UAE Clinic Website Checklist 2026: Bookings, WhatsApp, DHA Rules

A clinic website in the UAE has three jobs: win trust in a few seconds, turn visitors into booked appointments, and stay inside the rules set by the Dubai Health Authority (DHA), the Department of Health Abu Dhabi (DOH) or the Ministry of Health and Prevention (MOHAP). If your site does all three, it becomes your best receptionist. If it misses one, it either loses patients or creates compliance risk. Below is the checklist I use when I plan clinic websites for the Gulf in 2026.

I build and run the websites for Enfield Royal Clinic across Pakistan, the UAE, Saudi Arabia, Oman and the USA, so most of what follows comes from shipping and maintaining real clinic sites, not from theory. This is not legal advice. Your medical director and your licensing authority always have the final word on what you can publish.

1. Trust and licensing details patients look for first

Patients in Dubai and Abu Dhabi compare several clinics before they call. The first thing they check is whether the clinic and its doctors are real and licensed. Make that easy to confirm.

• Doctor profiles that match the licence. Every doctor gets a page with their name, photo, specialty and title exactly as it appears on their DHA, DOH or MOHAP licence. The DHA social media standard is explicit that titles must match the licence and that only physicians, dentists and recognised PhD holders may use “Dr.” I apply the same rule to the website so nothing contradicts the clinic’s social accounts.
• Facility details on every location page. Legal name, full address, map, phone, opening hours and the licensing authority that regulates that branch.
• No government logos without permission. Do not drop the DHA or DOH logo in your footer as a trust badge. Written approval is needed to use government names or logos.
• Real photos of the clinic. Stock images of smiling models do the opposite of building trust in a medical context.

2. Medical content that stays inside the advertising rules

Most clinic owners think of advertising rules as a social media problem. In practice, your website is advertising too, and the same words that get an Instagram post flagged will cause trouble on a treatment page. In 2026 the DHA issued updated rules for medical advertising on social media. Its Standards for Medical Advertisement Content in Social Media sit behind them, and the coverage in Gulf News (September 2026) lists words such as “miraculous”, “magic”, “the best”, “100 per cent”, “has no side effects” and “immediate results” as off limits. I treat that list as a style guide for website copy as well.

What I change on almost every clinic site

Two more habits help. First, give every treatment page a named medical reviewer and a “last reviewed” date. That is good practice under Google’s guidance on helpful, people first content and it gives your medical director a clear sign off step. Second, keep a simple content log (page, date, who approved). If your licensing authority ever asks, you can show what was published and when.

3. Online booking that actually fills the calendar

A “Book now” button that opens a generic contact form is the most common leak I see. A patient who wants an appointment on Thursday evening does not want to wait for a callback. The booking flow should answer three questions in under a minute: which doctor or treatment, which branch, and which time.

1. Choose a service or doctor. Keep it to one tap from any treatment or doctor page, with the selection carried into the form.
2. Choose a branch. For multi branch clinics, preselect the nearest one based on the page the patient came from.
3. Pick a slot. Pull real availability from your clinic management system or calendar where possible. If you cannot integrate yet, offer preferred date and time windows and confirm within working hours.
4. Collect the minimum. Name, mobile number with country code, and an optional note. Do not ask for Emirates ID, insurance card photos or medical history on a public web form.
5. Confirm instantly. Show a confirmation screen, send an email or WhatsApp confirmation, and push the lead into your CRM with its source (Google Ads, organic, Instagram) so you know which channel pays for itself.

Tracking matters as much as the form. Every booking should fire a conversion event in Google Analytics and your ad platforms. Without that, you are guessing where your marketing budget goes.

4. WhatsApp: the channel UAE patients actually use

In the Gulf, many patients would rather send a WhatsApp message than fill in a form or call. A floating WhatsApp button is now a standard feature on the clinic sites I build, but how you set it up decides whether it helps or creates chaos.

• Prefilled messages per page. A button on the hair transplant page should open WhatsApp with “Hi, I would like to know more about hair transplant at your Dubai branch.” Your team knows the context before they reply.
• Route by branch. Each location gets its own number or its own inbox, so messages do not pile up with one receptionist.
• Use the WhatsApp Business Platform for volume. Once you get more than a few dozen chats a day, a shared inbox with assigned agents, quick replies and opening hours messages beats a single phone.
• Add an AI assistant carefully. An assistant can answer opening hours, location, prices you publish and booking questions, and hand off to a human for anything clinical. It should never diagnose. I cover the setup in detail on my AI integration services page.
• Track clicks. Count WhatsApp clicks as conversions, with the page they came from.

5. Patient data, privacy and hosting

Clinic websites collect personal data from the first form submission, and anything that touches health information needs extra care. The UAE’s Federal Law No. 2 of 2019 on the use of information and communication technology in health fields restricts storing or processing health data outside the country unless an approved exception applies, and requires health records to be kept for at least 25 years. The law firm Al Tamimi has a clear summary of the health data law worth sharing with your management team.

What this means for the website in practice:

• Keep the public website for marketing data only. Name, phone, preferred time and treatment interest. Medical history, reports and insurance documents belong in your clinic system or a patient portal designed for that, hosted in line with the law.
• Do not email full form submissions to personal Gmail accounts. Send leads to a CRM with user accounts and access control.
• Use HTTPS everywhere, strong admin passwords, two factor login and a web application firewall. I have recovered more than 60 hacked websites, and the pattern is always the same: outdated plugins, shared logins and no monitoring.
• Publish a privacy policy and cookie notice that match what the site actually collects, in English and Arabic.
• Back up daily and test restores. A backup you have never restored is a hope, not a plan.

6. Arabic, mobile speed and local SEO

Your website can be compliant and well built and still be invisible. Three things decide whether patients find it.

Bilingual from day one

Plan English and Arabic together, with proper right to left layouts, translated (not machine only) medical content, and hreflang tags so Google shows the right language. Retrofitting Arabic later almost always costs more than building it in.

Fast on a phone

Most clinic traffic in the UAE is mobile, often from paid ads. Aim to pass Core Web Vitals: compress images, avoid heavy sliders, and load chat widgets and tracking scripts only after the page is usable. My guide on how to speed up a WordPress website covers the fixes I use most.

One page per branch and per core treatment

Create a location page for each branch with its own address, map, hours, doctors and reviews, linked to its Google Business Profile. Add LocalBusiness or MedicalClinic schema, plus FAQ content written for real patient questions. For groups that operate in several countries, I prefer one codebase with country sites that share design and components but keep their own content, doctors and regulator details. That is the approach behind the multi country clinic websites I run (see my web development portfolio).

The 2026 UAE clinic website launch checklist

1. Every doctor profile matches the licence title and specialty.
2. No banned or superiority words on any page, including image text and alt text.
3. Before and after images are unedited, consented and carry a “results vary” disclaimer.
4. No government logos without written approval.
5. Each branch has a location page with address, hours, map and regulator.
6. Booking takes under a minute and confirms instantly.
7. WhatsApp buttons use prefilled, page specific messages and route by branch.
8. Booking and WhatsApp clicks are tracked as conversions.
9. Forms collect only marketing data; health data stays in a compliant clinic system.
10. HTTPS, two factor login, firewall, updates and daily backups are in place.
11. English and Arabic versions are complete, with hreflang.
12. Mobile pages pass Core Web Vitals.
13. Medical director has signed off every treatment page, with review dates shown.

If you are comparing options, my web development services page explains how I scope clinic projects, and the pricing page shows my standard packages.

Frequently asked questions