Clinical Photo Management Software with UAE Data Residency
CureCast helps plastic surgeons, dermatologists, wound care surgeons, pediatric surgeons and medical spas in Dubai organize patient photos and compare results across visits. Its UAE deployment uses Microsoft Azure UAE North in Dubai for primary storage and an active secondary copy in UAE Central, Abu Dhabi.
Clinical photo software for Dubai clinics
CureCast is clinical photo management software for Dubai practices that need to organize patient photographs, compare before-and-after results and evaluate UAE data residency. Plastic surgeons, dermatologists, wound care surgeons, pediatric surgeons, medical spas and other surgical teams can review the photo workflow alongside storage and access requirements.
Plastic surgeons
Keep baseline and follow-up photography attached to the patient record. Select images from different visits to discuss treatment progress.
Plastic Surgery →Dermatologists
Organize photographs by patient and treatment so staff can retrieve earlier images during follow-up appointments.
Dermatology →Medical spas and aesthetic clinics
Keep treatment photos organized by patient and visit. Compare before-and-after images for laser treatments and other aesthetic procedures during follow-up consultations.
Medical Spa →Wound care surgeons
Capture and organize wound photographs across visits to track healing progress. Compare images over time and keep each photo connected to the correct patient record for clinical review.
Where does CureCast store patient photos for UAE clinics?
CureCast's UAE deployment uses Microsoft Azure UAE North in Dubai for primary patient photo storage and an active secondary copy in UAE Central, Abu Dhabi. Both locations are in the United Arab Emirates. Confirm the deployment and migration status for your specific account before uploading patient information.
Dubai and UAE data residency are different geographic commitments. The active secondary copy in Abu Dhabi remains within the UAE, but outside Dubai. An active copy does not by itself establish automatic failover or a guaranteed recovery time.
Explore clinical photo management, before-and-after photo software, and workflows for plastic surgeons and dermatologists.
Microsoft lists the geographic locations of Azure regions. Region availability does not independently verify an application's configuration. Review storage, processing, support access and transfers together.
Local storage is one part of your assessment. Review processing, support access, subprocessors, backups and transfers alongside the clinic’s staff controls and consent process.
This is not legal advice, and it has not been reviewed by UAE counsel. It is a practitioner-facing summary of the instruments listed under Sources, with every gap in our sourcing stated openly. These rules carry personal liability for the licensed professional, not only the facility. Obtain the circular from DHA directly and have counsel review anything you intend to rely on.
DHA Circular CIR-2026-00000144 and who it covers
What is DHA Circular CIR-2026-00000144 and when did it take effect?
A circular issued by the DHA Health Regulation Sector in August 2026 to private healthcare facilities and professionals in Dubai, enforcing standard code DHA/HRS/HPSD/ST-21, “Standards for Medical Advertisement Content on Social Media”. It replaces the enforcement position under version 1.1 of the same standard.
This analysis draws on law-firm and consultancy summaries. We could not retrieve the primary document from dha.gov.ae, and no summary substitutes for the text you will be held to.
What changed compared with the previous standard?
Version 1.1 was issued 3 August 2022 and took effect 3 October 2022. The 2026 circular tightens enforcement and scope rather than writing a new rulebook: it hardens before-and-after rules, formalises Medical Director authorisation, and extends facility liability to personal and third-party accounts.
| Area | Standard v1.1 (2022) |
Circular CIR-2026-00000144 (2026) |
|---|---|---|
| Before-and-after images | Permitted with conditions | Permitted with conditions, and restricted or prohibited entirely for certain specialised surgical procedures |
| Editing | Restricted | No Photoshop or equivalent, no digital filters, no misleading lighting, no altered angles |
| Disclaimer | Required | Required, and in the same font size as the rest of the advertisement |
| Consent | Required | Written, defining exact purpose, platform distribution and permissible timeframe |
| Approval | Facility responsibility | Prior internal review and formal Medical Director authorisation before publication |
| Personal accounts | Less clearly addressed | Facility liable for media recorded on its premises wherever it is posted. Personal and professional accounts must be separated |
| Influencers | Less clearly addressed | Third-party influencers expressly in scope |
| Filming patients | Restricted | Filming or live-streaming under general anaesthesia, during surgery, or in procedure rooms for promotion is prohibited |
| Audit | Not addressed | HRS may conduct social media audits. Posts should be archived with edits and formats |
Which standard code governs this, and where do I find the official text?
DHA/HRS/HPSD/ST-21, issued by the Health Policy and Standards Department within the DHA Health Regulation Sector. Request the current version and the circular through your facility’s DHA relationship or the Sheryan portal. Do not rely on a summary, including this one, as your compliance record.
Who does it bind?
DHA/HRS/HPSD/ST-21, issued by the Health Policy and Standards Department within the DHA Health Regulation Sector. Request the current version and the circular through your facility’s DHA relationship or the Sheryan portal. Do not rely on a summary, including this one, as your compliance record.
Does it apply to organic posts and stories, or only paid advertising?
The standard is framed around the promotional character of the content, not whether money changed hands. An organic post promoting a treatment is promotional. Treat organic posts, stories and reels as in scope and route them through the same approval.
Is a clinic landing page a regulated health advertisement?
Health advertising in the UAE is regulated more broadly than social media alone, and the official facility account must display a MOHAP-issued medical advertisement licence number. Whether a given web page falls under ST-21 or the wider advertising permit regime is a question to put to DHA for your facility.
Does it apply to WhatsApp broadcast messages?
ST-21 is framed around social media. A WhatsApp broadcast promoting a treatment has the character of a health advertisement, and the prudent position is to apply the same rules. Confirm with DHA rather than assuming it falls outside.
A separate and larger problem applies to WhatsApp regardless. See Is it legal to send patient photos over WhatsApp?
Does it apply to DIFC and Dubai Healthcare City clinics?
No. DIFC and Dubai Healthcare City are excluded from DHA’s standards. If you operate clinics inside and outside these zones, you are subject to more than one framework at once.
- DHCC: its own regulatory framework and advertisement policy, under the Dubai Healthcare City Authority
- DIFC: DIFC Law No. 5 of 2020, the DIFC Data Protection Law, supervised by the DIFC Commissioner of Data Protection
What if I am licensed in Abu Dhabi or the northern emirates?
DHA’s standard binds Dubai. Abu Dhabi is regulated by the Department of Health (DoH), the northern emirates by MOHAP, and Dubai Healthcare City by DHCA.
We have not verified DoH's before-and-after advertising requirements and will not describe them. Obtain them from DoH rather than assuming they mirror Dubai's.
What is the legal basis for DHA’s authority here?
Executive Council Resolution No. 49 of 2024, regulating health professions and health activities in the Emirate of Dubai, together with Federal Law No. 15 of 2020 on Consumer Protection as amended by Federal Decree-Law No. 5 of 2023.
DHA's standard also references MOHAP Ministerial Decision No. 430 of 2007 on medical advertisement regulation. We could not confirm whether it remains in force or has been superseded.
Before-and-after image rules in Dubai
Can I still post before-and-after photos in Dubai?
Yes, for most procedures, under conditions. The image must be of the same patient, taken with the same lens, unedited, with a variability disclaimer in the same font size as the rest of the advertisement, and supported by written patient consent. It is restricted or prohibited entirely for certain specialised surgical procedures.
We cannot list the restricted procedures from the sources available. Confirm this from the circular before you post surgical results.
What are the exact image requirements?
| Requirement | What it means in practice |
|---|---|
| Same patient | Both frames are the same individual. No composites, no stock, no representative cases |
| Same lens | Before and after on the same optical lens. Switching between a phone's main and telephoto cameras between visits breaks this |
| No editing software | No Photoshop or equivalent. Covers retouching, smoothing, blemish removal and colour grading |
| No digital filters | Including beautification filters applied by default in some phone camera and social apps |
| No misleading lighting | See misleading lighting below |
| No altered angles | The after may not be shot from a more flattering position than the before |
| Variability disclaimer | Same font size as the rest of the advertisement |
| Written consent | Specifying purpose, platform distribution and permissible timeframe |
The “same lens” rule is the one clinics fail without knowing. A phone chooses its own lens by zoom and light, and quietly drops from telephoto to the main camera in a dim room. Two photos taken in the same chair three months apart can be on different lenses with nothing on screen to say so.
CureCast records the lens used with every photo captured through the app, along with field of view, zoom factor, device angle and colour temperature. That record lets a practice demonstrate the condition was met rather than assert it.
Can I use any editing software, filters, lighting adjustment or angle changes?
No. The standard prohibits Photoshop or equivalent editing software, digital filters, misleading lighting and altered angles in before-and-after imagery. Cropping to a consistent frame is not editing the subject, but anything that changes how the patient appears is outside what the standard permits.
CureCast does not alter the photo at capture. No background replacement, no smoothing, no filters, no colour correction. The image stored is the image the camera captured.
What counts as misleading lighting in practice?
Any lighting difference between the two frames that makes the result look better than it is. It is usually not deliberate: a before under flat ceiling light and an after near a window will differ in shadow, contrast and skin tone even when nothing was staged.
The defensible position is consistency, not intent. Same place, same light, and hold exposure and colour settings across the series instead of re-metering each shot.
What disclaimer must appear, and how prominent must it be?
A disclaimer that outcomes vary, in the same font size as the rest of the advertisement. The font-size requirement is explicit and the part most often missed: a disclaimer set smaller than the promotional copy does not satisfy the standard.
What is the required wording of the variability disclaimer?
The v1.1 wording, published together with the risks of the procedure:
This is the 2022 version. Check it against CIR-2026-00000144 before adopting it. We could not obtain the 2026 text.
Are before-and-after images banned outright for any procedures?
Yes. The standard restricts or prohibits before-and-after imagery entirely for certain specialised surgical procedures. The list is in the standard and we will not guess at it. If your practice posts surgical results, obtaining that list is the highest-priority item on this page.
Can I film or live-stream a patient during a procedure?
No. Live-streaming or filming patients under general anaesthesia, during minor or major surgery, or in procedure rooms for promotional purposes is prohibited, regardless of consent and regardless of which account posts it.
Can I post a patient's photo if they were treated at a different facility?
Liability ties to the facility where the media was recorded and to the DHA-licensed professional publishing it. Your consent covers your use, not another facility's patient. Do not post another facility's cases without written consent that names you and your platforms.
Can a visiting practitioner post Dubai patients to their international account?
Visiting practitioners must maintain a separate Dubai account. The facility remains liable for media recorded on its premises wherever it is published, including an international personal account. Agree this in writing before they treat a patient in your clinic.
Patient consent for marketing photos
What consent do I need before using a patient's photo in marketing?
Written consent, specific to marketing use, defining the exact purpose, the platforms where the image will be distributed, and the permissible timeframe. A signature on a procedure consent form does not cover advertising.
Does my procedure consent form cover advertising use?
No. Treatment consent covers the procedure and its risks. Marketing consent covers publication, audience and duration. Bundling them means a patient cannot decline one without appearing to decline the other.
What must the consent specify?
| Element | Why it is required |
|---|---|
| Exact purpose | Marketing and promotion, distinguished from clinical record, teaching or peer review |
| Platform distribution | Named platforms. "Social media" is not a platform |
| Permissible timeframe | A defined period, after which the permission lapses |
| Withdrawal | How the patient withdraws and what happens when they do |
Does consent have to be written?
Yes. A verbal agreement, a WhatsApp "yes", or a note in the file is not what the standard asks for.
How long does consent remain valid?
For the timeframe the consent specifies. No end date does not meet the requirement, and an expired consent no longer supports a live post.
Do I need separate consent for each platform?
One document can name several platforms, but it must name them. Adding a platform later means new consent. Instagram is not TikTok.
What happens if a patient withdraws consent after I have posted?
Remove the content. The permission that made publication lawful no longer exists, and the obligation is immediate. You cannot remove a post reliably if you do not know every place the image was published, which is why the archive matters.
CureCast's marketing consent filter separates consented images from the rest of the patient's file, so marketing works only from approved material and a withdrawal is applied at the source rather than chased across accounts.
Medical Director approval and liability
Do I need Medical Director approval before every social media post?
Yes. No promotional content may be published without prior internal review and formal authorisation from the facility's Medical Director. It is per post, not a standing approval of the marketing function, and it is the item most likely to be tested in an audit.
Who is liable if a doctor posts from their personal account?
The facility. It is liable for all media recorded or filmed on its premises, whether on official channels or personal accounts of doctors, employees or influencers, and whether shot professionally or on a phone. The DHA-licensed professional also carries individual liability.
Am I liable if an influencer films in my clinic and posts from their own account?
Yes. Third-party influencers are expressly in scope, and liability follows the premises. Contract for it in advance:
Do I need to separate personal and professional accounts?
Yes. A single account mixing family photos with treatment promotion is a professional account under the standard, and everything on it is in scope.
Do I have to archive posts?
Posts should be archived, including edits and different formats. An expired story, a replaced reel and an edited caption are all part of what was published. Archive at the point of publication rather than reconstructing later.
Can the DHA audit my social media accounts?
Yes. The Health Regulation Sector may conduct social media audits. An audit examines three things, each easy to produce if created at the time and nearly impossible afterwards:
What are the penalties for non-compliance?
We cannot state the sanctions under this standard from the sources available, and will not estimate them. Enforcement sits with the Health Regulation Sector and connects to facility and professional licensing. Obtain the circular for the enforcement provisions.
Do not confuse these with the health data penalties, which are separate and statutory. See Article 24 below.
Banned words, titles and pricing
Which specific words are banned in medical advertising in Dubai?
The following words and phrases appear as prohibited in medical advertising in Dubai:
This is the list as reproduced in the summaries available to us. Check your copy against the standard itself, not this page.
Read the list for its logic. Every entry is an absolute claim, a superlative, or commercial urgency. A phrase not on the list that does one of those three things is unlikely to be acceptable. Run it against existing captions, your website and bios too. The archive is in scope.
Can I run flash discounts, bundles or limited-time offers?
No. Inducement pricing, including flash discounts and bundles, is prohibited, because price urgency pushes a medical decision onto a commercial timetable. "Very limited quantity" and "get money back" are banned for the same reason.
Can I say my clinic is better than another clinic?
No. Comparative marketing asserting superiority is prohibited. "The best", "the only", "incomparable" and "unprecedented" are all comparative claims without naming a competitor.
Which professional titles am I not allowed to use?
These imply a scope of practice the DHA licensing framework does not recognise:
- Cosmetic Specialist
- Aesthetic Consultant
- Aesthetician
- Cosmetologist
- Anti-Aging Consultant
Who can use the title "Dr" in Dubai medical advertising?
Physicians, dentists and holders of a recognised PhD. Anyone else is misrepresenting qualification.
Do I have to display a licence number on my official account?
Yes, the MOHAP-issued medical advertisement licence number. Anyone can check it in seconds, making it a common first audit finding.
Advertising permits and Sheryan
Do I need a permit to advertise, and how do I get one?
Advertising permissions are tied to facility licensure and administered through the Sheryan portal. The official account must display the MOHAP-issued medical advertisement licence number.
No published fee schedule for DHA advertisement permits could be located. Ask DHA for current fees rather than budgeting from a third-party figure.
What is Sheryan and how does the permit process work?
Sheryan is DHA's licensing and regulatory portal for health professionals and facilities in Dubai. Advertising permissions are administered through it and depend on an active facility licence.
Can I advertise while my facility licence is still being approved?
Not during initial approval, and not at all without an active licence. Promoting an opening before the licence is granted is unauthorised advertising.
Is there a temporary permit for a time-bound campaign?
DHA offers a "Request for Temporary Permit for Campaign" service, available only to facilities with active licences.
UAE health data residency under Article 13
The section most clinics have not addressed, and the one with a stated financial penalty.
Can a UAE clinic store patient photos on servers outside the UAE?
Not by default. Article 13 of Federal Law No. 2 of 2019 prohibits storing, processing, generating or transferring outside the UAE any health information related to health services provided inside the UAE, except as permitted by a decision of the Health Authority. A clinical photo of a patient treated in Dubai is health data generated in the UAE.
What does Article 13 actually prohibit?
Storing, processing, generating or transferring UAE health data outside the UAE, except as permitted by the Health Authority. The implementing regulation is Cabinet Decision No. 32 of 2020.
Note the breadth. Processing outside the UAE is caught even where the data is stored inside it.
What is the penalty for storing UAE health data offshore?
to AED 700,000
Article 24 of Federal Law No. 2 of 2019 sets a fine of not less than AED 500,000 and not more than AED 700,000. This is a statutory penalty, distinct from any sanction under the advertising standard.
Which exemptions allow health data to leave the UAE?
MOHAP Ministerial Decision No. 51 of 2021 sets the exemption matrix. The exemptions are specific categories with conditions attached, not a general permission. For a cloud application, the relevant route is the online health services exemption, described next.
CureCast UAE hosting and your Article 13 assessment
Check the deployment used by your clinic, including photo storage, recovery, processing and support access.
Does CureCast store UAE patient photos inside the UAE?
CureCast offers a UAE deployment with primary storage in Azure UAE North, Dubai, and an active secondary copy in UAE Central, Abu Dhabi. Confirm the region and migration status for your individual account in writing. Storage location alone does not establish compliance for every processing or support activity.
Which Azure region, and is there any cross-border transfer at any point?
| Field | CureCast UAE deployment |
|---|---|
| Primary region | Microsoft Azure UAE North, Dubai |
| Active secondary copy | Azure UAE Central, Abu Dhabi. Activation confirmed by CureCast on October 30, 2026; no automatic failover or recovery-time guarantee is stated here. |
| Sub-processors | Request the current subprocessor list, processing locations and data processing agreement from CureCast |
| Encryption | AES-256 at rest, TLS 1.2 or higher in transit |
| Support access | Review the support-access terms in your data processing agreement and the legal basis for any overseas access |
| Default or opt-in | Confirm provisioning and any migration status for your account |
| Status | Live in production |
Confirm development, administration and support-access arrangements in the current data processing agreement. The infrastructure summary does not independently establish where every support activity occurs or who can access patient information. Assess any proposed overseas processing or access against the applicable requirements.
Does UAE storage alone remove all cross-border requirements?
No. Assess storage, processing, access and transfers across the complete service. Article 13 restricts covered health information activities outside the UAE, subject to permitted authority decisions. A local storage region does not by itself establish that every activity stays in-country. Obtain advice on any proposed exception or overseas access.
Who at CureCast can access my patient images, and from where?
Request written confirmation of which CureCast personnel can access patient information, from which locations, and under what approval and logging controls. Confirm these arrangements in your data processing agreement. Clinic permission alone should not be treated as establishing a legal exception for overseas access.
Inside your account, access is per staff member at module and action level, and every view, download, share and export is logged in the audit trail with user, device and timestamp.
Is CureCast DHA compliant?
No software can make a clinic DHA compliant on its own. CureCast is designed to support the parts of a clinical photo workflow that sit within the software: patient photo management, access control, consent-based organization and auditability. Your clinic remains responsible for its policies, consent process, staff training, Medical Director approval and advertising practices.
CureCast can support a structured clinical photo workflow, but using the software does not by itself establish compliance with DHA requirements. Clinics should assess their complete workflow against the requirements applicable to their licence and activities.
What are CureCast's sub-processors and where are they located?
The infrastructure summary identifies Microsoft Azure for the UAE deployment. Obtain the current subprocessor list and processing locations from CureCast, including any logging, monitoring and support services. The hosting summary alone does not verify every third-party service or processing location.
Ask for the current list in writing and have it named in your DPA. A list that only exists on a web page is not a contractual commitment.
Is UAE residency the default for UAE clinics, or something I request?
Request written confirmation of the deployment assigned to your clinic account and any outstanding migration before uploading patient information. This page does not establish the provisioning status of every UAE account.
Is UAE-resident storage live today, or planned?
The UAE deployment is described here as live in production. Existing accounts may have a different migration status. Ask CureCast to confirm your account's primary and recovery regions in writing.
Ask this question in exactly this form, and ask for a customer reference. "We support UAE hosting" and "we have a clinic running on it" are different statements, and a roadmap commitment is not residency.
Does the UAE PDPL apply to patient photos, or does the Health Data Law govern?
Federal Law No. 2 of 2019 is the sector-specific health data instrument and contains the Article 13 residency restriction. Federal Decree-Law No. 45 of 2021, the PDPL, is the general personal data law. For a clinical photo system in Dubai, Article 13 applies regardless.
The status of the PDPL Executive Regulations is genuinely contested. One 2026 secondary source names a Cabinet Resolution, uncorroborated. Do not act on any claimed PDPL deadline you cannot verify against a published instrument.
Is it legal to send patient photos over WhatsApp in a Dubai clinic?
This is an Article 13 question first. A photo sent through WhatsApp is transmitted to and processed on infrastructure outside the UAE, and Article 13 covers transferring and processing, not only storage.
- The image lands in a personal message thread
- It is typically copied to both sender's and recipient's camera rolls
- It cannot be revoked, audited or access-controlled
Sharing a link to a controlled system is a different act from sending the image, and it is the pattern a clinic can defend.
Can I store patient photos in Google Drive, Dropbox or iCloud?
Assess the exact service, account type and configuration. Verify storage and processing locations, access controls, audit records, contractual terms and staff offboarding. These capabilities vary by product and plan. A personal cloud account should not be assumed to meet your clinic’s requirements.
What happens to patient photos when a staff member leaves?
Whatever was on their personal device leaves with them. The clinic cannot inventory those copies, cannot recall them, and usually cannot prove they were deleted.
CureCast captures into the patient's file, not the camera roll, and access is per staff member, so revoking one person removes their access to everything at once. A structural answer, not a policy one, because a policy cannot be enforced against a device you no longer hold.
NABIDH, ADHICS and information security
Do I need to connect my clinic system to NABIDH?
NABIDH is DHA's health information exchange, and connection is a licensing expectation for DHA-licensed facilities. The obligation sits on the facility and is met through the system of record, normally the EMR. CureCast is not an EMR and is not a NABIDH integration.
- HL7 and FHIR-conformant integration
- Emirates ID patient matching
- Structured clinical document submission
- Defined consent handling
Whether clinical photos fall within the submission set is a question for DHA and your EMR vendor, worth asking in writing. Malaffi is the Abu Dhabi equivalent, and a group in both emirates connects to each separately. Riayati is the federal layer.
Does ADHICS apply to a Dubai-licensed clinic?
No. ADHICS v2.0, introduced May 2024 and effective August 2024, is mandatory in Abu Dhabi only. It has become a de facto UAE benchmark, and a Dubai group with Abu Dhabi sites will be held to it there, so asking a vendor about it is reasonable even in Dubai.
What should a clinical photo system do to satisfy DHA information-security expectations?
| Expectation | What to ask a vendor |
|---|---|
| Residency | Which countries and regions hold primary data, secondary copies and backups? Ask for the actual replication configuration and account-specific confirmation |
| Encryption | At rest and in transit, with the cipher and TLS version named |
| Access control | Per individual, at module and action level. Shared logins cannot attribute an action to a person |
| Audit trail | Who viewed, downloaded, shared and exported, with timestamp and device |
| Backup and restore | Where backups sit, how long they are kept, and when a restore was last tested |
| Deletion | What happens on request, and whether you get written confirmation |
Primary storage is Azure UAE North, Dubai, with an active secondary copy in Azure UAE Central, Abu Dhabi, confirmed by CureCast on October 30, 2026. The September 12, 2026 infrastructure summary documents AES-256 encryption at rest, HTTPS with minimum TLS 1.2, private file containers and time-limited signed file links. Daily database backups are retained for 30 days and weekly backups for 90 days in Dubai. A September 9, 2026 test restored all 138 database tables successfully. Backup retention is not the same as the clinic’s medical-record retention obligation. This is CureCast’s infrastructure statement, not an independent certification.
Record retention
How long must a Dubai clinic retain patient records and clinical photographs?
We could not verify this and will not state a figure. A 25-year period is widely repeated in the UAE market, but we could not confirm it against the Arabic statutory text. Obtain the requirement from DHA for your facility type. Whatever it is, it applies to clinical photos as part of the record.
A retention obligation measured in decades is an argument against holding clinical images anywhere you do not control, including a staff phone or a consumer cloud account.
Compliant workflow, consent form and audit
What is a compliant before-and-after photography workflow, step by step?
| DHA requirement | Workflow step that satisfies it |
|---|---|
| Same patient | Capture directly into the patient's file. Never into a camera roll to be filed later |
| Same lens | Capture through a system that records the lens used, so the condition can be demonstrated |
| No altered angles | Take the follow-up against the earlier photo, with it overlaid on the camera |
| No misleading lighting | Same room, same light, and hold exposure and colour across the series |
| No editing or filters | No editing tools. Verify your phone's beautification filters are off |
| Written consent | Marketing consent separate from treatment consent, naming purpose, platforms and timeframe |
| Consent-limited use | Marketing works from a consented album, not the patient library |
| Disclaimer, same font size | Applied at publication. A marketing step, not a system step |
| Medical Director authorisation | Recorded before publication, per post |
| Archive | Captured at publication, including edits and formats |
The first seven rows are capture and storage. The last three are governance, and no software performs them for you.
What should a photo consent form for a DHA-licensed clinic contain?
A starting point, not legal advice or a guaranteed compliant form. It is assembled from the consent elements described in the applicable standard and should be reviewed for your facility's circumstances before use. Assembled from the consent elements the standard requires: exact purpose, platform distribution, permissible timeframe and written signature. Published in full and free to adapt.
Your obligations depend on your licence, specialties and procedures. Have this reviewed before a patient signs it.
How do I audit my existing social media archive?
Work backwards from the cheapest checks to the most expensive.
What do I do if I have already posted images that do not meet the new standard?
Remove first, document second, fix the process third.
Do not edit a non-compliant post into compliance and leave the original date. The archive obligation covers edits, and a silently amended post is worse than a removed one.
What CureCast does not do
CureCast does not make your practice compliant. Compliance is a property of your whole operation: your policies, training, consent process and governance. Software is one input.
Hold the parts that are structural rather than procedural: patient images inside the UAE, captured without editing, with the lens and capture conditions recorded, accessible per individual with an audit trail, and separated into consented and non-consented material.
Is CureCast DHA compliant?
CureCast is not a substitute for DHA compliance, and we do not describe the software as making a clinic “DHA compliant.” DHA compliance applies to the clinic's complete operation, including its health-information management, security controls, consent processes, staff practices and applicable regulatory obligations.
CureCast is designed to support the secure management of clinical photographs and patient records through controlled staff access, auditability, encrypted storage and structured clinical photo workflows. DHA's Health Information Assets Management Policy expressly covers health information stored in cloud-based systems, including the systems and infrastructure used by healthcare entities.
Whether a particular clinic meets its DHA obligations depends on how the clinic configures and uses its systems, as well as its policies, consent process, staff training and other regulatory requirements. CureCast can support that workflow; it does not replace the clinic's compliance responsibilities.
Sources
Primary instruments. Obtain current texts from the issuing authority rather than relying on this page.
What we could not verify
Stated plainly, because a knowledge page that hides its gaps is not one.
- The text of CIR-2026-00000144. Analysis draws on law-firm and consultancy summaries
- Which surgical procedures are restricted. Not in any source available to us
- The 25-year retention period. Unverified against statutory text
- UAE PDPL Executive Regulations. Contested, and we will not assert either way
- MOHAP Ministerial Decision No. 430 of 2007. Whether it remains in force
- DoH Abu Dhabi before-and-after requirements. Not retrieved, not assumed to mirror Dubai's
- DHA advertisement permit fees. No published schedule located
Written by Vishal Parikh, Founder, CureCast. Content updated 30 October 2026. For DHA-licensed practices in the Emirate of Dubai. Not legal advice, and not reviewed by UAE counsel. These rules carry personal liability for the licensed professional as well as the facility. Have counsel review before relying on anything here, and obtain CIR-2026-00000144 from DHA rather than relying on any summary, including this one.
