On 17 August 2026 the Dubai Health Authority issued a circular announcing its standards for medical advertisement content on social media, and told every licensed private-sector facility in Dubai to follow them or face disciplinary action. If you run a clinic or dental practice, your website is part of the same marketing picture, and the people reading it are both patients deciding whether to trust you and a regulator that has written down what trust looks like.
This article separates what the regulator has actually written from what is simply good practice, and then turns both into a site brief. It is not legal advice, and it ends with the questions to put to your compliance lead.
What DHA has actually published
The relevant document is DHA's Standards for Medical Advertisement Content on Social Media. The version we read is v1.1, issued 3 August 2022 and effective 3 October 2022. DHA's circular of 17 August 2026 announces the standards, says all facilities and professionals are expected to adhere to them, and says non-compliance will lead to disciplinary action. It gives no effective date, and the document it links to is that 2022 file. We cannot tell from the circular whether a newer text replaces v1.1, so check DHA's circulars page for the current version before you rely on a clause number below.
Two limits to be honest about:
- It is written for social media. It applies to DHA-licensed facilities and professionals engaged in social media advertisements, and it does not name a clinic's own website. Its definition of social media does include websites and applications built for sharing and networking.
- It covers DHA-licensed practices. The document itself lists the Ministry of Health and Prevention, the Department of Health in Abu Dhabi, the Dubai Healthcare City Regulatory Authority and DHA as separate authorities. A clinic in Dubai Healthcare City or another emirate answers to a different regulator.
Our practical reading: the standard describes how DHA expects a licensed practice to talk about itself in public. A site that breaks the same principles is carrying the same risk, so we design clinic sites to the standard even where it does not strictly bind the page. Confirm that reading with your medical director.
What the standard says that changes a website
Claims and wording
Advertising must be substantiated, especially when it relates to the outcome(s) of treatment, and should include the associated risks (clause 6.6). Clause 6.11 bans absolute and exaggerated wording. Its list includes unique, the best, exclusive, safest, the only, 100%, pioneer, famous and immediate results. The appendix adds that an ad must not claim a professional provides superior services to others.
Headlines such as "Dubai's best dentist" or "instant results" use exactly the words on that list. Strong copy is still possible: say what you do, how, with what training, and what the patient should expect.
Before and after photos
Clause 9.6 says before-and-after images should be of the same individual, using the same lens, with no photo-editing enhancement. They must carry this statement, in the same font size as the rest of the advertisement: there is no guarantee that the result will be the same, as it might vary from one individual to another, along with the risks. Clause 9.1 requires written, documented consent from anyone whose pictures, images, videos or statements are used.
For a design team, that means a before-and-after gallery is not a carousel with a caption. It is a template with a mandatory disclaimer that cannot be cropped out on mobile, and a consent record behind every image.
Testimonials
The appendix of prohibited content lists patient testimonials without written patient consent, and clause 6.10 requires documented consent for any individual used in advertising, limited to the purpose and period for which it was given. So a testimonial wall is possible only with paperwork behind each quote. Pulling in star ratings or reviews from a third party is a separate question to put to your compliance lead, because the standard does not address it.
Names, titles and qualifications
Clause 6.1 says staff must not use titles that differ from their DHA licence, giving examples such as Cosmetic Specialist, Aesthetic Consultant and Anti-Aging Specialist. Clause 6.2 says the title Dr can be used by physicians, dentists and other professionals holding a recognised PhD. Clause 8.1.3 says professionals should state name, title, professional qualification and speciality as per their DHA license.
This is a reason to treat doctor profile pages as controlled content. Copy the title exactly as it appears on the licence, and have the medical director sign off each profile. The same appendix lists qualifications, training institutions, languages spoken, and a statement of fees or accepted insurance arrangements among acceptable content, so a profile can carry them, as long as they are true and current.
Prices and offers
The appendix lists as not acceptable price information that is inaccurate or that fails to specify conditions or variables, and time-limited discounts that cannot be honoured. An offer banner on a clinic site needs its conditions and an end date that is actually enforced.
Licence number, logos and records
Clause 5.2 says the facility's official social media account must state its medical advertisement licence number issued by MOHAP. The standard says this about social accounts; whether a website carries one is a question for your compliance lead, and displaying it in the footer is an easy habit if you are advised to. Clause 7.2 says not to use the DHA or any government logo without explicit written approval. Clause 7.1.13 says posts should be archived with their edits for audit, which is a good reason to keep a dated change log of what your site said and when.
Patient data and your forms
An appointment form collects health information, even if it only asks "reason for visit". Two points are on the public record. The UAE government portal says Federal Law No. 2 of 2019 regulates the use of information and communication technology in the health care sector, including free zones. And DHA's Telehealth Policy, in clause 4.1.7, tells facilities to comply with that law and with Ministerial Decision No. 51 of 2021, and states: it is not permitted to store, develop, or transfer data and health information outside the country that is related to health services provided within the country, except in cases mentioned in Article no. (2) of the Ministerial Decision no. (51) of 2021.
That sentence sits in a telehealth policy, so we are not claiming it settles every website form. We could not read the federal law text itself, and we are not going to guess at its scope. What follows from it is a question, not a conclusion. Before launch, find out where your booking tool, form plugin, chat widget and email service store what patients type, and ask your compliance lead whether that is allowed. Collect the minimum: name, number, preferred time, service. Leave symptoms to the consultation.
The standard also says patient information must be protected on social media and that patients should not be identifiable (clauses 7.1.6, 8.1.10 and 8.1.13). Do not put patient names or case details into page URLs, image file names or alt text.
What patients and Google look for
Google classes health as a topic where mistakes can hurt people. Its documentation says topics that could significantly affect health are "Your Money or Your Life" topics, that the content must be highly accurate and consistent with established expert consensus, and that trust is most important. Its helpful content guidance encourages visible authorship, and warns against false credentials. Google's rater guidelines say the same about medical pages: a creator misrepresenting medical credentials is an example of harmfully misleading content. Those guidelines instruct human raters and, in their own words, no single rating directly changes how a page ranks. Treat them as a description of what trustworthy looks like.
For a clinic, the practical reading is simple. Named clinicians with accurate credentials, treatment pages written or reviewed by a clinician, and no inflated promises are good for patients, good for the regulator and consistent with what Google says it wants.
The practical site brief
Rules end here. Everything below is what we build for clinics because it converts, and where a DHA clause applies we have said so above.
- Booking on the first screen. A visible call and a WhatsApp or booking link, with a short form that asks for little.
- One page per treatment. What it involves, who performs it, what to expect, risks, and how to book. Written in plain language by someone who will stand behind it.
- Doctor profiles with licence-accurate titles. Photo, qualifications, languages, speciality exactly as licensed.
- An insurance and fees page. Say which insurers you accept and how self-pay works. The DHA appendix lists accepted insurance arrangements as acceptable content, so it is allowed and answers the question patients ask first.
- Arabic and English from the start. A patient reading in Arabic should not get a lesser page. See Arabic RTL website design for why this is a layout decision, not a translation task.
- Map, hours and local presence. A clear address, parking or metro note, real opening hours, and a consistent Google Business Profile. Our guide to local SEO for UAE businesses covers it.
- Fast on a phone. Treatment galleries full of large before-and-after images are the first place to check. Compress them and load them lazily. See website speed for UAE businesses.
- A secure, maintained site. A clinic site that gets hacked is a patient-trust incident. See our website security guide.
- A compliance sign-off step. Treatment pages, offers and galleries are approved by the medical director before publishing, and the approval is logged.
Where this lands
A site with superlative headlines and a gallery of unlabelled smiles runs against the standard. A site that is plain about what the practice does, clear about who does it and easy to book runs with it.
If you want a clinic site built as a business asset, with this review process in the brief from day one, see our custom-coded websites or, if your team will update content itself, our WordPress service. Tell us about your practice and we will tell you what we would build and what we would ask your medical director to check.
This article is general information, not legal advice or a compliance opinion. Regulatory text is as published by the Dubai Health Authority and the UAE government on or before 13 November 2026 and may change. Confirm requirements with your medical director and the relevant authority before publishing.