Healthcare App Development UAE: DHA Rules and Costs (2026)

Building a healthcare app in the UAE starts with one question: what will your app do with patient data? A wellness app, a clinic booking app and a telehealth platform answer to different rules. Dubai telehealth follows DHA's standard in force since November 2025, and patient data falls under Federal Law No. 2 of 2019, kept inside the UAE.

Key takeaways

• The type of app decides the rules. A wellness app, a booking app for a licensed clinic and a telehealth platform each carry a different set of requirements.

• Patient data has its own law. Federal Law No. 2 of 2019 keeps health data in the UAE for at least 25 years, and the general data protection law (PDPL) leaves it out of its scope.

• DHA tightened telehealth in November 2025. Platforms need DHA approval, a UAE cloud, a NABIDH connection, and HIPAA and ISO 27001 certification.

• Each emirate has its own health record exchange. NABIDH in Dubai, Malaffi in Abu Dhabi and Riayati at federal level, linked since 2023.

• Cost follows the same scoping. A booking or video consultation app sits in a lower band than one connected to patient records.

Building a health or wellness product in the UAE? See how we build healthcare and wellness apps.

What your app does with patient data decides which rules apply, before any feature is scoped.

What does it take to build a healthcare app in the UAE?

It takes a clear answer to what the app does with patient data, because that answer decides the authority, the law and the connections the app needs.

Most of the confusion around health apps in the UAE comes from treating them as one category. A step counter, a booking app for a dermatology clinic and a video consultation platform look alike on a phone, and they sit under very different rules.

Three types of app, three sets of rules:

• A wellness app that holds no clinical data. Fitness, sleep, nutrition or meditation apps that don't provide a health service. The general personal data law usually covers their users' data; an app that starts recording health conditions moves into the next category.

• An app for a licensed clinic or hospital. Booking, reminders, a patient portal or results. The facility holds the licence, and the patient data the app handles falls under the federal health data law.

• A telehealth platform. Video or chat consultations, e-prescriptions. In Dubai, it needs a DHA-licensed telehealth facility and a platform approved by DHA, and it carries the strictest technical requirements.

Scoping this first saves building twice. We diagnose which category an app sits in before we scope a single feature, because the category sets the hosting, the integrations and the approvals, and those are the expensive parts to add later.

Which authority regulates your healthcare app?

The authority depends on the emirate where the facility behind the app is licensed: DHA in Dubai, the Department of Health in Abu Dhabi, and the Ministry of Health and Prevention (MOHAP) for the other emirates.

Each authority licenses the facilities and professionals that deliver care, and each runs or connects to a health information exchange: the shared patient record that hospitals, clinics, laboratories and pharmacies read and write to. Since January 2023, the three exchanges have been linked, so a patient's record can follow them between emirates (DoH, 2023).

Abu Dhabi's cybersecurity standard reaches app builders too. ADHICS V2, in force since August 2024, applies to any entity handling health information in Abu Dhabi, including healthcare technology and service providers. An app built for an Abu Dhabi clinic is built to it.

What does DHA require from a telehealth app since November 2025?

DHA's Standards for Telehealth Services, Issue 4, in force since 26 November 2025, require a licensed telehealth facility, a platform approved by DHA, data hosted in the UAE, a NABIDH connection, and HIPAA and ISO 27001 certification.

The standard applies to telehealth delivered by DHA-licensed facilities and professionals. It treats the platform, meaning the app and the systems behind it, as something DHA assesses and approves before it is used, with legal representation in Dubai.

What the standard asks of a telehealth app:

• A licensed facility and accreditation. Telehealth is offered only through a DHA-licensed telehealth facility, and both facilities and platforms need accreditation.

• Care led by a physician. Telehealth services are physician-led, and clinical assessment stays with a DHA-licensed physician; the platform carries the consultation.

• Consent at every encounter. Patients are identified with at least three identifiers, and consent is documented at each consultation.

• Data hosted in the UAE. Data sits with a cloud provider certified by the Dubai Electronic Security Center, in the UAE, and leaves the country only with DHA approval.

• A NABIDH connection. The health records system integrates with NABIDH, Dubai's health information exchange.

• Certifications. All platforms need HIPAA compliance certification and ISO 27001 certification, in data centres certified at least Tier 3.

• Records kept for 25 years. Telehealth data is retained securely for at least 25 years from the last encounter.

• Prescribing limits. Prescriptions go through an online system that verifies physician, patient and pharmacist, and controlled medicines can't be prescribed by telehealth.

HIPAA is a US law, and DHA asks for its certification anyway. For a DHA telehealth platform, HIPAA certification is a written requirement of the standard, alongside the UAE's own health data law. For other health apps, the UAE law is what binds.

Eight requirements stand between a telehealth idea and a DHA-approved platform.

Which law covers patient data: the PDPL or the health data law?

Patient data falls under Federal Law No. 2 of 2019 on the use of ICT in health fields; the general personal data law, the PDPL, leaves out health data that has its own law.

Many guides, and several AI answers, still name the PDPL (Federal Decree-Law No. 45 of 2021) as the law for health apps. Its scope excludes health personal data regulated by the 2019 law (Clyde & Co, 2021). The PDPL still covers other personal data a business holds, which is why a health app usually answers to both, each for its own part of the data.

What the health data law requires:

• Data stays in the UAE. Article 13 bars storing, processing, generating or transferring health data outside the country unless a health authority approves it. Ministerial Resolution No. 51 of 2021 lists the exceptions, such as treatment abroad, overseas laboratory samples and approved research.

• Records are kept for at least 25 years from the patient's last procedure.

• It reaches the companies that build and run the systems. The law applies to healthcare IT providers as well as to clinics and insurers (Taylor Wessing, 2021).

• Breaches are costly. Storing or transferring health data abroad without approval carries a fine of AED 500,000 to 700,000 (Kayrouz & Associates, 2026).

The law's implementing regulation is Cabinet Resolution No. 32 of 2020. Dubai Healthcare City, the DIFC and ADGM run their own data regimes on top, so an app for a facility in one of those zones checks that zone's rules as well.

Health data answers to its own law; the PDPL covers the rest of what an app holds.

This is general information, not legal advice; a UAE lawyer can confirm what applies to your app.

Do you need to connect to NABIDH, Malaffi or Riayati?

You need a connection when your app keeps or exchanges patient records for a licensed facility; a wellness app or a simple booking app usually doesn't.

The exchanges are built for clinical records, such as diagnoses, prescriptions, laboratory results and discharge notes. The obligation sits with the licensed facility, and the app that holds its records is how the facility meets it.

What each authority asks:

• Dubai. DHA's telehealth standard requires the health records system to integrate with NABIDH.

• Abu Dhabi. Under DoH's policy on the Abu Dhabi Health Information Exchange, onboarding to Malaffi has been a condition for new and renewed facility licences since 1 April 2021 (Al Tamimi, 2020).

• The northern emirates. MOHAP facilities share records through Riayati, the national unified medical record, linked with NABIDH and Malaffi since 2023.

Many clinics already connect through their medical records system. When the clinic's records system is already connected, a patient app reads from it and writes to it, which keeps the app out of the exchange itself. That choice shapes both the build and the cost.

Not sure which of these apply to your app?

Tell us what your app does and where your clinic is licensed, and we'll talk through which rules apply.

Can a healthcare app use AI?

Yes, as support for people: DHA's policy on AI in healthcare asks that AI tools are supervised by the people who use them and that their decisions can be overridden.

The policy (2021) also asks providers to disclose which functions are AI-enabled and to have AI solutions validated independently. Combined with the telehealth standard's rule that care is physician-led, it leaves AI a clear place: triage questions, summaries, booking and reminders, with a clinician deciding.

Administrative AI is the easiest place to start. An AI receptionist that answers patients and books appointments touches no clinical decision. Our guide to AI receptionists for clinics in Dubai covers what one may handle and what it must never say.

What does a healthcare app cost in the UAE?

A booking or video consultation app usually starts in the band of AED 36,700–183,600, and an app connected to patient records in the band of AED 183,600–734,500, according to Clutch's September 2026 data.

Clutch, the B2B review platform, puts most app projects between USD 10,000 and 49,999, with the next band at USD 50,000–199,999; we convert at the dirham's fixed rate of AED 3.6725 to the US dollar. Our guide to app development costs in Dubai explains the bands and the six decisions that set the price.

What moves a healthcare app up the range:

These are market ranges; Applify Lab scopes every project after a diagnosis. A fixed price before we know the app's category would mean pricing in telehealth approval for a booking app, or leaving it out of a platform that needs it.

Start with the part that earns its cost first. For a clinic, that is often booking and reminders; consultations and records follow once the first version is in use. Our guide to clinic appointment apps in Dubai covers that first version.

How do you choose a healthcare app development company in the UAE?

Choose the team that asks what your app does with patient data before it talks about features, and that can show where the data will be hosted.

Most teams will say they have built health apps. The useful answers come from specific questions, asked in writing, before you compare prices.

Five questions to ask:

• Which authority's requirements have you built to? DHA, DoH or MOHAP, and for which type of app.

• Where will the data be hosted? The country, the cloud provider and its certification.

• How will the app connect to patient records? Through the clinic's records system, or directly to NABIDH, Malaffi or Riayati.

• Who owns the code and the accounts? Every Applify Lab client owns 100% of the code once it's built, with the store and cloud accounts in the client's name.

• What happens when the rules change? DHA's telehealth standard and AI policy both carry revision dates, so maintenance includes keeping up with them; our guide to app maintenance in Dubai covers what that costs.

FAQ

Does the PDPL apply to health data in the UAE?

Mostly no. The PDPL, Federal Decree-Law No. 45 of 2021, leaves out health personal data that has its own law, and health data falls under Federal Law No. 2 of 2019 on ICT in health fields. The PDPL still covers a health app's other personal data. This is general information, not legal advice; a UAE lawyer can confirm what applies to your app.

Can patient data be stored outside the UAE?

Only with approval or under a listed exception. Federal Law No. 2 of 2019 bars storing or transferring health data outside the UAE unless a health authority approves it, and Ministerial Resolution No. 51 of 2021 lists exceptions such as treatment abroad and approved research. Breaches carry fines of AED 500,000 to 700,000. In Dubai, telehealth data sits with a DESC-certified cloud provider in the UAE.

Does a healthcare app need DHA approval?

A telehealth platform does. Under DHA's Standards for Telehealth Services, Issue 4, in force since 26 November 2025, telehealth runs through a DHA-licensed telehealth facility, and the platform is assessed and approved by DHA before use. A booking app for a licensed clinic falls outside the telehealth standard, and it still follows the federal health data law.

Do I need to connect my app to NABIDH?

When your app keeps or exchanges patient records for a Dubai facility, yes: DHA's telehealth standard requires the health records system to integrate with NABIDH. Many clinics meet this through their medical records system, so a patient app connects to that system. Abu Dhabi uses Malaffi, and the northern emirates use Riayati.

How much does a healthcare app cost in the UAE?

According to Clutch's September 2026 data, most app projects cost AED 36,700–183,600, the band where booking and video consultation apps usually start. Apps connected to patient records usually start at AED 183,600–734,500. Hosting in the UAE, approvals and certifications move a health app up. These are market ranges; Applify Lab scopes every project after a diagnosis.

Is HIPAA required for a UAE health app?

For a DHA telehealth platform, yes: DHA's telehealth standard requires HIPAA compliance certification and ISO 27001 for all platforms. For other health apps, the binding rules are the UAE's own, starting with Federal Law No. 2 of 2019 on health data. HIPAA itself is US law, so its certification serves here as a technical benchmark that DHA asks for.

To go further

Explore how we build healthcare and wellness apps for UAE clinics and health businesses.

See how we approach custom app and AI development in Dubai.

Discover the chronic-care companion app we built.