Regulatory requirements for clinics explained: NPHIES claims, ZATCA e-invoicing, Saudi PDPL, the UAE health data platforms, staff licensing, and protecting patient records.
"Delete my data" and "keep this record for ten years" arrive from two different authorities, and both bind you. This guide puts the mandatory period for every country we serve in one table, explains which obligation wins and when, and shows how to answer a patient who asks for erasure before the clock runs out.
A clinic with one shared front-desk password has already made its decision: convenient on day one, and unaccountable by month three, because nothing in the system can say which of the three people using it actually opened a given file.
We added a floating assistant that answers questions about how the system works and about your clinic's numbers today. The hard part was never the answering — it was guaranteeing that no clinic can reach another clinic's data.
A shared front-desk login with one password everyone knows undoes any privacy policy written on paper. Real protection starts with three technical layers that don't depend on every staff member remembering the rules.
Your clinic's facility licence lets the building operate. It says nothing about whether the doctor inside it is currently allowed to practise — and that's a separate, per-person clock clinics track far worse.
NPHIES isn't just a portal — it reshapes the clinic revenue cycle. Clinics that understand the eligibility → authorisation → claim sequence cut rejections measurably; those that treat it as a digital paper form accumulate uncollected receivables.
E-invoicing looks like an accounting topic, but inside a clinic it's an operational one: who issues the invoice, when, and what happens on a refund or a changed treatment plan. This guide covers the cases clinics actually hit.
Patient data is sensitive data under the law. Compliance isn't a document you write once — it's daily controls: who sees what, how long data is kept, and what happens on a breach. Here's a working checklist.
The UAE isn't one regulatory market. A Dubai clinic deals with NABIDH, an Abu Dhabi clinic with Malaffi, and one in Sharjah or Ajman with Riayati. Clinics opening a second-emirate branch usually find this out too late.