Cloud Data Residency in the UAE: What Doctors Must Ask AI Vendors

Category: Privacy & Compliance | Market: UAE | Keywords: UAE cloud data residency healthcare AI vendor

When a physician in Dubai or Abu Dhabi uses an AI medical scribe, sensitive patient information is being processed by a third-party system. The question of where that data physically resides, and under which jurisdiction's laws it is governed, is not a technical detail. It is a compliance, ethical, and legal imperative. In the UAE, the regulatory framework around health data residency is clear enough to guide decision-making, but only if you know what to ask.

## What Is Data Residency and Why Does It Matter in the UAE?

Data residency refers to the physical location of servers and data centres where your data is stored and processed. For AI medical scribes, this means the location of servers that receive consultation audio, generate transcriptions, produce clinical notes, and store the resulting records.

In the UAE, health data residency matters for three reasons. First, MOHAP and emirate-level regulators expect that patient health information is stored in ways that comply with UAE privacy and security standards. Second, the UAE has national security interests in ensuring sensitive health data about UAE residents does not sit on servers subject to foreign government access orders. Third, patients have a reasonable expectation that their health information stays within a jurisdiction where their rights are enforceable.

## The UAE Legal Framework on Health Data Storage

• Federal Decree Law No. 45 of 2021 on the Protection of Personal Data sets rights and obligations for personal data processing in the UAE, including health data. It requires that data processors implement appropriate safeguards and that cross-border data transfers satisfy adequacy or consent requirements.

• MOHAP data security guidelines require that health information systems meet specified security standards, which are considerably easier to verify when infrastructure is UAE-resident.

• UAE Cloud Computing Policy: The government has directed federal entities to prefer UAE-based cloud services for sensitive data, signalling the regulatory direction of travel.

• DHA NABIDH and DOH Malaffi frameworks both require that clinical data flowing through these HIEs originates from systems that meet UAE security and privacy standards.

## 10 Questions to Ask Your AI Scribe Vendor

1. Where are your data centres located? If the vendor cannot specify the country and city of their primary and backup data centres, that is a red flag.

2. Is patient data processed in the UAE or another jurisdiction? Processing and storage may occur in different locations. Clarify both.

3. Can you offer UAE data residency? Many leading vendors offer regional data centres. Ask specifically whether a UAE or GCC-based processing and storage option is available.

4. Under what circumstances can foreign governments access patient data on your servers? US-based vendors are subject to the US CLOUD Act. Know the legal regime governing your vendor's data.

5. Is audio retained after note generation? A vendor that retains audio is accumulating a compliance liability on your behalf.

6. What encryption standards do you use? Minimum acceptable: TLS 1.2+ in transit, AES-256 at rest.

7. Who within your organisation can access patient data? Require role-based access controls and a commitment that patient data is not accessible to non-clinical teams.

8. Do you use patient data to train AI models? If yes or ambiguous, this is a fundamental compliance issue requiring explicit patient consent.

9. Can you provide a Data Processing Agreement compliant with UAE law? Any responsible vendor operating in the UAE market should be able to provide this.

10. What is your data breach notification process? UAE law requires prompt notification of data breaches. Your vendor must have a contractually committed notification process.

## Red Flags to Watch For

• The vendor cannot specify where data is stored or processed.

• The DPA references only US or EU law with no provisions for UAE requirements.

• The vendor's privacy policy states data "may be shared with affiliates" without specifying who those are.

• Audio is retained indefinitely or for extended periods without clinical justification.

• The vendor uses patient data to improve or train AI models without explicit opt-in.

• The vendor refuses to provide a written DPA, offering only a click-through privacy policy.

## Conclusion

Data residency is not a bureaucratic checkbox. It is a genuine patient protection and regulatory compliance issue for every UAE clinic using an AI medical scribe. The good news is that the questions to ask are clear, the red flags are identifiable, and a growing number of purpose-built medical AI vendors offer UAE-compatible data residency as a standard option. Ask the questions before you sign, not after.

Internal links: AI Scribe Vendor Due Diligence UAE, MOHAP UAE Compliance Checklist, DHA Licensing AI Dubai, NABIDH Platform Dubai