AI agents and UAE healthcare rules: what clinics need to know

Healthcare in the UAE is regulated by emirate. The Dubai Health Authority (DHA) licenses and oversees facilities in Dubai. The Department of Health Abu Dhabi (DoH) does the same in Abu Dhabi. The Ministry of Health and Prevention (MOHAP) covers the northern emirates and sets federal health policy. Your licence decides which regulator's policies apply to you.

Each of these bodies has published or is developing guidance on artificial intelligence in healthcare. The common threads are consistent: patients should be told when AI is involved, people stay in charge of decisions, data is protected and kept in the country, and incidents are reported. An administrative agent that answers calls and books visits is a lighter use than a diagnostic tool, but the same principles apply to it.

Above the health regulators sit the federal laws on data. Two matter most for patient communication: Federal Law No. 2 of 2019 on the use of information and communication technology in health fields, and Federal Decree-Law No. 45 of 2021 on the protection of personal data. Which one governs a given piece of data depends on what the data is and who holds it. That is a question for your compliance officer, and it is worth asking early.

The single most important rule is honesty. A patient who calls your clinic should know, at the start, that they are speaking with an AI assistant. The UAE's AI policies for healthcare all point the same way: be transparent about where AI is used and keep a human in the loop.

Federal Decree-Law No. 45 of 2021 gives individuals rights over their personal data, including access, correction, deletion and objection. In practice, a responsible deployment treats the following as non-negotiable for every patient interaction:

• Disclosure at the start. The agent says it is an AI on every call and in every chat. The clinic cannot switch it off.
• A human on request. If a patient asks for a person, the agent transfers the call or flags the request for a callback, with the full context so the patient does not repeat themselves.
• A truthful answer when asked. If a patient asks whether they are talking to a machine, the answer is yes.
• Requests routed to the clinic. Requests to access, correct or delete data go to the clinic, which is the data controller. The vendor acts on the clinic's written instruction.

At VoclyAI the disclosure is system level. Every call and message starts with it, and no client setting removes it. Patients can ask for a human at any time. You can read more in our AI safety and transparency page.

Federal Law No. 2 of 2019 restricts storing, processing or transferring health data outside the UAE, except in cases set by the health authorities. The exceptions are specific, such as treatment abroad or research, and some require patient consent or a copy kept in the UAE. Answering a booking call is not one of them.

For a clinic, the practical rule is simple. Recordings, transcripts, summaries, booking details and chat messages should be stored and processed in the UAE. That includes the AI processing, not only the database. Ask every vendor three questions and get the answers in writing:

1. 1Where is patient data stored, including backups?
2. 2Where is it processed, including the AI that listens and replies?
3. 3Is any data transferred outside the UAE, and on whose authority?

Abu Dhabi's Department of Health has gone further in its standard for responsible AI, which expects the compute and storage behind AI systems to sit in the UAE. If you are licensed by DoH, check the current version of that standard with your compliance team.

VoclyAI is UAE hosted. Data is encrypted at rest and in transit, access is role based and every action is logged. Details are on our data residency and security page.

Two documents should be signed before any patient speaks to an agent. A Health Business Associate Agreement (HBAA) sets out how the vendor handles patient health information on your behalf. A Data Processing Agreement (DPA) sets out the controller and processor roles: your clinic decides what happens to the data, and the vendor only processes it on your documented instructions.

Between them, these documents should answer:

• What data is processed, for what purpose, and for how long it is kept.
• Who at the vendor can access it, and how access is logged.
• Which subprocessors are used, and how you can see the list.
• How fast the vendor tells you about a breach.
• How you export your data, and how it is deleted when the service ends.
• That your data is not sold, not used for advertising, and not used to train models without your explicit authorisation.

If a vendor cannot produce these documents before a pilot, stop there. At VoclyAI the HBAA and DPA are signed before go-live, including for the pilot.

An agent that answers patient calls will sooner or later take one from someone in danger. The protocol has to be decided before go-live, not improvised on the night.

The baseline we apply, and recommend you require from any vendor, is this. If a caller describes a life-threatening situation, the agent gives the UAE emergency number 998 and transfers to a person. The protocol is always on and cannot be disabled. Urgent but non-life-threatening calls follow your clinic's own rules: forward to an on-call nurse or doctor, or flag the call for first callback in the morning.

The second boundary is clinical. A patient communication agent is an administrative tool. It does not diagnose, recommend treatment, interpret results or triage clinically. It answers from the information your clinic approves, such as services, doctors, hours, insurance and policies. When a question goes beyond that, it says so and passes the patient to your team.

Many clinics want recordings for quality review. Recording should be a deliberate choice, made in writing, with the greeting telling the caller that the call is recorded. Your clinic remains responsible for patient consent, so agree the wording with your compliance officer.

Retention is the other half. Health records in the UAE carry long retention duties under the health ICT law, but call recordings and chat logs held by a communication vendor are a different question. Decide what you keep, where, and for how long, and write it into the DPA. When the service ends you should be able to export everything and receive confirmation that it has been deleted.

Before you sign with any AI vendor for patient calls or messages, ask for evidence on each line below. Logos on a website are not evidence.

VoclyAI states compliance with DHA, DoH, MOHAP, ADHICS, HIPAA and GDPR, and provides the documentation pack on request. See the compliance page.

The safest way to deploy an AI agent is to start where the alternative is nothing. After-hours calls go to voicemail today. Putting a disclosed, supervised agent on those calls first gives your team real recordings to review before you widen its role.

Our 7-day After-Hours pilot runs on your line with the HBAA and DPA in place, and ends with an ROI audit of what was answered and captured. Bring your compliance officer to the demo call. It is the best place to test every answer in this guide against your own licence.