DHA rules for clinical photography &
before-and-after images in Dubai
Circular CIR-2026-00000144 on before-and-after advertising, and Article 13 of Federal Law No. 2 of 2019 on where patient data may live. Two different problems. Most Dubai clinics have both.
This is not legal advice, and it has not been reviewed by UAE counsel. It is a practitioner-facing summary of the instruments listed under Sources, with every gap in our sourcing stated openly. These rules carry personal liability for the licensed professional, not only the facility. Obtain the circular from DHA directly and have counsel review anything you intend to rely on.
The short version
Dubai’s advertising standard for medical social media was reissued in August 2026 under circular CIR-2026-00000144, enforcing standard code DHA/HRS/HPSD/ST-21. It tightens what may be done to a before-and-after image, who must approve a post, and who carries liability when the post is not on a clinic account.
Separately, and often confused with it, Article 13 of Federal Law No. 2 of 2019 restricts where health data generated in the UAE may be stored or processed at all.
CureCast stores UAE patient photographs in Microsoft Azure's UAE region, primary storage in UAE North and the recovery copy in UAE Central, with no cross-border transfer of patient data. This satisfies Article 13 of Federal Law No. 2 of 2019 by architecture rather than by exemption.
A system that keeps the data in-country does not need the exemption matrix, does not need cross-border patient consent, and meets the UAE-copy condition inherently, because there is no other copy.
DHA Circular CIR-2026-00000144 and who it covers
What is DHA Circular CIR-2026-00000144 and when did it take effect?
A circular issued by the DHA Health Regulation Sector in August 2026 to private healthcare facilities and professionals in Dubai, enforcing standard code DHA/HRS/HPSD/ST-21, “Standards for Medical Advertisement Content on Social Media”. It replaces the enforcement position under version 1.1 of the same standard.
This analysis draws on law-firm and consultancy summaries. We could not retrieve the primary document from dha.gov.ae, and no summary substitutes for the text you will be held to.
What changed compared with the previous standard?
Version 1.1 was issued 3 August 2022 and took effect 3 October 2022. The 2026 circular tightens enforcement and scope rather than writing a new rulebook: it hardens before-and-after rules, formalises Medical Director authorisation, and extends facility liability to personal and third-party accounts.
| Area | Standard v1.1 (2022) |
Circular CIR-2026-00000144 (2026) |
|---|---|---|
| Before-and-after images | Permitted with conditions | Permitted with conditions, and restricted or prohibited entirely for certain specialised surgical procedures |
| Editing | Restricted | No Photoshop or equivalent, no digital filters, no misleading lighting, no altered angles |
| Disclaimer | Required | Required, and in the same font size as the rest of the advertisement |
| Consent | Required | Written, defining exact purpose, platform distribution and permissible timeframe |
| Approval | Facility responsibility | Prior internal review and formal Medical Director authorisation before publication |
| Personal accounts | Less clearly addressed | Facility liable for media recorded on its premises wherever it is posted. Personal and professional accounts must be separated |
| Influencers | Less clearly addressed | Third-party influencers expressly in scope |
| Filming patients | Restricted | Filming or live-streaming under general anaesthesia, during surgery, or in procedure rooms for promotion is prohibited |
| Audit | Not addressed | HRS may conduct social media audits. Posts should be archived with edits and formats |
Which standard code governs this, and where do I find the official text?
DHA/HRS/HPSD/ST-21, issued by the Health Policy and Standards Department within the DHA Health Regulation Sector. Request the current version and the circular through your facility’s DHA relationship or the Sheryan portal. Do not rely on a summary, including this one, as your compliance record.
Who does it bind?
DHA/HRS/HPSD/ST-21, issued by the Health Policy and Standards Department within the DHA Health Regulation Sector. Request the current version and the circular through your facility’s DHA relationship or the Sheryan portal. Do not rely on a summary, including this one, as your compliance record.
Does it apply to organic posts and stories, or only paid advertising?
The standard is framed around the promotional character of the content, not whether money changed hands. An organic post promoting a treatment is promotional. Treat organic posts, stories and reels as in scope and route them through the same approval.
Is a clinic landing page a regulated health advertisement?
Health advertising in the UAE is regulated more broadly than social media alone, and the official facility account must display a MOHAP-issued medical advertisement licence number. Whether a given web page falls under ST-21 or the wider advertising permit regime is a question to put to DHA for your facility.
Does it apply to WhatsApp broadcast messages?
ST-21 is framed around social media. A WhatsApp broadcast promoting a treatment has the character of a health advertisement, and the prudent position is to apply the same rules. Confirm with DHA rather than assuming it falls outside.
A separate and larger problem applies to WhatsApp regardless. See Is it legal to send patient photos over WhatsApp?
Does it apply to DIFC and Dubai Healthcare City clinics?
No. DIFC and Dubai Healthcare City are excluded from DHA’s standards. If you operate clinics inside and outside these zones, you are subject to more than one framework at once.
- DHCC: its own regulatory framework and advertisement policy, under the Dubai Healthcare City Authority
- DIFC: DIFC Law No. 5 of 2020, the DIFC Data Protection Law, supervised by the DIFC Commissioner of Data Protection
What if I am licensed in Abu Dhabi or the northern emirates?
DHA’s standard binds Dubai. Abu Dhabi is regulated by the Department of Health (DoH), the northern emirates by MOHAP, and Dubai Healthcare City by DHCA.
We have not verified DoH's before-and-after advertising requirements and will not describe them. Obtain them from DoH rather than assuming they mirror Dubai's.
What is the legal basis for DHA’s authority here?
Executive Council Resolution No. 49 of 2024, regulating health professions and health activities in the Emirate of Dubai, together with Federal Law No. 15 of 2020 on Consumer Protection as amended by Federal Decree-Law No. 5 of 2023.
DHA's standard also references MOHAP Ministerial Decision No. 430 of 2007 on medical advertisement regulation. We could not confirm whether it remains in force or has been superseded.
Before-and-after image rules in Dubai
Can I still post before-and-after photos in Dubai?
Yes, for most procedures, under conditions. The image must be of the same patient, taken with the same lens, unedited, with a variability disclaimer in the same font size as the rest of the advertisement, and supported by written patient consent. It is restricted or prohibited entirely for certain specialised surgical procedures.
We cannot list the restricted procedures from the sources available. Confirm this from the circular before you post surgical results.
What are the exact image requirements?
| Requirement | What it means in practice |
|---|---|
| Same patient | Both frames are the same individual. No composites, no stock, no representative cases |
| Same lens | Before and after on the same optical lens. Switching between a phone's main and telephoto cameras between visits breaks this |
| No editing software | No Photoshop or equivalent. Covers retouching, smoothing, blemish removal and colour grading |
| No digital filters | Including beautification filters applied by default in some phone camera and social apps |
| No misleading lighting | See misleading lighting below |
| No altered angles | The after may not be shot from a more flattering position than the before |
| Variability disclaimer | Same font size as the rest of the advertisement |
| Written consent | Specifying purpose, platform distribution and permissible timeframe |
The “same lens” rule is the one clinics fail without knowing. A phone chooses its own lens by zoom and light, and quietly drops from telephoto to the main camera in a dim room. Two photos taken in the same chair three months apart can be on different lenses with nothing on screen to say so.
CureCast records the lens used with every photo captured through the app, along with field of view, zoom factor, device angle and colour temperature. That record lets a practice demonstrate the condition was met rather than assert it.
Can I use any editing software, filters, lighting adjustment or angle changes?
No. The standard prohibits Photoshop or equivalent editing software, digital filters, misleading lighting and altered angles in before-and-after imagery. Cropping to a consistent frame is not editing the subject, but anything that changes how the patient appears is outside what the standard permits.
CureCast does not alter the photo at capture. No background replacement, no smoothing, no filters, no colour correction. The image stored is the image the camera captured.
What counts as misleading lighting in practice?
Any lighting difference between the two frames that makes the result look better than it is. It is usually not deliberate: a before under flat ceiling light and an after near a window will differ in shadow, contrast and skin tone even when nothing was staged.
The defensible position is consistency, not intent. Same place, same light, and hold exposure and colour settings across the series instead of re-metering each shot.
What disclaimer must appear, and how prominent must it be?
A disclaimer that outcomes vary, in the same font size as the rest of the advertisement. The font-size requirement is explicit and the part most often missed: a disclaimer set smaller than the promotional copy does not satisfy the standard.
What is the required wording of the variability disclaimer?
The v1.1 wording, published together with the risks of the procedure:
This is the 2022 version. Check it against CIR-2026-00000144 before adopting it. We could not obtain the 2026 text.
Are before-and-after images banned outright for any procedures?
Yes. The standard restricts or prohibits before-and-after imagery entirely for certain specialised surgical procedures. The list is in the standard and we will not guess at it. If your practice posts surgical results, obtaining that list is the highest-priority item on this page.
Can I film or live-stream a patient during a procedure?
No. Live-streaming or filming patients under general anaesthesia, during minor or major surgery, or in procedure rooms for promotional purposes is prohibited, regardless of consent and regardless of which account posts it.
Can I post a patient's photo if they were treated at a different facility?
Liability ties to the facility where the media was recorded and to the DHA-licensed professional publishing it. Your consent covers your use, not another facility's patient. Do not post another facility's cases without written consent that names you and your platforms.
Can a visiting practitioner post Dubai patients to their international account?
Visiting practitioners must maintain a separate Dubai account. The facility remains liable for media recorded on its premises wherever it is published, including an international personal account. Agree this in writing before they treat a patient in your clinic.
Patient consent for marketing photos
What consent do I need before using a patient's photo in marketing?
Written consent, specific to marketing use, defining the exact purpose, the platforms where the image will be distributed, and the permissible timeframe. A signature on a procedure consent form does not cover advertising.
Does my procedure consent form cover advertising use?
No. Treatment consent covers the procedure and its risks. Marketing consent covers publication, audience and duration. Bundling them means a patient cannot decline one without appearing to decline the other.
What must the consent specify?
| Element | Why it is required |
|---|---|
| Exact purpose | Marketing and promotion, distinguished from clinical record, teaching or peer review |
| Platform distribution | Named platforms. "Social media" is not a platform |
| Permissible timeframe | A defined period, after which the permission lapses |
| Withdrawal | How the patient withdraws and what happens when they do |
Does consent have to be written?
Yes. A verbal agreement, a WhatsApp "yes", or a note in the file is not what the standard asks for.
How long does consent remain valid?
For the timeframe the consent specifies. No end date does not meet the requirement, and an expired consent no longer supports a live post.
Do I need separate consent for each platform?
One document can name several platforms, but it must name them. Adding a platform later means new consent. Instagram is not TikTok.
What happens if a patient withdraws consent after I have posted?
Remove the content. The permission that made publication lawful no longer exists, and the obligation is immediate. You cannot remove a post reliably if you do not know every place the image was published, which is why the archive matters.
CureCast's marketing consent filter separates consented images from the rest of the patient's file, so marketing works only from approved material and a withdrawal is applied at the source rather than chased across accounts.
Medical Director approval and liability
Do I need Medical Director approval before every social media post?
Yes. No promotional content may be published without prior internal review and formal authorisation from the facility's Medical Director. It is per post, not a standing approval of the marketing function, and it is the item most likely to be tested in an audit.
Who is liable if a doctor posts from their personal account?
The facility. It is liable for all media recorded or filmed on its premises, whether on official channels or personal accounts of doctors, employees or influencers, and whether shot professionally or on a phone. The DHA-licensed professional also carries individual liability.
Am I liable if an influencer films in my clinic and posts from their own account?
Yes. Third-party influencers are expressly in scope, and liability follows the premises. Contract for it in advance:
Do I need to separate personal and professional accounts?
Yes. A single account mixing family photos with treatment promotion is a professional account under the standard, and everything on it is in scope.
Do I have to archive posts?
Posts should be archived, including edits and different formats. An expired story, a replaced reel and an edited caption are all part of what was published. Archive at the point of publication rather than reconstructing later.
Can the DHA audit my social media accounts?
Yes. The Health Regulation Sector may conduct social media audits. An audit examines three things, each easy to produce if created at the time and nearly impossible afterwards:
What are the penalties for non-compliance?
We cannot state the sanctions under this standard from the sources available, and will not estimate them. Enforcement sits with the Health Regulation Sector and connects to facility and professional licensing. Obtain the circular for the enforcement provisions.
Do not confuse these with the health data penalties, which are separate and statutory. See Article 24 below.
Banned words, titles and pricing
Which specific words are banned in medical advertising in Dubai?
The following words and phrases appear as prohibited in medical advertising in Dubai:
This is the list as reproduced in the summaries available to us. Check your copy against the standard itself, not this page.
Read the list for its logic. Every entry is an absolute claim, a superlative, or commercial urgency. A phrase not on the list that does one of those three things is unlikely to be acceptable. Run it against existing captions, your website and bios too. The archive is in scope.
Can I run flash discounts, bundles or limited-time offers?
No. Inducement pricing, including flash discounts and bundles, is prohibited, because price urgency pushes a medical decision onto a commercial timetable. "Very limited quantity" and "get money back" are banned for the same reason.
Can I say my clinic is better than another clinic?
No. Comparative marketing asserting superiority is prohibited. "The best", "the only", "incomparable" and "unprecedented" are all comparative claims without naming a competitor.
Which professional titles am I not allowed to use?
These imply a scope of practice the DHA licensing framework does not recognise:
- Cosmetic Specialist
- Aesthetic Consultant
- Aesthetician
- Cosmetologist
- Anti-Aging Consultant
Who can use the title "Dr" in Dubai medical advertising?
Physicians, dentists and holders of a recognised PhD. Anyone else is misrepresenting qualification.
Do I have to display a licence number on my official account?
Yes, the MOHAP-issued medical advertisement licence number. Anyone can check it in seconds, making it a common first audit finding.
Advertising permits and Sheryan
Do I need a permit to advertise, and how do I get one?
Advertising permissions are tied to facility licensure and administered through the Sheryan portal. The official account must display the MOHAP-issued medical advertisement licence number.
No published fee schedule for DHA advertisement permits could be located. Ask DHA for current fees rather than budgeting from a third-party figure.
What is Sheryan and how does the permit process work?
Sheryan is DHA's licensing and regulatory portal for health professionals and facilities in Dubai. Advertising permissions are administered through it and depend on an active facility licence.
Can I advertise while my facility licence is still being approved?
Not during initial approval, and not at all without an active licence. Promoting an opening before the licence is granted is unauthorised advertising.
Is there a temporary permit for a time-bound campaign?
DHA offers a "Request for Temporary Permit for Campaign" service, available only to facilities with active licences.
UAE health data residency under Article 13
The section most clinics have not addressed, and the one with a stated financial penalty.
Can a UAE clinic store patient photos on servers outside the UAE?
Not by default. Article 13 of Federal Law No. 2 of 2019 prohibits storing, processing, generating or transferring outside the UAE any health information related to health services provided inside the UAE, except as permitted by a decision of the Health Authority. A clinical photo of a patient treated in Dubai is health data generated in the UAE.
What does Article 13 actually prohibit?
Storing, processing, generating or transferring UAE health data outside the UAE, except as permitted by the Health Authority. The implementing regulation is Cabinet Decision No. 32 of 2020.
Note the breadth. Processing outside the UAE is caught even where the data is stored inside it.
What is the penalty for storing UAE health data offshore?
to AED 700,000
Article 24 of Federal Law No. 2 of 2019 sets a fine of not less than AED 500,000 and not more than AED 700,000. This is a statutory penalty, distinct from any sanction under the advertising standard.
Which exemptions allow health data to leave the UAE?
MOHAP Ministerial Decision No. 51 of 2021 sets the exemption matrix. The exemptions are specific categories with conditions attached, not a general permission. For a cloud application, the relevant route is the online health services exemption, described next.
How CureCast meets Article 13
Vendor-specific answers, because "is your vendor compliant" is the question a clinic actually has to resolve.
Does CureCast store UAE patient photos inside the UAE?
Yes. CureCast stores patient photos and records for UAE clinics inside the UAE on Microsoft Azure, with no cross-border transfer of patient data. UAE-resident storage is the default for UAE accounts, not an option a clinic has to request, and it is live in production today.
Which Azure region, and is there any cross-border transfer at any point?
| Field | CureCast UAE deployment |
|---|---|
| Primary region | Microsoft Azure UAE North, Dubai |
| Recovery region | Azure UAE Central, Abu Dhabi. Geo-redundancy pairs in-country |
| Sub-processors | Configured in-region: storage, backup, logging and error monitoring |
| Encryption | AES-256 at rest, TLS 1.2 or higher in transit |
| Support access | No access to patient images from outside the UAE without the clinic's prior written authorisation under the DPA |
| Default or opt-in | Default for UAE accounts |
| Status | Live in production |
Product development and support engineering are performed outside the UAE, on environments containing no patient data. Diagnosing a fault does not normally require real patient images. Where it genuinely cannot be avoided, access requires the clinic's prior written authorisation under the data processing agreement, and the clinic may refuse. A vendor claiming absolute zero cross-border anything, with a development team abroad, is making a claim that does not survive a procurement review.
Does in-country storage mean I avoid the Article 13 exemption process entirely?
Yes. If the data never leaves the UAE, there is nothing to exempt. A system that does not store, process, generate or transfer health data outside the UAE does not engage the prohibition, so the exemption matrix under MOHAP Ministerial Decision No. 51 of 2021 is never invoked.
| Condition under the online health services exemption | With in-country storage |
|---|---|
| Patient consent for cross-border transfer | Not required. There is no transfer |
| A copy of the data must be retained inside the UAE | Inherently met. There is no other copy |
| Where an image is sent, only the treating physician may access it, time-limited | Does not apply. This is the condition that makes the exemption route awkward for a photo system used by a clinical team |
| Emirate-level approval from DHA, DoH, MOHAP or DHCA | Not required. No transfer occurs |
| Security duties under Article 4 | Still apply. Residency does not displace confidentiality and integrity obligations |
Read the third row carefully if a vendor says they rely on the exemption. A platform hosted offshore, where reception, marketing or head office can open patient images, is not operating inside a condition that restricts access to the treating physician.
Who at CureCast can access my patient images, and from where?
Nobody outside the UAE, without your prior written authorisation. Routine operation, support and administration do not require viewing patient images. Where a fault cannot be diagnosed without them, access needs the clinic's written authorisation under the DPA, and it is refusable.
Inside your account, access is per staff member at module and action level, and every view, download, share and export is logged in the audit trail with user, device and timestamp.
Is CureCast DHA compliant?
No software can make a clinic DHA compliant on its own. CureCast is designed to support the parts of a clinical photo workflow that sit within the software: patient photo management, access control, consent-based organization and auditability. Your clinic remains responsible for its policies, consent process, staff training, Medical Director approval and advertising practices.
CureCast can support a structured clinical photo workflow, but using the software does not by itself establish compliance with DHA requirements. Clinics should assess their complete workflow against the requirements applicable to their licence and activities.
What are CureCast's sub-processors and where are they located?
Configured in the UAE region, covering storage, backup, logging and error monitoring. There is no offshore CDN in the patient image path and no third-party image processing service.
Ask for the current list in writing and have it named in your DPA. A list that only exists on a web page is not a contractual commitment.
Is UAE residency the default for UAE clinics, or something I request?
The default. A UAE clinic is provisioned on UAE-resident storage without asking. Clinics outside the UAE are hosted elsewhere, which is why this claim is specific to UAE accounts.
Is UAE-resident storage live today, or planned?
Live in production. It runs for a Dubai clinic today, is the default for new UAE accounts, and existing UAE accounts are being migrated onto it.
Ask this question in exactly this form, and ask for a customer reference. "We support UAE hosting" and "we have a clinic running on it" are different statements, and a roadmap commitment is not residency.
Does the UAE PDPL apply to patient photos, or does the Health Data Law govern?
Federal Law No. 2 of 2019 is the sector-specific health data instrument and contains the Article 13 residency restriction. Federal Decree-Law No. 45 of 2021, the PDPL, is the general personal data law. For a clinical photo system in Dubai, Article 13 applies regardless.
The status of the PDPL Executive Regulations is genuinely contested. One 2026 secondary source names a Cabinet Resolution, uncorroborated. Do not act on any claimed PDPL deadline you cannot verify against a published instrument.
Is it legal to send patient photos over WhatsApp in a Dubai clinic?
This is an Article 13 question first. A photo sent through WhatsApp is transmitted to and processed on infrastructure outside the UAE, and Article 13 covers transferring and processing, not only storage.
- The image lands in a personal message thread
- It is typically copied to both sender's and recipient's camera rolls
- It cannot be revoked, audited or access-controlled
Sharing a link to a controlled system is a different act from sending the image, and it is the pattern a clinic can defend.
Can I store patient photos in Google Drive, Dropbox or iCloud?
The same analysis applies. These services default to regions outside the UAE, with no clinical access control, no audit trail, and no way to restrict an image to the treating physician. And they leave with the person: a photo in a staff member's iCloud stays with them after they resign.
What happens to patient photos when a staff member leaves?
Whatever was on their personal device leaves with them. The clinic cannot inventory those copies, cannot recall them, and usually cannot prove they were deleted.
CureCast captures into the patient's file, not the camera roll, and access is per staff member, so revoking one person removes their access to everything at once. A structural answer, not a policy one, because a policy cannot be enforced against a device you no longer hold.
NABIDH, ADHICS and information security
Do I need to connect my clinic system to NABIDH?
NABIDH is DHA's health information exchange, and connection is a licensing expectation for DHA-licensed facilities. The obligation sits on the facility and is met through the system of record, normally the EMR. CureCast is not an EMR and is not a NABIDH integration.
- HL7 and FHIR-conformant integration
- Emirates ID patient matching
- Structured clinical document submission
- Defined consent handling
Whether clinical photos fall within the submission set is a question for DHA and your EMR vendor, worth asking in writing. Malaffi is the Abu Dhabi equivalent, and a group in both emirates connects to each separately. Riayati is the federal layer.
Does ADHICS apply to a Dubai-licensed clinic?
No. ADHICS v2.0, introduced May 2024 and effective August 2024, is mandatory in Abu Dhabi only. It has become a de facto UAE benchmark, and a Dubai group with Abu Dhabi sites will be held to it there, so asking a vendor about it is reasonable even in Dubai.
What should a clinical photo system do to satisfy DHA information-security expectations?
| Expectation | What to ask a vendor |
|---|---|
| Residency | Which country, which region, and is cross-region replication disabled? Ask for the configuration, not the marketing claim |
| Encryption | At rest and in transit, with the cipher and TLS version named |
| Access control | Per individual, at module and action level. Shared logins cannot attribute an action to a person |
| Audit trail | Who viewed, downloaded, shared and exported, with timestamp and device |
| Backup and restore | Where backups sit, how long they are kept, and when a restore was last tested |
| Deletion | What happens on request, and whether you get written confirmation |
Primary storage Azure UAE North in Dubai, recovery copy Azure UAE Central in Abu Dhabi, geo-redundancy in-country. AES-256 at rest, TLS 1.2 minimum in transit. Sub-processors in-region. Daily and weekly backups held in the UAE with 30 and 90 day retention. Last verified restore 9 September 2026.
Record retention
How long must a Dubai clinic retain patient records and clinical photographs?
We could not verify this and will not state a figure. A 25-year period is widely repeated in the UAE market, but we could not confirm it against the Arabic statutory text. Obtain the requirement from DHA for your facility type. Whatever it is, it applies to clinical photos as part of the record.
A retention obligation measured in decades is an argument against holding clinical images anywhere you do not control, including a staff phone or a consumer cloud account.
Compliant workflow, consent form and audit
What is a compliant before-and-after photography workflow, step by step?
| DHA requirement | Workflow step that satisfies it |
|---|---|
| Same patient | Capture directly into the patient's file. Never into a camera roll to be filed later |
| Same lens | Capture through a system that records the lens used, so the condition can be demonstrated |
| No altered angles | Take the follow-up against the earlier photo, with it overlaid on the camera |
| No misleading lighting | Same room, same light, and hold exposure and colour across the series |
| No editing or filters | No editing tools. Verify your phone's beautification filters are off |
| Written consent | Marketing consent separate from treatment consent, naming purpose, platforms and timeframe |
| Consent-limited use | Marketing works from a consented album, not the patient library |
| Disclaimer, same font size | Applied at publication. A marketing step, not a system step |
| Medical Director authorisation | Recorded before publication, per post |
| Archive | Captured at publication, including edits and formats |
The first seven rows are capture and storage. The last three are governance, and no software performs them for you.
What should a photo consent form for a DHA-licensed clinic contain?
A starting point, not legal advice or a guaranteed compliant form. It is assembled from the consent elements described in the applicable standard and should be reviewed for your facility's circumstances before use. Assembled from the consent elements the standard requires: exact purpose, platform distribution, permissible timeframe and written signature. Published in full and free to adapt.
Your obligations depend on your licence, specialties and procedures. Have this reviewed before a patient signs it.
How do I audit my existing social media archive?
Work backwards from the cheapest checks to the most expensive.
What do I do if I have already posted images that do not meet the new standard?
Remove first, document second, fix the process third.
Do not edit a non-compliant post into compliance and leave the original date. The archive obligation covers edits, and a silently amended post is worse than a removed one.
What CureCast does not do
CureCast does not make your practice compliant. Compliance is a property of your whole operation: your policies, training, consent process and governance. Software is one input.
Hold the parts that are structural rather than procedural: patient images inside the UAE, captured without editing, with the lens and capture conditions recorded, accessible per individual with an audit trail, and separated into consented and non-consented material.
Is CureCast DHA compliant?
CureCast is not a substitute for DHA compliance, and we do not describe the software as making a clinic “DHA compliant.” DHA compliance applies to the clinic's complete operation, including its health-information management, security controls, consent processes, staff practices and applicable regulatory obligations.
CureCast is designed to support the secure management of clinical photographs and patient records through controlled staff access, auditability, encrypted storage and structured clinical photo workflows. DHA's Health Information Assets Management Policy expressly covers health information stored in cloud-based systems, including the systems and infrastructure used by healthcare entities.
Whether a particular clinic meets its DHA obligations depends on how the clinic configures and uses its systems, as well as its policies, consent process, staff training and other regulatory requirements. CureCast can support that workflow; it does not replace the clinic's compliance responsibilities.
Sources
Primary instruments. Obtain current texts from the issuing authority rather than relying on this page.
What we could not verify
Stated plainly, because a knowledge page that hides its gaps is not one.
- The text of CIR-2026-00000144. Analysis draws on law-firm and consultancy summaries
- Which surgical procedures are restricted. Not in any source available to us
- The 25-year retention period. Unverified against statutory text
- UAE PDPL Executive Regulations. Contested, and we will not assert either way
- MOHAP Ministerial Decision No. 430 of 2007. Whether it remains in force
- DoH Abu Dhabi before-and-after requirements. Not retrieved, not assumed to mirror Dubai's
- DHA advertisement permit fees. No published schedule located
Written by [author name], CureCast. Last reviewed 19 September 2026. For DHA-licensed practices in the Emirate of Dubai. Not legal advice, and not reviewed by UAE counsel. These rules carry personal liability for the licensed professional as well as the facility. Have counsel review before relying on anything here, and obtain CIR-2026-00000144 from DHA rather than relying on any summary, including this one.
