What Makes a Clinic Website DHA-Compliant? A 2026 Checklist for UAE Practices

Dubai Health Authority (DHA) regulation doesn't stop at paid ads. It extends to a clinic's own website, from practitioner bios to the booking form. This checklist is written specifically for facilities licensed by DHA in mainland Dubai. If your clinic is licensed through Dubai Healthcare City, DHCC rules apply instead. Outside Dubai, the Department of Health Abu Dhabi (DoH) or the federal Ministry of Health and Prevention (MOHAP) governs instead. Confirm which regulator issued your license before working through the list below. It changes which rules actually apply to you.

Does DHA Regulate Your Website, or Just Your Ads?

Yes. Website content falls under the same oversight as paid campaigns. DHA's healthcare advertising guidelines apply to licensed facilities and professionals within the context of their own healthcare setting, which includes owned digital channels, not only sponsored ones.

But DHA isn't universal across the UAE, and that distinction matters more than most clinic websites treat it.

A clinic licensed through Dubai Healthcare City that follows a DHA-shaped checklist is following the wrong one. This guide covers DHA specifically. DHCC- and MOHAP-licensed practices should confirm equivalent requirements with their own regulator before assuming this applies as is.

The DHA Website Compliance Checklist

1. Your DHA facility license number is visible

State it in the footer, About page, or Contact page, not buried in a downloadable brochure. It's both a regulatory expectation and a trust signal for patients comparing providers.

2. Each practitioner's license number sits next to their name

A facility license covers the business. It doesn't cover the individuals in it. Doctor bios and team pages should list each practitioner's own DHA license number.

3. Website content is kept separate from promotional claims

General information about a treatment is different from a promotional claim about it. For what a specific campaign or social post can say, including before-and-after photos, outcome claims, and “best in Dubai” language, see our breakdown of DHA advertising rules for clinics. This checklist covers the site itself, not campaign copy.

4. The privacy policy names what UAE PDPL actually requires

Under Federal Decree-Law No. 45 of 2021, in force since January 2022, with its Executive Regulation added via Cabinet Decision No. 33 of 2024, a compliant privacy policy states who controls the data, why it's collected, what categories are gathered, how long it's retained, and how a patient exercises their rights. A generic template rarely covers all five.

5. Cookies require a genuine opt-in

“By continuing to browse, you agree” doesn't meet the standard. PDPL requires explicit consent before non-essential cookies load, with a withdrawal option just as easy to use as giving consent was.

6. Booking and “ask a doctor” forms disclose where health data goes

Health information sits in a higher-protection category under PDPL. State who receives form submissions, how they're stored, and for how long.

7. A medical disclaimer is present

Website content is informational, not a diagnosis. Say so clearly, and don't imply DHA endorsement. Using the DHA logo or crest to suggest official approval is a separate, specific violation.

8. Testimonials reference documented consent, not just claim it

A testimonials or reviews page should note that patient stories run with consent on file. Full detail on consent and claims substantiation for marketing use belongs with the advertising-rules checklist, not repeated here.

9. A complaints or feedback path is visible, not buried

Patients should be able to find how to raise a concern without hunting for it. A dead-end contact form doesn't count.

10. Telehealth disclosures, if virtual consultations are offered

This only applies if the practice offers online consultations. If it does, the site should disclose how a virtual visit differs from in-person care and what it can't replace.

What Happens If a Clinic Website Isn't Compliant?

Non-compliance risk isn't limited to the website itself. DHA circulars govern the same claims across channels, so a website gap often surfaces first as a flagged inspection finding or, downstream, as a suspended Google or Meta healthcare ad. Platforms increasingly treat site-level compliance as a signal for whether to keep running a clinic's campaigns at all.

The safer sequence is fixing the website baseline first, since campaigns get rebuilt on top of it. Exact penalty schedules should come from your compliance officer or DHA directly. This guide won't guess at figures it can't verify.

DHA Website Compliance vs. DHA Advertising Rules

The two overlap at points. A testimonials page touches both. But “is our site compliant” and “can we say this in an ad” are different checklists. This page covers the first. See the campaign-side compliance checklist for the second.

About This Checklist

This reflects DHA's published advertising standards and the UAE PDPL statute as of August 2026. It isn't legal advice. DHA, DHCC, and PDPL requirements are revised periodically, so confirm current specifics with your compliance officer or legal counsel before publishing changes based on it.

Written by: Veridion & Partners, a healthcare marketing and practice growth advisory based in Downtown Dubai, working with clinics, hospital groups, and medical-tourism operators across the UAE and GCC. Our clinic website builds are built against checklists like this one from the first draft.

Published August 2026 · Last updated August 2026