This page is a plain-language summary for context, written by a vendor in this space, not a law firm. UAE healthcare and data-protection rules can change and can apply differently by emirate and case. Confirm your clinic's specific position with MOHAP/DHA directly or a UAE-licensed lawyer before making a compliance decision.
Two separate questions, not one
"Is it legal" is really two different rulebooks stacked on top of each other, and most of the confusion comes from treating them as one thing.
1. What is it allowed to say? — MOHAP + DHA
Healthcare advertising in the UAE is jointly regulated by the Ministry of Health and Prevention (MOHAP) and, in Dubai, the Dubai Health Authority (DHA) — a stricter regime than most Western markets, where content typically requires pre-approval before it's allowed to reach a patient at all. The categories that create the most risk:
- Guaranteed-outcome claims — "permanent results," "100% pain-free," anything promising a specific result
- Comparative superiority claims — "best clinic in Dubai," "#1 dentist"
- Unapproved pricing or insurance statements — quoting a price or confirming coverage without authority to do so
- Before/after imagery without required context — statistical disclaimers, not just a photo pair
- Anything resembling medical advice or diagnosis — a chatbot suggesting what a patient's symptoms mean
A human receptionist generally knows, by instinct, not to promise a cosmetic outcome or confirm a patient's insurance on the spot. A generic AI model has no such instinct — left ungoverned, it will happily generate a confident, persuasive answer in exactly these prohibited categories, especially when a patient pushes for a direct yes or no.
2. What is it allowed to collect? — UAE PDPL
Federal Decree-Law No. 45 of 2021 is the UAE's general personal data protection law (PDPL), in effect since January 2022. Consent is its default legal basis for processing personal data, and valid consent has to be freely given, informed, explicit, specific to the purpose, and revocable at any time — not assumed, and not buried in fine print.
One nuance worth being precise about: PDPL carves out certain health and clinical data that's governed by its own separate sector legislation. But a website chat widget of the kind covered here typically captures a visitor's name, phone number, and which service they're asking about — ordinary personal data, not a clinical record — so it sits squarely inside PDPL's general consent requirements, not a separate health-data regime.
A practical checklist
| What the chatbot does | Status |
|---|---|
| "We'll pass your details to the team to confirm your appointment" | Fine |
| Shows a visible consent notice before capturing name/phone | Required, and fine |
| "This treatment is guaranteed to fix your smile" | Prohibited — guaranteed outcome |
| "We're the best dental clinic in Dubai" | Prohibited — comparative superiority |
| Quotes an exact price for a treatment | Risk — unapproved pricing claim |
| "Your insurance will most likely cover this" | Risk — unverified coverage claim |
| Captures name/phone silently, no notice shown | Non-compliant under PDPL |
This is a practical summary, not an exhaustive legal checklist — the FAQ below covers the edge cases most owners ask about.
This is exactly why CareLayer is built with 3-tier grounding that structurally cannot invent a price, confirm insurance, or give medical advice — not as a feature to advertise, but because it's the only way to put an AI chatbot on a UAE clinic's site without creating the exposure described above. It's a design constraint before it's a marketing line.
Frequently asked questions
Is an AI chatbot on a dental clinic website legal in the UAE?
Does UAE data protection law (PDPL) apply to a website chat widget?
What must a clinic's chatbot never say to a patient?
Does the chatbot itself need separate MOHAP or DHA approval, or just the clinic's ads?
What happens if a clinic's website content breaks these rules?
Is this page legal advice?
See a compliance-first chatbot in action
A live, working demo — try asking it for a guaranteed price or an insurance confirmation. Watch it decline safely and capture your details instead.
Try the live demo →Published 8 August 2026 · Last updated 8 August 2026 by Ahsan Ishaq, Ahsomatic. This page is informational, not legal advice — confirm current requirements with MOHAP/DHA or a UAE-licensed lawyer before making a compliance decision for your clinic.