What the agent can do.
These tasks need little or no health information and are where clinics save the most front-desk time.
What it must not do.
These are the lines we hard-code, whatever the patient asks.
Which law covers what.
| Topic | What applies | What it means for the build |
|---|---|---|
| Health data | Federal Law No. 2 of 2019 (ICT in health fields) and its implementing rules | Health information generally stays in the UAE; transfers abroad only under the exceptions set by ministerial resolution. Host anything that stores health data in the UAE. |
| Other personal data | UAE PDPL (Federal Decree-Law No. 45 of 2021), which excludes health data covered by the health ICT law | Names and phone numbers used for bookings: minimise, explain in your privacy notice, honour requests. |
| Free zones | DIFC or ADGM data protection regimes, if your clinic is licensed there | Confirm your licence location first; the regime follows it. |
| Your regulator | DHA (Dubai), DoH (Abu Dhabi), MOHAP (northern emirates) | Your existing patient-communication and advertising policies apply to the agent too. |
| WhatsApp itself | Meta's Business Messaging Policy and template rules | Opt-in, 24-hour window, approved templates for reminders sent later. |
How we would build it.
Sort a month of real enquiries into admin, practical and clinical.
Decide the fields the agent may collect: usually name, phone, reason category, slot.
Conversation logs and any patient record links hosted in the UAE; identifiers stripped before text goes to a model where the rules require it.
Clinicians sign off every preparation and aftercare text the agent may quote.
We test emergency and clinical phrases in Arabic and English before go-live.
Not legal advice.
This guide is general information, checked against the sources listed, and not legal advice. Rules change; check the current text or ask a lawyer before you rely on it. Checked November 2026.
Common questions.
Does the UAE PDPL apply to patient data?
The PDPL excludes health data that is regulated by its own legislation, which in practice points to Federal Law No. 2 of 2019 for health information. Contact details used only for booking are treated with care under both. Ask your legal adviser how your clinic classifies them.
Can the AI model run outside the UAE?
For anything containing health information, plan for UAE processing or a documented exception. For purely administrative messages without health details, the options are wider. We set this out per data field in the design.
Do patients have to be told it is AI?
We always label the agent as an assistant and give patients a way to reach a person. It is the standard we apply in every market, and the EU AI Act requires it for European clinics.
Can it send reminders on WhatsApp?
Yes, with the patient's opt-in and a Meta-approved template for messages sent outside the 24-hour window.
Want this in your business?
Tell us how you work today. We'll tell you honestly what AI can take off your team's plate, what it costs, and whether we are the right fit.