A clinic that brings enquiries into a CRM and answers patients in WhatsApp handles health data every day, often without noticing. In the UAE this data has its own law with strict rules on where it is stored and how it may be used, and medical advertising in Dubai has its own standards, including messages in WhatsApp. This guide explains in plain words what goes into the CRM, what stays in the medical system, when you need written consent and how to write messages that stay within the rules. It is practical guidance, not legal advice: confirm the setup for your clinic with your medical director or lawyer.
Talk to usSeveral sets of rules meet in a clinic's chats and CRM. The main one for patient data is Federal Law No. 2 of 2019 on the use of information and communication technology in health fields. It applies to health facilities across the UAE, including the free zones, and it defines health data broadly: information collected about a patient in connection with health services can fall under it, not only diagnoses.
The UAE personal data protection law, Federal Decree-Law No. 45 of 2021, does not apply to health data that is regulated by its own legislation, but it still matters for contact details and direct marketing. Dubai Healthcare City, DIFC and ADGM have their own data regimes, so first check which one covers your licence.
The simplest safe setup is to split roles. The medical system holds everything clinical. The CRM holds what the front desk needs to answer, book and follow up, and nothing more.
Because even a name with an appointment at a clinic can count as health data, ask your CRM provider where your account is hosted. Zoho opened data centres in Dubai and Abu Dhabi in 2026; for any CRM, check with the vendor whether your account can be hosted in the UAE, and agree the setup with your lawyer. A practical split looks like this.
| Data | Where it lives | In the CRM |
|---|---|---|
| Name, phone, channel, language | CRM and medical system | Yes |
| Source of the enquiry, ad campaign | CRM | Yes |
| Service the patient asked about | CRM and medical system | Neutral wording |
| Appointment date, doctor, branch | Booking system and CRM | Yes |
| Consent to reminders and offers | CRM, with date and channel | Yes |
| Symptoms, diagnosis, test results | Medical system | No |
| Prescriptions, treatment notes | Medical system | No |
| Before-and-after photos | Medical system, with consent | No |
| Emirates ID, insurance card copies | Medical system | No |
Patients write in WhatsApp the way they talk: they describe symptoms, send photos and lab results, ask whether a treatment is right for them. The front desk and the bot need written rules for this, otherwise clinical information ends up scattered across personal phones and CRM notes.
Reminders about an appointment the patient booked are part of the service. Offers, win-back messages and news are marketing. For marketing to existing patients you need their consent: the health data law requires written consent to use health data for non-health purposes, and the personal data law gives everyone the right to refuse direct marketing. Keep the two apart and do not slip an offer into a reminder.
On WhatsApp, messages outside the 24-hour window after the patient's last message go only through the WhatsApp Business Platform with templates approved by Meta, and WhatsApp's policy also requires opt-in and an easy way to opt out.
Dubai's standards for medical advertisement content on social media apply to DHA-licensed facilities and professionals on all major platforms, WhatsApp included. In practice this covers broadcast texts, bot answers about treatments and posts by doctors that name the clinic.
TLNT.ae is an international company based in the UAE and has worked here since 2022. In our business consulting practice we set up CRM and AI chatbots for clinics in Dubai: we split data between the CRM and the medical system, write the bot's red lines, build reminders and consent fields, and check templates against the DHA standards. We come to the clinic for the audit and the front desk training. TLNT.ae is an official amoCRM partner in the amoSTART programme.
Every project starts with a free review, a 15-minute call. After it we name a fixed project price, and we agree it with you before work starts.
Keep the CRM to contacts, enquiries and bookings, and leave clinical information in the medical system. UAE law requires health data to be stored and processed in the country unless an exception applies, so ask the vendor where your account is hosted and agree the setup with your medical director or lawyer.
Yes. The health data law requires written consent to use health data for non-health purposes, the personal data law gives a right to refuse direct marketing, and WhatsApp requires opt-in and an easy opt-out. Reminders about a booked appointment are part of the service, but keep offers out of them.
The DHA standards for medical advertisement content on social media list WhatsApp among the platforms they cover. Broadcasts and bot answers about treatments should avoid absolute claims, comparisons and patient content without written consent.
A free review in WhatsApp: we look at your numbers and tell you honestly what we would do.
Message on WhatsApp