Where Can a Dubai Therapist Store Client Notes? The UAE Health Data Rules

Therapist client notes storage in the UAE: why this question catches practices out

Most therapy practices in Dubai choose their software while setting up the practice, at the point when the priority is seeing clients rather than reading legislation. The booking platform is whichever one a colleague recommended, notes go into whatever app is convenient, and the whole arrangement works well enough that nobody revisits it.

The question then arrives from somewhere unexpected. A licence renewal asks where records are held. An insurer's form asks about data storage. A landlord in a medical building asks for evidence before granting a licence to occupy. At that point the practitioner discovers that the honest answer is not known, because the software never said and nobody asked.

It is worth separating two things here. Whether your records are secure is a question about encryption, passwords and access. Whether they are in a permitted location is a separate question with a different answer, and a practice can easily be strong on the first and non-compliant on the second.

What the UAE rule actually says

UAE federal law governing the use of information and communication technology in health fields sets out that health data related to health services provided inside the UAE may not be stored, processed, generated or transferred outside the country, unless the activity is approved by the relevant health authority in coordination with the federal ministry. The law is written to apply across the country, including free zones.

It also sets a minimum retention period for health records that is considerably longer than most small businesses plan for, measured in decades from the last procedure rather than in a handful of years. That single provision has more practical effect on a small practice than almost anything else, because it turns backup from an operational habit into a records obligation.

We are IT engineers rather than lawyers, so treat this as orientation rather than advice. The authoritative places to confirm what applies to your licence and scope of practice are the UAE Ministry of Health and Prevention and, for a Dubai-licensed practice, the Dubai Health Authority, alongside your own legal advisor.

Do a therapist's notes count as health data?

For most practices the answer is straightforwardly yes. A physiotherapy record describing an injury and a treatment plan, a nutritionist's file listing medication and conditions, an osteopath's assessment notes: all of these describe a person's health and were created in the course of providing a health service in the UAE.

Practitioners sometimes assume the rule is aimed at hospitals and large clinics, and that a two-room practice falls outside it. The obligation does not scale with the size of the practice, and neither does the consequence of getting it wrong. What does scale is the cost of compliance, which for one or two practitioners is modest.

The grey area is genuinely grey for some wellness services. A record of massage appointments with no health information reads differently from one recording contraindications and medication. Where a practice sits on that line is a question for the licensing authority rather than for an IT provider, and in our experience most practices find that they hold more health information than they first thought, because intake forms collect it by default.

The software question, and how to ask it

The useful question to put to any supplier is short: in which country is our client data stored, and will you state that in writing? A supplier who can answer immediately and specifically is usually fine. A supplier who answers with reassuring language about security while never naming a country has effectively answered the question.

Several categories tend to fail. Consumer cloud storage rarely lets you choose or confirm a region. International booking platforms often default to data centres in the United States or Europe with no regional option for a market the size of the UAE. Note-taking apps sync wherever the vendor chose, and a personal account attached to a practitioner's own email address is outside the practice's control entirely.

What tends to work is either a system explicitly offering UAE or regional hosting, or a setup where records are held on storage the practice controls, backed up to a location it has chosen deliberately. Our storage and backup service exists partly for this, because a practice that needs records in a known place and kept for decades is describing on-premises storage with a designed backup rather than a consumer subscription.

Email is the leak nobody draws on the diagram

Ask a practitioner where client data lives and you will get a list of systems. Ask where intake forms arrive and the answer is almost always email, which never appears on the list. Yet a mailbox holding completed health questionnaires is holding health data, in whatever country the mail provider chose, for as long as the practitioner keeps the message.

Personal email accounts are the sharper version of the problem. A practitioner using a personal address for practice correspondence has put client information into an account the practice does not own, cannot audit and cannot close. If that person leaves a group practice, or simply loses the password, the records go with them.

The fix is unglamorous and effective. Use a practice domain rather than a personal address, route intake forms into the system that holds client records instead of into a mailbox, and stop treating email as storage. Where a form genuinely must be emailed, the message should be deleted from the mailbox once the content is in the record, because a mailbox is the one place nobody ever applies a retention rule to.

Retention changes how backup should be built

A retention period measured in decades is longer than the working life of any hard drive, and considerably longer than most software subscriptions last. That has consequences people rarely plan for: the format has to remain readable, the storage has to be replaced while preserving the contents, and the practice has to still be able to retrieve a record from a system it stopped paying for years ago.

In practice that argues for three things. Keep records in a format you could still open without the original vendor. Hold at least one copy on storage you control rather than only inside a platform. And test a restore, because an untested backup is a belief rather than a control. Microsoft makes the same distinction in its own guidance on Microsoft 365 Backup, which exists precisely because a cloud platform holding your data is not the same thing as a backup of it.

This is also where practices discover the cost of having postponed the decision. Migrating five years of notes out of a platform that stores them offshore is a bigger job than choosing correctly on day one, though still a finite one.

What happens when the practice grows

A solo practice has one advantage: only one person can see anything. The moment a second practitioner or an administrator joins, access becomes a decision rather than a fact, and most software defaults to letting everybody see everything.

The pattern that works is access by clinical relationship: a practitioner sees their own clients, with a documented route for supervision and holiday cover rather than permanent visibility for all. Administrative staff need bookings, contact details and invoicing, and specifically do not need clinical notes. Almost every practice-management system supports this distinction and almost none of them apply it by default.

Joiners and leavers then matter more than any technical control. Access should be granted on a person's first day and removed on their last, as a written step someone owns, not a verbal request made in a busy week. A quarterly review listing every account and when it was last used is the thing that catches what the process missed, and dormant accounts are what it catches most often.

What a compliant small practice actually looks like

None of that is expensive or exotic at the scale of a small practice. Most of it is configuration of software already being paid for, and the inventory is an afternoon's work that answers the licence and insurer questions permanently. The items that cost money are storage and, occasionally, moving off a platform that cannot tell you where your data lives.

• One system of record for client notes, with its storage location known and documented.
• A named login per practitioner, with no shared practice password anywhere.
• Multi-factor authentication on every account that can reach client records.
• Full-disk encryption on every laptop and phone able to open a record.
• Admin staff able to see bookings and contact details but not clinical notes.
• A backup to a deliberately chosen location, with a restore that has been tested.
• A one-page written inventory of which system holds what, and where.

The order to do this in

Start with the inventory, because you cannot fix what you have not listed. Write down every place client information exists: the booking system, the notes app, email, the intake form, the practitioner's phone, any spreadsheet. For each one, note what it holds and where the supplier says it stores it.

Then close the obvious gaps, which are usually encryption, multi-factor authentication and shared logins. These are quick, they reduce real risk immediately, and they do not depend on resolving the harder question. Our cybersecurity guidance for small businesses covers the same ground for practices that are not health-related.

Only then take on the storage location question, with your regulator's answer in hand rather than a guess. Migrating a system is the most disruptive item on the list and the one most worth doing once, correctly, rather than twice. If you would rather not run that process alone, a free practice assessment produces the inventory and the gap list for you, and counselling practices have additional considerations set out on our counsellors page.

Frequently asked questions

Written by Srinivasan Ramachandran, Founder, Listonics · Published Sep 24, 2026 · Last reviewed October 11, 2026 · 2,071 words