UAE Personal Data Protection Law
We support privacy review with access controls, audit records and campaign consent preferences, while your team determines its obligations and the procedures it needs.
What this is
The UAE Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. It is a law, and your organisation decides how it applies to its activity. Health information may also be subject to sector rules, such as the federal law on information and communication technology in health fields, and to emirate-level health regulators. Confirm with qualified advisers which rules apply.
What is built
- Care Medical records provides controlled access and activity evidence.
- Patient portal is included as a patient-facing review surface.
- Engage campaigns uses recorded consent preferences in its supported workflow.
What a reviewer can inspect
Review representative roles, record activity and campaign preferences with the people responsible for privacy. A portal is a surface to assess, not proof of an automated rights-request workflow. A marketing preference does not establish the legal basis for every use of health information.
Roles and deployment questions
- Which organisation decides why and how patient data is used, and which acts on its behalf? Agree and document the roles for your deployment, and have your advisers confirm them.
- Where is the deployment hosted, and does any data leave the UAE?
- Which agreements, retention rules and access procedures apply to the data in scope?
- How will your organisation handle rights requests, since the portal does not automate them?
Documents
The privacy notice on this website covers website enquiries only. It does not describe how patient data is processed in a customer’s deployment. Data-processing terms for a deployment are discussed with our team and are not published on this page.
Boundaries
No legal compliance determination, automatic rights handling or certification is claimed. No contractual terms or transfer arrangements are inferred from available application controls.
What we claim, precisely
The system holds the evidence; the facility's accountable person attests. Nothing here asserts that a facility is compliant.
Common questions
-
No. It identifies product controls and records for review. Your organisation must assess the applicable requirements, processing arrangements, contracts and procedures before making a compliance determination.
-
The privacy notice covers this website’s enquiries. Terms for processing patient data in a deployment are agreed with our team before go-live and are not published on this page.
-
The facility and NextHealth need to agree and document their roles for the personal data in the deployment, and your legal advisers should confirm them. This page does not determine them.
Not answered here? Contact the team
NXH Flow