
- Scope an MVP that covers the compliance basics, then add features in phases.
For a broader view of health app features, read our healthcare app development guide. If you also serve patients in India or the US, our post on HIPAA and DPDP compliance for healthcare apps covers those rules.
Frequently Asked Questions
In most cases the healthcare facility is licensed by DHA, and the app is the tool it uses to deliver care. The DHA Standards for Telehealth Services set what that service must do, so the facility will hold the app to those rules. Check the current standard with DHA before you build.
Generally no. Article 13 of Federal Law No. 2 of 2019 restricts storing, processing or transferring health data related to UAE healthcare services outside the country unless an exception applies. Ministerial Decision No. 51 of 2021 lists specific exceptions.
NABIDH is Dubai’s health information exchange run by DHA. Summaries of the latest telehealth standard say the record system behind a telehealth service must integrate with it. Usually the facility’s EMR handles that connection, and your app connects to the EMR.
ADHICS is the Abu Dhabi Healthcare Information and Cyber Security Standard from the Department of Health. Healthcare entities in Abu Dhabi are audited against it, and DoH says meeting a minimum set of its controls is a prerequisite for joining Malaffi.
In our planning ranges, a clinic booking app typically costs AED 60,000 to 150,000, a patient records and follow-up app AED 100,000 to 200,000, and a telehealth platform with EMR integration AED 180,000 to 400,000.
Yes, as long as the data, hosting and production access stay in the UAE and the licensed facility owns compliance. We are an India-based team and plan UAE hosting and in-country data handling from the first scoping call.
Final Thoughts
A UAE healthcare app succeeds or fails on three early decisions: where the data lives, how it reaches the EMR and exchange, and who owns compliance. Make those first, then design screens. The features can grow in phases, but the foundation is expensive to move later.
Planning a patient app, clinic booking system or telehealth product for Dubai or Abu Dhabi? See our mobile app development and custom CRM and admin panel services, or book a free consultation and we will map the rules to your scope before you spend on code.
