Where we stand
| Item | Status |
|---|---|
| Dubai Health Authority telehealth platform approval | In progress. To confirm: management approves publishing that the application is not yet approved |
| ISO 27001 information security certification | In preparation. Not yet certified. |
| SOC 2 report | Planned. Not yet issued. |
| Penetration test by an independent firm | Planned. Not yet done. |
When any of these is issued we will show the certificate or reference here, with its date. Until then, nothing on this site or in our apps should be read as saying it has been issued.
How we protect your data today
Our security policy lists the protections we can stand behind, for example encrypted connections, role-based access for staff and partners, and encrypted identity documents. Our data retention page explains how long we keep records. What each service costs, and how refunds work, is on the services, fees and refunds page.
We scan our code for exposed secrets and known weaknesses on every change, and we are adding stronger sign-in checks and a fuller record of who opens patient records.
Where your data is hosted
To confirm: approved public wording on hosting location, covering the temporary arrangement and the planned return to the UAE, agreed with counsel and the regulator
Your rights and how to use them
You can ask to see the data we hold about you, to correct it, or to delete it where the law allows. Write to support@medicai.ae with the subject line "Data request". We aim to answer within 30 days.
Some health records must be kept for a long period by law. If we cannot delete something, we will tell you why.
Complaints and concerns
Write to support@medicai.ae with the subject line "Complaint". We acknowledge it within 2 days and aim to answer within 15 days. If you are not satisfied, you can raise your concern with the regulator. To confirm: regulator contact route to publish
To report a security weakness, write to support@medicai.ae with the subject line "Security report".