A therapy practice is usually one or two practitioners holding some of the most sensitive records a small business can hold. The IT question is rarely about equipment. It is where client notes are allowed to sit under UAE rules, who can reach them, and whether they survive a lost laptop.
Why is a therapy practice a harder IT problem than its size suggests?
A two-room practice has the administrative burden of a small office and the confidentiality burden of a clinic. Client notes may record injuries, diagnoses, medication and treatment history. That is health information, and it is regulated in the UAE regardless of how small the practice is or whether it operates from a shared wellness centre.
The practical difficulty is that most practitioners set up their systems while setting up the practice, choosing whatever was convenient — a personal laptop, a consumer cloud account, notes in a notebook app. None of that is malicious and most of it is fixable, but it tends to be discovered when a licence renewal, an insurer or a landlord asks a question nobody has an answer to.
Where are you allowed to store client health records?
Where you are allowed to store client health records is the question that changes which software a practice may use, and it is the one most often answered by accident. UAE federal law on the use of information and communication technology in health fields restricts the storage, processing and transfer of health data relating to services provided in the UAE to inside the country, unless the relevant health authority approves otherwise. The law also sets a long minimum retention period for health records, measured in decades rather than years.
The consequence is concrete: a consumer cloud account that stores data in Europe or the United States is not automatically an acceptable home for UAE client notes, and a booking platform that keeps records offshore raises the same question. What matters is where the data actually sits, which is a question you should be able to put to any supplier and get a clear answer to.
We are IT engineers, not lawyers, so the way we handle this is to establish the facts rather than to interpret the law for you: which systems hold client data, which country each one stores it in, and what each supplier states in writing. You then confirm your own obligations with the UAE Ministry of Health and Prevention or the Dubai Health Authority for a Dubai-licensed practice, or with your legal advisor. What we can promise is that you will know what you actually have.
How should notes and access be set up?
- One system of record for client notes, not notes in one place and bookings in another.
- A named login per practitioner, never a shared practice password.
- Multi-factor authentication on anything reachable from outside the practice.
- Encryption on every laptop and phone that can open client records.
- Reception or admin staff able to see bookings and contact details without clinical notes.
- A written record of which system holds what, and where each one stores it.
What happens if a laptop is lost?
For most practices this is the realistic worst case, and it is entirely survivable if prepared for. Device encryption means a lost laptop is a lost asset rather than a disclosure. Records held centrally rather than locally mean the practice keeps working from another machine the same afternoon. Remote wipe means the device can be cleared even if it never comes back.
Microsoft documents how app protection policies and Intune handle exactly this on laptops and phones. None of it is expensive at the scale of a small practice, and all of it has to be in place beforehand, because it cannot be applied to a device that is already gone.
The same preparation covers the duller failure, which is a disk dying with the only copy of five years of notes on it. Given how long health records have to be retained, backup here is a records-keeping obligation rather than an operational nicety, which is why we design it as a tested backup service with a restore that has actually been proven rather than a drive somebody remembers to plug in.
What about practising from a shared wellness centre?
Renting a room by the hour in a shared centre is common and it changes the IT picture. The network belongs to the centre, other practitioners are on it, and the Wi-Fi password is known to everyone who has ever worked there. That is a reasonable arrangement for browsing and a poor one for client records.
The answer is to stop depending on the network for confidentiality. Your records live in your own system, reached over an encrypted connection with multi-factor authentication, on a device you control. Then the centre's network is simply a route to the internet, and who else is on it stops being your problem.
How are bookings and reminders handled without leaking information?
Reminders are a quiet confidentiality risk. A message naming the treatment, sent to a shared family phone or left as a voicemail, discloses more than the client may have expected. The safe pattern is a reminder that confirms the appointment without describing it, and a client record that notes their preferred contact method.
Online booking raises the same point. A form that asks for medical history is collecting health data from the first click, so it should submit into a system that stores it appropriately rather than emailing it in plain text to an ordinary inbox. That is a common setup and it is worth checking early.
A practice where client notes stay where UAE law requires
We start with a free assessment that produces a plain inventory: every system holding client data, where each stores it, who can reach it, and what is missing. For a small practice this alone usually answers questions that have been open for a while. Projects are quoted as a fixed scope, from AED 2,500 to AED 30,000 depending on requirement.
Support is a fixed monthly fee with written response times, sized for a practice rather than an office. Where a practice grows into a clinic with multiple practitioners and medical devices, our clinic IT page covers the additional ground, and counselling and psychology practices have their own considerations on the counsellors page.
If you are weighing the decision behind this rather than the support, our guide on where a Dubai therapist may store client notes goes into the detail an assessment would cover.
Frequently asked questions
Probably not, and it is worth checking properly. UAE rules restrict where health data relating to UAE services may be stored, and most consumer accounts do not let you choose or confirm the country. Establish where your current provider actually stores the data, then confirm your obligations with the health authority or your legal advisor.
The confidentiality obligation does not scale with practice size, and neither does the consequence of losing a laptop. What does scale is the cost: for one or two practitioners this is encryption, named logins, multi-factor authentication and a backup, which is a small setup rather than a project.
UAE health data rules set a minimum retention period considerably longer than most businesses plan for, measured in decades from the last procedure. That changes backup from an operational concern into a records-keeping one, so we design storage that can actually hold records that long rather than a drive that will be replaced.
The federal health data law is written to apply across the UAE including free zones, so a free-zone licence does not remove the question. Your licensing authority is the right place to confirm what applies to your specific licence and scope of practice.
Yes, and the important part is where the answers land. A form that emails medical history to an ordinary inbox is a weak design. We route intake into the system that holds client records properly, so the sensitive part never sits in a mailbox.
Keep the devices patched and encrypted, keep access correct as people join or leave, monitor and test the backup rather than assuming it, and answer the helpdesk when something breaks. For a small practice most months are quiet, which is the point of a fixed fee rather than hourly billing.
Written by Srinivasan Ramachandran, Founder, Listonics · Last reviewed October 8, 2026