UAE Health Data Sovereignty Guarantee
In accordance with UAE Federal Law No. 2 of 2019 Concerning the Use of Information and Communication Technology in Healthcare (ICT Healthcare Law), all identifiable health data processed via Clinix Cloud remains securely stored within certified UAE data center facilities (Oracle Cloud UAE / AWS Middle East UAE region) and is never exported outside the UAE without prior statutory Ministry authorization.
1. Scope and Applicability
This Privacy Policy explains how Clinix Healthcare OS ("Clinix", "we", "us", or "our") handles health data, clinical records, diagnostic photographs, Emirates ID demographic tokens, and billing information collected through our Electronic Medical Record (EMR) software, patient queue mobile tokens, and associated healthcare clinic websites.
2. Categories of Clinical & Personal Data Processed
- Patient Identifiers & Demographics: Name, EID card chip cryptographic identifier, nationality, gender, date of birth, contact number, and emergency contact details.
- Electronic Health Records (EHR): SOAP physician notes, vital signs, ICD-10 diagnostic classifications, CPT treatment coding, allergy registries, and immunization logs.
- Dental & Aesthetic Records: #1-32 visual odontograms, periodontal probing charts, clinical pre/post-operative photographic documentation, and laser treatment joule logs.
- Pharmacy & Prescription Records: UAE Tatmeen 2D DataMatrix serial codes, GS1 GTIN codes, medication dispensing timestamps, and physician e-Rx approvals.
- Insurance & Financial Data: DHA eClaimLink XML claims, Malaffi/Shafafiya authorizations, patient co-pay records, and FTA VAT tax invoices.
3. Purpose and Legal Basis for Processing
Processing of medical records occurs under lawful bases established by UAE healthcare regulatory bodies including the Dubai Health Authority (DHA), Department of Health (DoH Abu Dhabi), and Ministry of Health and Prevention (MOHAP):
- Direct outpatient and inpatient medical care provision and diagnostic assessment.
- Automated interoperability with NABIDH (Dubai) and Malaffi (Abu Dhabi) national health exchanges.
- Submitting and adjudicating statutory electronic health insurance pre-authorizations and claims.
- Ensuring clinical safety through automated contraindication and allergy alerts.
4. Encryption and Technical Safeguards
Clinix enforces bank-grade security standards across all layers:
5. Statutory Medical Record Retention
Medical records are retained in accordance with DHA and MOHAP statutory retention guidelines (a minimum of 25 years from the date of the last treatment or until the patient reaches 25 years of age in pediatric cases), after which records are archived or securely sanitized according to UAE health data destruction protocols.
6. Data Protection Officer & Contact
For inquiries regarding health data governance, patient consent verification, or clinic data retrieval: