Security
How we protect your data
Your data is encrypted at every step, open only to the right people, and every action is recorded.
Your team
SSO + one-time code
Gateway
The only door to the internet
Application
Checks role and facility
Database
Encrypted at rest
Authorities
DHPO · Shafafiya · Riayati
Access & Identity
Seven roles, from coder to super admin, with no shared logins. Single sign-on with a mandatory one-time code, brute-force protection and a 30-minute idle timeout. Every request is checked against the user’s organisation and facilities.
Encryption
TLS 1.2 and 1.3 with HSTS in transit. Database and logs encrypted at rest, with keys and secrets kept apart from the data. Only the web gateway is reachable from the internet, and data is hosted in the UAE in a private data centre.
Audit & Testing
Sign-ins, views and changes are recorded with the user, time and before/after values. Dependency scanning and static analysis run on every build, with scheduled vulnerability scans. Controls reviewed against ADHICS V2; ISO/IEC 27001 in progress.
Service levels
Daily
backup
24 hrs
recovery time
12 hrs
recovery point
7 days
critical patches
14 days
high patches
48 hrs
client notice
Integrations
Connected Authorities
DataHub works alongside your existing hospital and billing systems, connected directly to each UAE Authority.
DHPO / eClaimLink
Dubai Health Authority (DHA)
What DataHub doesClaims and remittance download; test and production resubmission
Shafafiya
Department of Health – Abu Dhabi (DOH)
What DataHub doesClaims resubmission
Riayati
Ministry of Health and Prevention (MOHAP)
What DataHub doesClaims and remittance download
Authority compliance
Authority Requirements vs DataHub Compliance
How DataHub’s controls line up with what the UAE health Authorities (DHA, DOH and MOHAP) ask of systems that handle health data.
Role-based access, no shared logins
Met7 roles from coder to super admin; no shared logins
Strong sign-in (MFA)
MetSSO with mandatory one-time code; lockout; 30-min timeout
Audit access to health data
MetAudit trail of sign-ins, views, changes with before/after
Encryption in transit and at rest
MetTLS 1.2/1.3 + HSTS; encrypted database; keys apart
Patching and security testing
MetScans every build; critical in 7 days, high in 14
Authority e-claims platforms and code sets
MetDHPO, Shafafiya and Riayati connections; ICD-10/CPT/drug checks
Security management system
In progressISO/IEC 27001 in progress; ADHICS V2 controls reviewed
Health data kept in the UAE, 25 years
MetHosted in the UAE in a private data centre
Breach reporting and yearly DPIA
MetBreach reporting process and yearly DPIA in place
Backup and disaster recovery
MetDaily backup, 24-hr recovery time, 12-hr recovery point
Met = control in place today · In progress = certification under way
Dubai claims rules
Dubai’s New Claims Rules: Right the First Time
Dubai’s new directive puts a clock on every step of a claim. Getting it right the first time now protects both revenue and compliance.
1 hr
to request prior approval after the doctor’s order
6 / 24 hrs
insurer reply: outpatient / inpatient
45 days
initial claim must be paid
30 days
resubmitted claim must be paid
2
resubmissions allowed per disputed claim
141 days
full adjudication cycle
What it means for providers
- All claims go through eClaimLink; manual submission is prohibited
- Late submission can trigger daily delay fees (0.03% per day)
- Fines of AED 10,000–50,000 per incident
- Annual reconciliation sessions are mandatory
How DataHub helps
- Direct connections to the UAE Authorities
- Falcon AI flags missing prior approvals before sending
- Test upload protects your 2 resubmission chances
- Denials surface as soon as the RA arrives
Request our security pack
We share our full security documentation with prospective clients.