Why UAE Health Data Must Stay Onshore, and What It Means for Health Kiosks

Under health data law in the UAE, patient health data generally has to be stored inside the country. Federal Law No. 2 of 2019 on the use of information and communication technology in health fields sets this out in Article 13, with exceptions only where the regulations allow them. If you plan to deploy a connected health kiosk, this rule decides where every screening result lives.

This guide explains what the law asks for, why it matters for smart health kiosks, and the checklist every buyer should use before signing a contract.

The main rules come from the federal health ICT law and the UAE’s data protection framework. The law firm Al Tamimi & Company has published a useful summary, and Kayrouz & Associates covers how it applies to telehealth providers.

• Local storage: health data and information about patients must be stored and processed in the UAE, unless an exemption under MOHAP Resolution No. 51 of 2021 applies.
• Long retention: health records must be kept for at least 25 years from the date of the last procedure.
• Penalties: breaching the localisation rule can lead to fines of AED 500,000 to AED 700,000.
• Sensitive data: the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) treats health data as sensitive personal data, which carries stricter handling rules.
• Free zones: Dubai Healthcare City (DHCC), DIFC and ADGM have their own data regimes. If your office sits in one of them, check the zone’s rules as well.

A smart health kiosk in the UAE is not just a machine in a corner. Every visit creates a medical record: blood pressure, ECG, blood sugar, haemoglobin, a colour-coded report and sometimes a doctor’s notes and an e-prescription.

Most kiosks send that record to a cloud server. That is how the report reaches the patient’s phone, how the doctor sees results during a teleconsultation, and how an employer gets an anonymised dashboard. If the server sits outside the UAE, the deployment may not comply with the localisation rule.

The issue is easy to miss because many kiosk platforms were designed for other markets. A provider might host data in India, Europe or the United States by default. Before you sign, ask exactly where the data is hosted, who can access it and how long it is kept.

When you assess a kiosk provider, follow the data through three steps.

Use this list in every procurement conversation:

• Hosting location: is patient data stored on servers inside the UAE, including backups?
• Retention: can records be kept for 25 years, and retrieved if needed?
• Encryption: is data encrypted in transit and at rest?
• Access control: do roles limit who sees individual results? HR should see aggregate trends, not personal reports.
• Patient ownership: do reports go only to the patient’s own WhatsApp, email or app?
• Consent: does the kiosk record the patient’s consent before screening?
• Free zone sites: if the kiosk will sit in DHCC, DIFC or ADGM, have you checked that zone’s rules?
• Exit plan: if you change provider, how is the data returned to you, and in what format?

The Clinics On Cloud platform runs on AWS with primary, hot-standby and disaster-recovery copies. Data is encrypted in transit and at rest, access is role-based at every layer, and reports are shared only through the patient’s own WhatsApp, email and QR health card.

The platform follows ISO 27001 information security practices and HIPAA-aligned privacy controls, and it has been tested through VAPT security assessments. Where a project requires it, the application and data can be deployed on client-controlled or in-country infrastructure. You can read more about the platform on the Clinics On Cloud Health Kiosk page.

For an employer, the law creates a clear duty of care. When you put a health kiosk in your office, you become part of how employees’ medical data is handled, even if you never see a single personal result.

That is why the best corporate wellness programmes separate the two views. Employees see their own reports. HR sees anonymised totals: how many people were screened, which risk areas are common, which departments need attention. Our employee health screening day checklist shows how to set this up from the start.

Data rules also link to telehealth rules. If your kiosk offers a doctor on video, the consultation must be delivered by an authorised facility in your emirate. We cover that in DHA vs DOH vs MOHAP telehealth rules.

Keep UAE health data in the UAE. Keep it for 25 years. Keep it in the patient’s hands. Ask every provider to show you how they do each of these, in writing, before you sign.

Talk to our team about a compliant deployment, or read about the Health Kiosk.

This article is general information, not legal advice. Confirm current requirements with your legal counsel and the relevant health authority.