Who owns your medical record? In theory, in most jurisdictions, you do. In practice, your health data is held by the institution that generated it — the hospital, the clinic, the lab — and accessing it requires navigating bureaucratic processes that were not designed with patient convenience in mind. This review examines the state of patient data rights across the four largest GCC healthcare markets.
UAE
The UAE Federal Decree-Law on Personal Data Protection establishes health data as a category of sensitive personal data requiring specific handling. Under the law, patients have the right to access, correct and request erasure of their personal data. In practice, healthcare providers have been slow to implement patient data access systems, with most access requests handled manually and often requiring significant follow-up.
Saudi Arabia
Saudi Arabia's Personal Data Protection Law, which came into force in 2023, similarly recognises health data rights. The National Data Management Office has published implementing regulations that include specific provisions for health data. Compliance among private healthcare providers remains uneven.
Qatar and Kuwait
Qatar and Kuwait both have developing data protection frameworks that address health data with varying degrees of specificity. In both markets, the practical reality for most patients is that accessing records held by a healthcare institution requires a formal written request, a waiting period and often a fee for copies.
The patient-platform alternative
Patient-held records — where the patient is the custodian and the healthcare provider is the issuer — sidestep many of these institutional barriers. When your health data lives in your account, you don't need to request access from an institution. You already have it.