Readiness
UAE-specific governance, policies and evidence in place for your product and your support model.
Service · Health-tech suppliers
Your product is ready for a UAE hospital. Is your evidence?
An Abu Dhabi or Dubai provider can only say yes to a supplier who shows how patient data is protected, where it is held, who can reach it and how any AI features are governed. We build that evidence with you, written for the UAE, in six weeks and for one fixed fee.
Where suppliers lose months
EMR, telehealth, imaging, lab and clinical AI vendors usually arrive with a good product, UAE cloud hosting and a willing prospect. What stops them is governance evidence. Policies written for another country come back with questions because they do not reflect UAE requirements, and every round of questions adds weeks.
The questions are predictable. Where does patient data live? Federal Law 2/2019 keeps health data in the UAE. Who can reach it from abroad? Offshore support teams are the most common sticking point. What standard binds you? ADHICS applies to technology and service providers directly, not only through your client's contract. How is your AI governed? Abu Dhabi's Responsible AI Standard covers AI bought from third parties, expects AI compute and storage in the UAE with support access from inside the country, and keeps production data out of model training.
The route to going live
Five stages for a supplier to an Abu Dhabi provider; Dubai follows the same shape with DHA and NABIDH. Our work makes the first three straightforward and prepares you for the last two.
Prospect due diligence
Your prospect assesses you as a supplier: security and privacy questionnaires, evidence requests and contract terms.
Regulatory alignment
Your prospect, as the licensed facility, confirms your product meets DoH and ADHICS requirements.
Exchange onboarding
Integration, security assurance and conformance testing before your product exchanges data with Malaffi or NABIDH.
Go-live
Contract signed, system live, and compliance maintained from then on.
What we do
One engagement, four stages, delivered by us with short working sessions with your team.
Assess
Your product, in each version you sell, your hosting and your support model against UAE health-data law, ADHICS, the DoH or DHA standards, the health information exchange and Emirates ID requirements. Every gap identified, and the safest operating model agreed for supporting UAE data.
Review your policies
What you already have, including any ISO/IEC 27001 work: what can be kept, what needs strengthening and what must be replaced for the UAE.
Build
Your complete UAE policy suite and supporting assessments, and data flow diagrams produced with your engineers. Your AI governance and your position on any access from outside the UAE set out in terms a UAE reviewer will accept.
Prepare for onboarding
Your responses to your prospect's due diligence and your evidence for the regulator and the exchange, and a session taking your leadership through the findings and next steps.
What you receive
Delivered in editable formats and branded as your own.
- UAE requirements and gap assessment
- Review of your existing policies
- Operating model recommendation, including any support from outside the UAE
- Complete UAE information security and data protection policy suite
- Data flow diagrams for each product version
- Data protection impact assessment and record of processing
- Cross-border access risk assessment
- AI governance policy and human oversight statement
- Supplier due-diligence response pack
- Regulator and health information exchange evidence pack
- Onboarding roadmap with owners and dates
- Leadership readout
What it costs
One fixed fee for the full scope, paid in advance in two instalments: half before kick-off, half before the build stage. Each stage starts once its instalment has cleared.
Health-tech supplier readiness, UAE
One product, AI and non-AI versionsOne prospectOne emirateSix weeks
Includes 30 days of follow-up questions by email after delivery, up to six working sessions and two review rounds on each document. A second emirate, product or prospect is scoped and priced before you commit.
From AED 42,000≈ USD 11,436. Excludes VAT and other taxes, applied as the law requires.
Support through due diligence and onboarding
Help during your prospect's review, with the regulator or the exchange, or when you add customers.
AED 3,500 per consultant day≈ USD 953. Agreed and paid in advance. No minimum commitment.
What we need from you
The six weeks start when we have a named technical lead and business lead; a short overview of each product version, including any AI or cloud services it uses; your existing policies and ISO/IEC 27001 documentation in whatever state they are in; your cloud architecture and who will access UAE data, from where and why; anything your prospect or regulator has sent you; and time for a two-hour kick-off and three or four short working sessions.
Outside this service
Approval decisions, which rest with your prospect and regulators. Technical build work, including cloud configuration, exchange and Emirates ID interfaces, and penetration testing. ISO/IEC 27001 certification, which only an accredited body can grant. Legal advice, licensing and contract drafting, which need UAE counsel. Medical device registration: if your AI features could be regulated as a medical device, we tell you in week one and recommend a specialist.
The firewall
This is readiness work, so we will never assess it. Because we help write your documentation, we will not later act as its independent assessor or issue it an AI Trust Passport. Your prospect and regulators make their own assessment of it.
Questions
Do you get our product approved?
No. Approval decisions rest with your prospect, the Department of Health and Malaffi in Abu Dhabi, or the Dubai Health Authority and NABIDH in Dubai. We prepare you so that their review is short; we cannot guarantee its outcome or timing.
Will you audit us afterwards?
No. Because we help write your documentation, we will not later act as its independent assessor or issue it an AI Trust Passport. Your prospect and regulators make their own assessment.
Does the work need patient data?
No. We work from your product documentation, architecture, policies and the requirements your prospect has sent. No patient data is needed or accepted. Meetings are held remotely.
Do you use AI tools?
Yes, enterprise AI tools speed up drafting under consultant review. Your documents are not used to train any model, and no patient data is ever entered into them.
Can this support our ISO/IEC 27001 work?
Yes. Everything is written for the UAE and aligned to ISO/IEC 27001:2022, so the same documents support your UAE onboarding and your certification and you do not maintain two sets. Certification itself can only be granted by an accredited body.
Selling into Saudi Arabia instead? Start with our Saudi supplier guide.
Tell us about your prospect
The product, the emirate, the facility and what they have asked you for so far. We reply within one working day with whether this fits, and a fixed proposal if it does.