Skip to content
Trust Center · Compliance

Compliant with DHA, DoH, MOHAP, ADHICS, HIPAA and GDPR.

The UAE regulators and the international frameworks clinics ask about, explained in terms of what they mean for patient calls and messages.

Request the packData and security
Framework mapCompliant with all six
UAEUAE
  • DHADubai
  • DoHAbu Dhabi
  • MOHAPFederal · northern emirates
  • ADHICSAbu Dhabi · security standard
InternationalUS · EU
  • HIPAAUnited States patients
  • GDPREuropean Union patients
What each framework means

For a clinic's patient communication

DHAUAE
DHACOMPLIANT
AUHDXBSHJAJMUAQRAKFUJ
24-hour windowNABIDH breach notice

Dubai Health Authority

For Dubai-licensed facilities, patient communication handled by VoclyAI follows the DHA's rules on health data: hosted in the UAE, access-controlled, logged, and handled under an agreement with the facility. Where DHA (NABIDH) requirements apply to a breach, the 24-hour notification window is used.

DoHUAE
DoHCOMPLIANT
AUHDXBSHJAJMUAQRAKFUJ
24-hour windowMalaffi breach notice

Department of Health, Abu Dhabi

For Abu Dhabi facilities, the same data handling applies under the Department of Health's framework, including the 24-hour notification window where DoH (Malaffi) requirements apply, and alignment with the ADHICS standard below.

MOHAPUAE
MOHAPCOMPLIANT
AUHDXBSHJAJMUAQRAKFUJ
Stays in the UAE unless authorised

Ministry of Health and Prevention

For facilities licensed federally and in the northern emirates, VoclyAI follows the federal rules on health information, including keeping it in the UAE unless the facility authorises otherwise in writing.

ADHICSUAE
ADHICSCOMPLIANT
EncryptionRole accessAudit logsIncident response

Abu Dhabi Healthcare Information and Cyber Security Standard

The security controls behind the platform (encryption at rest and in transit, role-based access, audit logs, monitoring and incident response) are run to the ADHICS standard expected of a healthcare information supplier.

HIPAAInternational
HIPAACOMPLIANT
Business associate agreementUS patients · PHI safeguards
HBAA in place

US Health Insurance Portability and Accountability Act

For providers that serve US patients or work with US partners, protected health information in calls and messages is handled under HIPAA privacy and security safeguards, with a business associate agreement (our HBAA) in place.

GDPRInternational
GDPRCOMPLIANT
Data-subject requestEU patient · via the clinic
DPAPurpose limits

EU General Data Protection Regulation

When a clinic communicates with patients in the EU, their data is processed on the clinic's instructions as a processor, with a DPA, purpose limits, data-subject request support and breach notification.

Before deployment

Agreements and eligibility

Mandatory

HBAA

Health Business Associate Agreement

Signed

HBAA, mandatory

A Health Business Associate Agreement is signed before every deployment. No HBAA, no go-live.

Available

DPA

Data Processing Agreement

On request

DPA, available

A Data Processing Agreement sets out what we process, on whose instructions, and the deletion and breach terms.

Eligibility

Activation check

Vocly Demo Clinic
Healthcare providerLicensed

Licensed providers only

VoclyAI is offered only to licensed healthcare providers. Licence details may be requested before activation.

For IT, legal and the medical director

Request the documentation pack

Business details only. We send the pack within one working day and answer the reviewer's questions directly.

  • Security and data-handling overview
  • Data map per component, with controller and processor roles
  • Health Business Associate Agreement (HBAA) template
  • Data Processing Agreement (DPA) template
  • AI transparency statement and safety rules
  • Subprocessor list, under NDA

Business details only. Please do not include patient information.

7 days · no IT disruption

Start with a 7-day pilot.

Seven nights on your after-hours line. No IT disruption, and an ROI audit at the end.

Start a 7-day pilotRequest a demo
Period
7 days
Pilot
After-Hours
Covers
Nights, weekends, holidays
Ends with
ROI audit