Our approach
The DIFC Data Protection Law requires us to use appropriate technical and organisational measures for the risk involved, and health data is high risk. UAE health law and DHA rules add further duties.
This page lists only what we can stand behind. We leave out some detail on purpose, because publishing it would help an attacker. We do not claim any security certification here.
What we do to protect your data
In transit and in storage
- Our website and app connect to our servers over encrypted HTTPS connections.
- Files in cloud storage are encrypted at rest.
- Scans of identity documents such as your Emirates ID or passport get an extra layer of encryption in our application, and only a signed-in, authorised request can open them.
Signing in
- Passwords are stored only as salted hashes, so nobody can read them.
- One-time codes expire after a short time and lock after too many wrong attempts.
- Repeated sign-in attempts are limited.
- Sign-in sessions and password reset links expire.
- Staff with administrator access can use two-factor authentication.
Access
- Doctors, facilities, employers, insurers and our staff each have roles that decide what they can see and do.
- Reports for employers use masked data and coded aliases, as our privacy policy explains.
- Our internal AI assistant for staff removes details like email addresses, phone numbers and ID numbers before anything goes to the AI provider.
Payments and connections
- You enter card details on the hosted page of our payment provider, Stripe, so your full card number does not reach our systems.
- We check the signature on messages from payment and wearable connection providers before we trust them.
Monitoring
- We log sign-ins, messages sent, errors and important actions, such as a consent being recorded. See the data retention policy for how long we keep logs.
Partners and service providers
We use outside providers to run the service, including cloud hosting, messaging and payments. The privacy policy lists them and says where they are. Licensed facilities have their own systems and security duties under DHA or DoH rules, and we do not control those systems.
What you can do
- Use a strong password that you do not use anywhere else, and keep your phone locked.
- Never share a one-time code, even with someone who says they work for medicAI. We will never ask for your password or a one-time code.
- Watch out for messages or calls that ask for payment or personal details in an unexpected way. If you are unsure, contact us using the details on this page.
- Sign out if you share or use another device.
- Tell us straight away if you lose your phone or think someone has got into your account: support@medicai.ae or +971 56 991 1993.
How to report a security weakness
If you think you have found a weakness in medicAI, please tell us. Email support@medicai.ae with the subject line "Security report". Please include:
- What the weakness is and where you found it.
- Steps to reproduce it, and what someone could do with it.
- How we can reach you. You may report anonymously, but then we cannot reply.
While looking into it, please:
- Do not open, copy, change or delete anyone else's data. If you come across personal data, stop and tell us, and do not keep a copy.
- Do not disrupt the service, use social engineering or attack our staff, partners or users.
- Do not share details publicly until we have had a reasonable time to fix the problem.
If you report in good faith and follow these points, we will treat your report as help and work with you. We do not currently offer a paid reward. UAE law treats unauthorised access to computer systems as an offence, and this page does not give anyone permission to break the law.
How we handle a personal data breach
A personal data breach is when personal data is lost, changed, disclosed or accessed without authority, whether by accident or on purpose. If we learn of one, we will:
- Act to contain it and limit the harm.
- Work out what happened, what data and which people are affected, and what the risks are.
- Tell those who need to know, as set out below.
- Keep a record, and fix the cause.
Who we tell
| Who | When | Source of the duty |
|---|---|---|
| The DIFC Commissioner of Data Protection | As soon as practicable, where a breach compromises a person's confidentiality, security or privacy | DIFC Data Protection Law, Article 41 |
| You | As soon as practicable, if the breach is likely to put your security or rights at high risk, and promptly if there is an immediate risk of damage | DIFC Data Protection Law, Article 42 |
| The facility, employer or other organisation we act for | Without undue delay, where we are acting as its processor | DIFC Data Protection Law, Article 41 |
| Health regulators | As DHA, DoH or other health rules require, where health information is involved | DHA data protection policy and other health rules |
When we tell you, we will use clear language to explain what happened, the likely effects, what we are doing and what you can do to protect yourself. If contacting everyone directly would take disproportionate effort, the law allows a public notice instead.
If you think your data has been affected, email support@medicai.ae with the subject line "Security report". You can also complain to the DIFC Commissioner of Data Protection.
Contact and changes
For security questions, contact support@medicai.ae or +971 56 991 1993, or use our contact form. We update this page when our security measures change, and we show the date at the top.