PDPL for UAE clinics: your website handles health data.
Booking forms, patient enquiries and the analytics on your treatment pages all touch sensitive personal data. Under the UAE PDPL, health data carries a higher bar — and most clinic sites were never built for it.
Why clinics are different
Health data is sensitive personal data — and the bar is higher.
Under the Federal PDPL, health data is a special category of sensitive personal data, subject to stricter conditions than an ordinary contact detail.
A clinic site collects it everywhere: appointment and intake forms, symptom or treatment enquiries, WhatsApp and email, even reviews that identify a patient.
Analytics and marketing pixels on condition and treatment pages can infer health information about a visitor before any consent is recorded.
On your website
Where a clinic website exposes health data.
Most exposure is ordinary plumbing that was never designed with sensitive data in mind. Each of these is a processing decision you should be able to explain.
Booking & intake forms
Names, contact details and often symptoms or treatment reasons — sensitive by context.
Enquiries via WhatsApp & email
Health questions arrive through channels with their own data trail and residency.
Analytics & pixels
Trackers on condition or treatment pages can infer health status before consent.
Reviews & testimonials
Patient names tied to a treatment are identifiable health data — publish with care.
What the law asks
Sensitive data means a higher standard of care.
The PDPL is consent-first with no general legitimate-interest basis, and sensitive data raises the bar further. Some operational specifics are deferred to the Executive Regulations, unissued as of 2026 — so we build to the principles and keep the details adjustable.
Stronger, explicit consent
Clear, specific and informed — recorded and revocable, not a pre-ticked box.
Purpose & minimisation
Collect only what a booking needs; do not gather health detail you will not use.
Documented retention
Keep patient enquiries only as long as the purpose requires, then delete.
Access & erasure paths
A defined way for a patient to see, correct or remove their data.
Beyond the website
Your clinical systems need a lawyer, not just a web build.
Clinics may also fall under UAE health-sector rules (for example DHA, DoH or MOHAP health-data requirements), and, in a free zone, under DIFC or ADGM.
We build and document the website and its data flows to the PDPL. Your electronic medical records and clinical systems should have separate legal review.
The two fit together: a compliant public site, and clinical systems your legal advisor signs off — we are happy to work alongside them.
FAQ
Common questions from clinics
Does my clinic website need to comply with the PDPL?
If it collects any personal data — a booking form, an enquiry, analytics or cookies — the UAE PDPL (Federal Decree-Law No. 45 of 2021) applies. For a clinic, much of that data is health-related and therefore sensitive, which raises the standard.
Is health data really treated differently?
Yes. Health data is sensitive personal data under the PDPL and carries stricter conditions than ordinary contact details — starting with clearer, explicit consent and tighter purpose limits. Some operational specifics are deferred to the Executive Regulations, which are not yet issued as of 2026.
Do booking and enquiry forms need consent?
They need a lawful basis, transparent information about what you do with the data, and — for the sensitive parts — explicit, recorded consent. It should be as easy to withdraw as to give.
What about patient enquiries over WhatsApp?
The same principles follow the data wherever it travels: a defined purpose, minimal collection, documented retention and a path to access or delete. We map those channels as part of the build.
Are we also under DHA or other health-authority rules?
Possibly — UAE health authorities (such as DHA, DoH or MOHAP) have their own patient-data requirements, and free zones add DIFC or ADGM. We handle the website and its data flows; your clinical records systems should have separate legal review, and we work alongside your advisor.
Next steps
Check it, understand it, or get it built.
Send your URL and get a short written readiness report — where you stand and what to fix first.
Federal PDPL, DIFC, ADGM and the GDPR, cited by article — with the side-by-side comparison.
A clinic site with data protection designed into the build, documented and defensible.
Book a consultation
Talk to us about your clinic site.
Tell us how patients reach you today. We come back within one business day with an honest view of what a compliant clinic presence would take.
- Direct reply from the founder
- No obligation, no sales sequence
- Your details handled per the PDPL