DHA social media advertising rules: how Dubai clinics can use AI content safely

Digital marketing

Dubai clinics want to publish every day, and AI makes that cheap. The Dubai Health Authority's Standards for Medical Advertisement Content on Social Media, re-issued to private facilities in 2026, make the clinic liable for what its staff and influencers post, and they ban much of the language generative AI produces by default. Below is the rulebook in plain terms, and a workflow where AI drafts, an automated checklist strips banned claims, and the medical director signs off before anything goes live.

Generative AI has collapsed the cost of producing clinic marketing. A reel script, an Instagram caption, a WhatsApp broadcast and a TikTok hook can be drafted in minutes. What has not collapsed is the cost of getting them wrong. Under the Dubai Health Authority's Standards for Medical Advertisement Content on Social Media, the facility's medical director is accountable for the content and style of any post that promotes the clinic, the facility is liable for what is filmed on its premises even on an influencer's personal phone, and "the best", "miraculous" and "immediate results" are prohibited outright. The same tooling that creates the risk can be pointed at it. What follows is the rulebook you have to design against, and a drafting, checking and sign-off workflow that keeps the content calendar moving.

What the DHA social media advertising rules actually say

The governing document is DHA/HRS/HPSD/ST-21, Standards for Medical Advertisement Content on Social Media, version 1.1, issued on 3 August 2022 and effective from 3 October 2022. DHA's Health Regulation Sector re-issued it to licensed health facilities and healthcare professionals in the Dubai private sector in 2026, through a circular on the Sheryan portal, and the press covered it in September 2026 (Gulf News, Emirates 24/7). One nuance matters: the standard has been in force since October 2022. The 2026 circular is an enforcement reminder, not a new rulebook, so content your clinic published over the past three years is already inside audit scope.

The standard applies to every DHA-licensed facility and professional engaged in social media advertising, and it names Instagram, Facebook, TikTok, YouTube, Snapchat, WhatsApp and LinkedIn. Influencers promoting a facility's services, treatments or outcomes fall inside it too. Note the boundaries: Dubai Healthcare City and the DIFC sit under separate regulatory frameworks, and the wider statutory backdrop includes Executive Council Resolution No. 49 of 2024 on health professions and Federal Law No. 15 of 2020 on consumer protection, as amended.

The obligations cluster around six things:

1. Pre-approval. Any social media advertisement that names or identifies the facility must be approved by the medical director first (clauses 5.3, 5.4 and 7.3). That includes posts by administrative staff and by influencers.
2. Premises liability. The facility is liable for all content filmed on its premises, shot professionally or on personal mobile phones, whether it appears on the clinic's account, a doctor's account or an influencer's account (clause 5.5).
3. Banned language. Absolute statements, exaggerated claims and alarming expressions must not be used (clause 6.11): "unique", "one of a kind", "the best", "exclusive", "safest", "the only", "incomparable", "unprecedented", "best product", "magic", "miraculous", "assured success", "very limited quantity", "has no side effects", "get money back", "100%", "absolutely certain", "distinguished", "famous", "pioneer" and "immediate results". Clause 6.12 bars negative statements about other professionals, facilities or government entities, and clause 8.1.9 bars superiority claims against named or unnamed rivals.
4. Substantiation and balance. Outcome claims must be substantiated and must state the associated risks (clause 6.6). Content must not create unrealistic expectations, induce fear to drive demand, manufacture unnecessary need, or exploit a patient's lack of knowledge (clause 8.1.14 and Appendix 1).
5. Consent and imagery. Written, documented consent is required before any patient picture, video or statement is used (clause 9.1), with verifiable parental consent for under-18s (clause 8.1.12(a)). Before-and-after images must show the same individual, the same lens, no Photoshop or equivalent, and carry the disclaimer "there is no guarantee that the result will be the same, as it might vary from one individual to another" plus the risks, in the same font size as the rest of the post (clause 9.6). No filming or live streaming during surgery, under general anaesthesia, or in procedure rooms for promotional purposes (clause 9.7).
6. Records and controls. Posts must be archived with their edits and formats for verification and audit (clause 7.1.13). The medical director must appoint a trained content moderator, run induction and refresher training, keep a social media policy, communicate penalties to staff, and control account access (clauses 7.1.8 to 7.1.15).

Two further details catch clinics out. The official account must display the medical advertisement licence number issued by the Ministry of Health and Prevention (clause 5.2), and specialty titles must match the DHA licence exactly: "Cosmetic Specialist", "Aesthetic Consultant", "Aesthetitian", "Anti-Ageing Specialist" and "Beauty Expert" are all listed as unacceptable (clause 6.1). "Dr" is reserved for physicians, dentists and holders of a recognised, UAE Ministry of Education attested PhD (clauses 6.2 and 6.3).

On penalties, the circular says non-compliance "will result in taking the suitable disciplinary actions", and no fine schedule has been published. Treat that as open-ended exposure rather than a capped cost of doing business.

Why AI content is the highest-risk material you publish

Three properties of generative AI collide with clause 6.11 and Appendix 1:

• Superlatives are the default register. Marketing prompts produce "the best", "transform", "guaranteed" and "immediate results" almost reflexively. Clause 6.11 bans that register outright.
• Fear hooks are the standard growth tactic. "Your skin is ageing faster than you think" is textbook engagement copy and textbook prohibited content under clause 8.1.14(b) and Appendix 2 item 10 (words that cause fear, anxiety or panic).
• Models invent substantiation. A draft may cite "studies" that do not exist or imply guaranteed outcomes. Clause 6.6 requires real substantiation and stated risks. A fabricated citation is both a compliance breach and a trust breach.

There is a fourth trap specific to aesthetic medicine. AI upscaling, generative fill and background clean-up would each count as "photo shop enhancements or equivalent software" under clause 9.6. Touch a before-and-after image with one and you have voided the only conditions under which it is allowed.

The point is not to stop using AI. It is that AI output cannot be treated as publishable content. It is a draft that enters a controlled process.

Three ways to run clinic content, compared

The third model is the only one that survives an audit, and the checklist is what makes it affordable. Relying on the medical director to proofread every caption personally is how approval bottlenecks build, and bottlenecks are what push teams back to auto-publishing.

Worked example: a Jumeirah aesthetics clinic, one month of content

Take a clinic producing 30 social media items a month across Instagram, TikTok and WhatsApp, plus one influencer visit. The hours below are illustrative effort figures for that scenario, not benchmarks.

Step 1, brief the model. The marketing executive asks for a reel script promoting a hydrafacial course. The prompt carries house rules: title exactly as on the DHA licence, no clause 6.11 words, risks stated, no recovery-time promises.

Step 2, first draft. The model returns: "Dubai's best hydrafacial. Immediate results, 100% satisfaction, no side effects. Book now, offer ends Friday."

Step 3, automated check. The linter below flags five violations in one pass: "best" (6.11), "immediate results" (6.11), "100%" (6.11), "no side effects" (6.11), and a time-limited inducement ("offer ends Friday") that Appendix 1 prohibits where the offer cannot be met as advertised. Elapsed time: seconds. Under manual review, this is the stage where things quietly get missed.

Step 4, rewrite within guardrails. The revised draft reads: "A hydrafacial course at our clinic, delivered by a DHA-licensed dermatologist. It cleans, exfoliates and hydrates the skin. Some people see a glow after the first session; results vary between individuals. Mild redness can occur for a day. Book a consultation to check whether it suits your skin." That is publishable material: factual, balanced, no superlatives.

Step 5, evidence pack. The executive attaches the clinic's internal treatment protocol as substantiation for the outcome statement, stored against the post for audit (clauses 6.6 and 7.1.13).

Step 6, medical director sign-off. The medical director reviews from a queue, not an inbox. For a 30-post month this is the bulk of the clinical time involved: roughly 15 to 20 minutes per working day if posts arrive in daily batches. The director approves the reel and rejects a carousel whose before-and-after shot lacks the clause 9.6 disclaimer at the correct font size.

Step 7, influencer day. The influencer films in reception. Clause 5.5 makes the clinic liable for that footage, so the process is: consent forms for any patient appearing (clause 9.1), a scripted brief that itself passes the linter, medical director approval of the final cut before it is posted on the influencer's personal account, and disclosure of the paid relationship (clause 6.7). If the influencer posts something unapproved that names the clinic, it comes down and the incident is logged.

Step 8, archive. Every published item is stored with its draft history, consent reference, substantiation link and approval timestamp. Clause 7.1.13 expects posts archived "with edits and formats", so keep the final asset, not just the caption.

The checklist you can automate

Banned words and structural omissions are deterministic problems. Solve them with code and reserve human judgement for clinical accuracy and tone. A minimal rules file:

# dha-sma-rules.yaml
banned_terms:            # DHA/HRS/HPSD/ST-21 clause 6.11
  - "unique"
  - "one of a kind"
  - "the best"
  - "exclusive"
  - "safest"
  - "miraculous"
  - "magic"
  - "assured success"
  - "has no side effects"
  - "get money back"
  - "100%"
  - "absolutely certain"
  - "immediate results"
  - "pioneer"
  - "famous"
fear_patterns:           # clause 8.1.14(b), Appendix 2 item 10
  - "before it is too late"
  - "is ruining your"
  - "you are losing"
superiority_patterns:    # clause 8.1.9
  - "better than"
  - "unlike other clinics"
requires_risks_if_outcome_claim: true   # clause 6.6
before_after_disclaimer: "there is no guarantee that the result will be the same, as it might vary from one individual to another"

And a checker you run on every draft before it reaches the medical director:

import re, yaml

rules = yaml.safe_load(open("dha-sma-rules.yaml"))

def check_draft(text: str, is_before_after: bool = False) -> list[str]:
    findings, lower = [], text.lower()
    for term in rules["banned_terms"]:
        if term in lower:
            findings.append(f"6.11 banned term: {term!r}")
    for pat in rules["fear_patterns"]:
        if pat in lower:
            findings.append(f"8.1.14(b) fear inducement: {pat!r}")
    for pat in rules["superiority_patterns"]:
        if pat in lower:
            findings.append(f"8.1.9 superiority claim: {pat!r}")
    if re.search(r"\b(guarantee[sd]?|cure[sd]?|permanent)\b", lower):
        findings.append("Appendix 2 item 3/7: outcome presented as guaranteed")
    if is_before_after and rules["before_after_disclaimer"].lower() not in lower:
        findings.append("9.6 before/after disclaimer missing")
    return findings

Run this in CI for your content pipeline, or as a pre-submit hook in whatever system holds your prompts. If findings come back, the item never reaches the medical director's queue. A shared, versioned prompt library with these rules baked in means nobody on the marketing team starts from scratch and the compliant phrasing survives staff turnover, which is what Azrty's PromptForge is built for.

Influencers, WhatsApp and paid campaigns

Influencers. The contract is your first control, but the standard is your second. Anything filmed on your premises is your liability (clauses 5.3 and 5.5), so build pre-approval into the engagement: brief, script and final cut all signed off by the medical director before posting. Paid relationships must be documented and disclosed (clause 6.7). Testimonials need written patient consent, and comparative or "exclusive skill" testimonials are prohibited outright (Appendix 2 items 8 and 11).

WhatsApp. The standard's definition of social media is broad and names WhatsApp explicitly, so broadcast lists and status posts promoting treatments are in scope. Every broadcast that names the clinic needs medical director approval like any other advert, and consent records for patient content are the same (clause 6.10: consent limited to the stated subject and period). Reusing consent beyond its stated duration is a breach even when the original shoot was compliant.

Paid campaigns. Two licences interact. The clinic's official account must display the MOHAP medical advertisement licence number (clause 5.2), and MOHAP licenses healthcare advertising on social media accounts through its healthcare advertisement licensing service, with a stated completion time of 1 to 3 working days, one account per healthcare institution (duplicate accounts are frozen) and fees of AED 100 to apply plus AED 1,000 a month or AED 3,000 a year for a social media account licence. For campaigns tied to events or screenings, DHA offers a temporary permit for a media campaign, free of charge with a 2 working day delivery time. Budget the approval time into the campaign calendar: a Meta or TikTok ads launch that assumes same-day creative sign-off will fail on both counts.

What to do next

If you run a Dubai clinic, this week:

1. Pull the standard and map your last 90 days of posts against clauses 6.11, 6.6, 9.1 and 9.6. Fix or delete what fails, and note the changes.
2. Confirm your MOHAP advertisement licence number is displayed on your official accounts, and that nobody on staff uses a title that differs from their DHA licence.
3. Write the approval rule into your social media policy: nothing naming the clinic goes out without the medical director's recorded sign-off, influencer content included.
4. Stand up the automated checklist above on your drafts, and keep consent and archive records beside every published item.
5. Train the team now and schedule refreshers; clauses 7.1.9 and 7.1.11 make both an explicit medical director duty.

If you want this built properly, it is the kind of work we do at Azrty. We are a Dubai team, and our digital transformation practice connects the marketing, consent and approval systems so that this workflow runs as a process rather than a spreadsheet. AI can keep your clinic's content volume high. A checklist like this is what keeps it, and your medical director, out of trouble.

https://www.azrty.com/blog/dha-social-media-advertising-rules-how-dubai-clinics-can-use-ai-content-safely

<a href="https://www.azrty.com/blog/dha-social-media-advertising-rules-how-dubai-clinics-can-use-ai-content-safely">DHA social media advertising rules: how Dubai clinics can use AI content safely</a> (Azrty)