Healthtech B2B marketing in the UAE and Saudi Arabia: data rules, device approval and hospital buying groups
Healthtech B2B marketing in the UAE and Saudi Arabia succeeds when it answers the regulatory questions before the clinical ones: where health data is stored, whether the product is a regulated medical device, and how it connects to the national and emirate health systems. UAE federal law keeps health data inside the country except under defined exemptions, and in Saudi Arabia digital products that qualify as medical devices fall under SFDA marketing authorization, so proof of compliance and integration is the foundation every campaign builds on.
Key takeaways
- UAE Federal Law No. 2 of 2019 restricts storing, processing or transferring health data outside the UAE, with exemptions set by a 2021 ministerial resolution.
- Abu Dhabi's Malaffi health information exchange lists more than 3,100 connected facilities, so integration is a buying question.
- In Saudi Arabia, SFDA guidance MDS-G27 ties digital health products that qualify as medical devices to its marketing authorization requirements.
- Saudi public sector procurement runs through NUPCO prequalification, and products must be registered with the SFDA first.
Regulation shapes the buying process
Hospital groups and health systems in the Gulf buy technology through clinical, IT, privacy and procurement reviews that are shaped by health-specific rules. A vendor that leads with outcomes and features, without clear answers on data location, device status and integration, usually reaches a clinical champion and then waits.
In the UAE, Federal Law No. 2 of 2019 on the use of information and communications technology in health fields applies to health service providers using ICT for health data, including in free zones. Al Tamimi summarizes its core rule as health data cannot be stored, processed, generated or transferred outside the UAE, except where permitted, and notes a minimum retention period of 25 years from the last health procedure. A ministerial resolution in April 2021 set out 10 circumstances in which transfers may be allowed, including telemedicine services and certain personal-use devices and wearables, some with conditions such as written consent and encryption.
In Saudi Arabia, the Saudi Food and Drug Authority's Guidance on Digital Health Products (MDS-G27, August 2025) states that manufacturers of digital health products that qualify as medical devices shall comply with its Medical Devices Marketing Authorization requirements. This is a planning summary, not legal advice; confirm your product's status with regulatory counsel.
What buyers ask, and what marketing must show
We turn the regulatory questions into a content plan before writing a single campaign.
| Buyer question | Rule or system behind it | Content that answers it |
|---|---|---|
| Where is patient data stored and processed? | UAE ICT health law; Saudi PDPL and sector rules | Hosting and data flow statement per country, with any exemption relied on |
| Is this a regulated medical device? | SFDA MDS-G27 and MDMA requirements; UAE device rules | Regulatory status page: classification, approvals held and in progress |
| Does it connect to our health information exchange? | Malaffi in Abu Dhabi and other emirate and national platforms | Integration page: standards supported, connections live and timelines |
| Can we buy it through public procurement? | NUPCO prequalification and SFDA registration in Saudi Arabia | Procurement page: registrations, local entity or partner and frameworks |
| Who supports it locally? | Hospital IT and clinical engineering expectations | Support model, local partner, training and clinical onboarding |
| What evidence supports the outcomes? | Clinical and operational review | Studies, peer references and outcomes data you are allowed to publish |
We build tiered account lists with your sales team and launch the first plays in weeks.
The hospital buying group
Health system purchases involve more roles than most vendors map. We plan targeting and content for each, and record them against the account in the CRM.
- Clinical leaders: chief medical officers, department heads and nursing leadership who own the clinical case.
- Digital health and IT: CIO, CMIO, integration and EHR teams who own interoperability and hosting.
- Information security and privacy: who review data location, access and the health data rules.
- Biomedical or clinical engineering: who manage device inventory and maintenance for regulated devices.
- Operations and finance: who own capacity, cost and the business case.
- Procurement and supply chain: who run tenders, frameworks and, in the Saudi public sector, NUPCO processes.
Coverage across these roles predicts progress better than engagement from any one of them. Our buying group consensus program is built around that idea.
Saudi Arabia: health clusters and centralized procurement
The Saudi health system is being reorganized. The US International Trade Administration's country guide, updated in May 2026, describes the Health Holding Company as having taken over as provider of healthcare services, with health clusters, each an integrated network of providers serving about one million people. It describes NUPCO as responsible for centralized government procurement of pharmaceuticals and medical supplies, with only prequalified companies able to bid, and states that foreign companies must register their medical products with the SFDA before prequalifying with NUPCO.
For marketing, that means two account structures: the cluster and its facilities for clinical and operational adoption, and the central procurement and registration path for the commercial route. Plan both, and do not confuse a pilot with a procurement route.
Channels and compliance in campaigns
LinkedIn company list targeting works for named hospital groups and health systems, with campaigns split by role. Search needs careful negatives to separate hospital and IT buyers from patients and job seekers; our Google Ads for healthtech companies page covers the patient-search negatives and Google's healthcare ad policy. Events and clinical conferences should be run as account programs with meetings booked in advance.
Keep patient data out of marketing systems entirely. Your CRM should hold business contacts at providers, with consent recorded under the Saudi and UAE data protection laws, as we describe in our guide to Saudi PDPL and UAE PDPL for B2B marketers.
How we work with healthtech vendors in the GCC
We work with clients across the GCC from Montreal and have no office in the region. We work asynchronously with scheduled overlap in the Gulf afternoon and do not take calls in Gulf business mornings. Arabic content is produced with your clinical and regulatory reviewers or native partners, not by us, and we do not claim GCC client work.
Our part is the account-based structure: the regulatory and integration proof library, buying group maps, LinkedIn and event programs and pipeline reporting by health system. The healthtech programs are described on our healthtech industry page.
The account approach is on our ABM services page.
For the UAE market, see our UAE page, and for the Kingdom, our Saudi Arabia page.
If you are planning a UAE or Saudi launch for a health product, talk to our team and we will build the proof library and account plan with you.
Frequently asked questions
Can health data be stored outside the UAE?
Federal Law No. 2 of 2019 restricts storing, processing, generating or transferring health data outside the UAE. A 2021 ministerial resolution set out 10 circumstances where transfers may be allowed, such as telemedicine and certain wearables, some with conditions. Confirm your case with counsel.
Does health software need SFDA approval in Saudi Arabia?
If the digital health product qualifies as a medical device, SFDA guidance MDS-G27 says manufacturers shall comply with the Medical Devices Marketing Authorization requirements. Classification depends on the product's intended use.
How do vendors sell to Saudi public hospitals?
Centralized government procurement runs through NUPCO, which only accepts bids from prequalified companies, and foreign companies must register their medical products with the SFDA before prequalifying, according to the US International Trade Administration.
What is Malaffi?
Abu Dhabi's health information exchange platform, which links healthcare providers across the emirate. Its website lists more than 3,100 connected facilities, so integration is a common buyer question for Abu Dhabi health systems.
What marketing works for healthtech in the GCC?
Account-based programs for named hospital groups and health systems, a proof library covering data location, device status, integration and procurement, role-based LinkedIn targeting and events run as account programs.
Can we use patient stories in healthtech marketing in the Gulf?
Only with the provider's approval and the patient's consent, and only through the provider's own processes. Most B2B healthtech marketing is better served by operational outcomes and peer references from clinical and IT leaders.
Sources
- Al Tamimi & Company: The federal law regulating the use of ICT in the UAE healthcare sector (November 2019)
- Al Tamimi & Company: Regulated exemptions to restrictions on transferring health data outside the UAE (January 2022)
- Malaffi: Abu Dhabi Health Information Exchange
- Saudi Food and Drug Authority: Guidance on Digital Health Products, MDS-G27 (August 11, 2025)
- US International Trade Administration: Saudi Arabia Country Commercial Guide, healthcare (May 11, 2026)
Related service: Account-based marketing. See also pricing and client results.
We run enterprise B2B demand generation for teams in Montreal, Toronto, Ottawa and the United States.
