Malaffi, NABIDH, Riayati: The UAE’s Health Data Exchanges and What Vendors Must Actually Do

Three exchanges, one map

Malaffi is Abu Dhabi’s health information exchange, mandated by the emirate’s Department of Health and operated by ADHDS/M42. Its published scale: 3,141 connected facilities, including 100% of the emirate’s hospitals.

NABIDH is Dubai’s exchange, run under the Dubai Health Authority and governed by the NABIDH Policies & Standards — the document set that defines what connected systems must do.

Riayati is the federal layer: the National Unified Medical Record, under the Ministry of Health and Prevention. At the time of its integration milestone it held around 1.9 billion records for 9.5 million patients — the closest thing the country has to a single national patient history.

The practical reading for a vendor: Abu Dhabi patients flow through Malaffi, Dubai patients through NABIDH, and Riayati sits above both as the federal record. Selling into UAE healthcare means meeting your customers on all three.

Since January 2023, one system in practice

On 31 January 2023, at Arab Health, the three platforms were announced as mutually integrated — Abu Dhabi’s, Dubai’s and the federal exchange connected into a single national fabric. For providers, a patient moving between emirates no longer means a record that stops at an emirate’s border.

For vendors, integration raises the bar rather than lowering it: a system that connects in one emirate is expected to behave consistently in the national picture.

The mandate: connection is not optional

In both Abu Dhabi and Dubai, connection to the emirate’s exchange is mandatory for licensed healthcare facilities. This is a facility-connection mandate: the obligation sits on the hospital, clinic or laboratory holding the licence, as a condition of operating — not as a vague market expectation.

Vendors feel the mandate second-hand but completely. A facility that must connect will only buy systems that can connect — which makes conformance a sales feature before it is a compliance one.

What vendors must actually do

Here is the precise version, because market talk about “vendor certification” overstates it. There is no single vendor certification licence that unlocks the UAE’s health data exchanges. What exists is a facility-connection mandate plus platform conformance testing — and each platform runs its own onboarding.

For NABIDH, the governing text is the NABIDH Policies & Standards: the rulebook a connecting system is tested against during onboarding with the Dubai Health Authority. For Malaffi, onboarding runs under Abu Dhabi’s ADHICS framework, with its own conformance requirements. Riayati connection follows the federal platform’s integration process.

The sequence to plan for: pick the emirate your first customers are licensed in, obtain that platform’s standards and onboarding path, build and test against it, and only then scale to the next. Vendors who treat conformance as an afterthought discover it in the middle of a procurement they were about to win.

The residency layer: where the data may sit

Connection is only half the compliance map; the other half is geography. Federal Law No. 2 of 2019 — the health ICT law — restricts the transfer of health data outside the UAE: Article 13 makes keeping it in-country the default, with carve-outs only as set out in Ministerial Decision No. 51 of 2021.

Abu Dhabi sharpens this further. ADHICS v2.0, issued in May 2024, blocks cross-border health data flows — including backup and disaster-recovery copies — while permitting in-UAE cloud. Read that carefully if you architect systems: the restriction reaches the copies, not just the primary database, and “cloud” is allowed only when the cloud is inside the country.

Together, the federal law and ADHICS draw the same line from two directions: UAE health data stays in the UAE. Every system in your stack that touches it — analytics, support tooling, AI — inherits that line.

Where a governed in-country AI layer fits

This is where the AI question usually breaks. The default pattern — streaming clinical data to a foreign model API — is a cross-border health data transfer wearing a product demo’s clothes. Under Article 13 and ADHICS v2.0, that is not an architecture choice; it is a violation in waiting.

The pattern that fits the map is the one DEBO is built on: the AI deploys inside the country, inside your environment, so data is processed where it already lawfully sits. Questions are asked in plain language, permissions decide what each user can see, and every question and answer lands in an audit log — the evidence trail a health-authority audit will ask for. For vendors, it is also an embeddable shape: a governed in-country AI layer under your own product’s brand.