Skip to content

UAE Addendum

Draft — pending legal review. This document has not yet been reviewed by counsel and may change before it takes effect. Version 0.1-draft · effective 2026-10-01 · updated 2026-09-27.

This addendum supplements the Terms of Service and Privacy Policy for clinics based in the United Arab Emirates. It describes, in neutral terms, UAE federal data protection and health-sector ICT laws that may apply to your use of Enamela. It does not state that Enamela is certified or has been assessed as compliant with these laws; each clinic is responsible for its own legal compliance. Draft — pending legal review.

1. Scope

This addendum applies to clinics operating in the United Arab Emirates that use Enamela, in addition to the Terms of Service, Privacy Policy, and Data Processing Agreement. It does not address emirate-level or free-zone regimes (such as DIFC or ADGM data protection law), which a clinic operating in those zones should review separately with counsel. Where this addendum conflicts with those other documents on a matter specific to the UAE, this addendum controls for that matter.

2. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data

UAE Federal Decree-Law No. 45 of 2021 (the federal Personal Data Protection Law) governs the processing of personal data of individuals in the UAE, including rules on lawful processing, data subject rights, and cross-border transfer of personal data.

As between a clinic and Enamela, the clinic remains the controller of patient personal data (as described in the Data Processing Agreement) and is responsible for identifying and meeting its own obligations as a controller under this law, including any notices owed to patients and any cross-border transfer conditions that apply to data hosted outside the UAE.

3. Federal Law No. 2 of 2019 on the Use of ICT in Health Fields

UAE Federal Law No. 2 of 2019 concerns the use of information and communications technology (ICT) in the health sector, including health-data handling and, in some interpretations, data localisation expectations for health data relating to UAE residents. This is a health-sector-specific law, separate from the general federal Personal Data Protection Law described above.

Whether and how this law applies to Enamela as a practice-management platform used by a dental clinic, and whether it requires in-country hosting for the patient data a clinic stores in Enamela, is a legal question that Enamela is reviewing with counsel. This addendum does not represent that Enamela's current hosting arrangement satisfies Federal Law No. 2 of 2019.

4. Data hosting location

Clinic and patient data is currently hosted in the ap-southeast-1 (Singapore) region with our database provider, as described in the Subprocessors page. Enamela does not currently offer in-country (UAE) hosting.

Because UAE health-sector rules may require in-country hosting for health data (see Section 3), in-country hosting for UAE health-data clinics is under review with counsel before Enamela is offered to clinics for whom this is a hard requirement. UAE clinics with confirmed in-country hosting obligations should raise this with Enamela before storing sensitive patient data, and should confirm their own requirements with counsel.

5. No compliance claim

This addendum is a general description of relevant UAE federal laws for context. It is not legal advice, and it is not a representation or certification that Enamela or a clinic's use of Enamela complies with Federal Decree-Law No. 45 of 2021, Federal Law No. 2 of 2019, or any other UAE law (federal, emirate-level, or free-zone). Clinics should seek their own legal advice on compliance.

6. Contact

Questions about this addendum can be sent to legal@enamela.app [confirm address]. [Company legal name]; [registered address].