Key points
- Residency rules differ by country. The UK and Singapore allow transfers abroad with safeguards, the US allows offshore storage under a business associate agreement, and the UAE keeps health data inside the country by default.
- UAE Federal Law No. 2 of 2019 bars storing or processing health data from UAE services outside the State except in cases set by decision, with fines of AED 500,000 to 700,000 for breach.4
- The UAE law sets a retention floor of 25 years after the last health procedure, while UK GDPR and Singapore's PDPA require data to be kept no longer than needed.426
- Get the storage country, the subprocessor list and the deletion terms in writing before any patient data moves.
- wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.7
Summary
Store patient data where the clinic's own law allows, keep it as long as that law and medical record rules require, then delete it. Ask every AI vendor for the storage country in the contract, the subprocessors and where they sit, how transfers abroad are covered, and what happens to the data on exit.
Your patient records sit where your law expects them, and every regulator's question already has a written answer in the contract. The UK, the US, the UAE and Singapore show the range a private clinic may meet, on where data may sit and how long it must or may be kept.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee where your clinic's records would be hosted, who processes them and how export works, in fifteen minutes with a clinician who uses wai daily.
| Jurisdiction | Where data may sit | How long it is kept | Question for the vendor |
|---|---|---|---|
| United Kingdom, UK GDPR | Abroad only under adequacy regulations, safeguards with a transfer risk assessment, or an exception | No longer than necessary, set out in a retention schedule | Which subprocessors are outside the UK, and which mechanism covers each |
| United States, HIPAA | Onshore or offshore under a business associate agreement, with location weighed in the risk analysis | Return or destroy at termination where feasible | When is the BAA signed, and where are the servers |
| United Arab Emirates, Federal Law No. 2 of 2019 | Inside the State, except cases set by decision of the health authority with the Ministry | At least 25 years from the last health procedure | Is all storage and processing inside the UAE, including AI processing |
| Singapore, PDPA | Abroad only with protection comparable to the PDPA | Until the purpose and legal or business need end | How is comparable protection ensured for each overseas recipient |
United Kingdom, transfers with safeguards
UK GDPR controls restricted transfers, which the ICO describes as sending personal information to a separate organisation outside the UK, and leaves storage abroad open where a transfer is covered. Every restricted transfer must be covered by UK adequacy regulations, appropriate safeguards or an exception.1
Where there are no adequacy regulations, the clinic or its vendor uses a safeguard such as the International Data Transfer Agreement and completes a transfer risk assessment, to make sure protection is not materially lower after the transfer.1 For an AI vendor, ask which subprocessors sit outside the UK and which mechanism covers each.
Article 5(1)(e) requires personal data to be kept no longer than necessary for its purpose, and the ICO recommends a retention schedule listing each type of record, its use and how long it is kept.2 Professional record-keeping rules for clinicians set the actual periods, and the vendor's contract should follow the clinic's schedule.
United States, location is a risk question
The HIPAA rules allow a covered entity to use a cloud provider that stores electronic protected health information on servers outside the United States, provided a business associate agreement is in place and the other HIPAA requirements are met.3 HHS adds that the risks to such data may vary greatly with its geographic location, and that the clinic's risk analysis should take that into account.3
A provider that stores only encrypted data without the key is still a business associate, and the agreement must require the provider to return or destroy the information at termination where feasible.3 State law can add requirements, so check the clinic's own state as well.
United Arab Emirates, health data stays in the country
Article 13 of UAE Federal Law No. 2 of 2019, on the use of information and communication technology in health fields, provides that health information and data related to health services provided in the State may not be stored, processed, generated or transferred outside the State, except in cases defined by decision of the health authority in coordination with the Ministry.4 Article 24 sets fines of AED 500,000 to AED 700,000 for breach.4
Article 20 requires health information to be kept for a period commensurate with the need, and no less than 25 years from the date of the last health procedure.4 Implementing regulations and emirate health authorities add detail, so read your own emirate health authority's rules too. More in our guide to UAE data residency for AI scribes.
Singapore, comparable protection abroad
Section 26 of Singapore's Personal Data Protection Act provides that an organisation must not transfer personal data outside Singapore except in line with prescribed requirements that ensure a standard of protection comparable to the Act.5
Section 25 requires an organisation to stop retaining personal data, or anonymise it, once the purpose is no longer served and retention is no longer necessary for legal or business purposes.6 Medical record rules set the legal minimum, and the vendor should delete on the clinic's schedule after that.
How wai hosts clinic records
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. Every subprocessor is named with what it does and the agreement in place, with thirty days notice before anything changes, and every access to a record is logged.7
Where to start
List the countries where the clinic sees patients and the retention period for each type of record. Then ask every shortlisted vendor for the storage and processing country for each record type, the subprocessors with their locations and transfer mechanisms, and the export and deletion terms at exit.
Put the answers into the contract and file them with the rest of the procurement checklist. This page is general information on the law as read on 14 October 2026, and the clinic's own adviser should confirm how it applies.
Name the countries you see patients in and see where your records would be hosted.
Frequently asked questions
Does UK law require patient data to stay in the UK?
No. It requires every restricted transfer abroad to be covered by adequacy regulations, appropriate safeguards or an exception.1
Can a US clinic use a vendor with servers outside the US?
HIPAA allows it with a business associate agreement in place, and HHS notes the risks can vary with location, so the clinic's risk analysis should cover it.3
Can health data from a UAE clinic be processed abroad?
Not by default. Article 13 of Federal Law No. 2 of 2019 keeps it inside the State except in cases set by decision of the health authority with the Ministry.4
How long must a clinic keep records?
Where does wai host clinic records?
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.7
What happens to our data if we leave?
Ask for full export first, then deletion on a stated date. In the US, the business associate agreement must require return or destruction at termination where feasible.3
Sources
- 1Information Commissioner's Office, 2026A brief guide to international transfersRead 14 October 2026Read source
- 2Information Commissioner's OfficePrinciple (e), storage limitationRead 14 October 2026Read source
- 3US Department of Health and Human Services, Office for Civil Rights, 2022Guidance on HIPAA and cloud computingRead 14 October 2026Read source
- 4UAE Ministry of Justice, 2019Federal Law No. 2 of 2019 on the use of information and communication technology in health fieldsRead 14 October 2026Read source
- 5Singapore Statutes Online, Attorney-General's Chambers, 2012Personal Data Protection Act 2012, section 26, transfer of personal data outside SingaporeRead 14 October 2026Read source
- 6Singapore Statutes Online, Attorney-General's Chambers, 2012Personal Data Protection Act 2012, section 25, retention of personal dataRead 14 October 2026Read source
- 7wai, 2026Security at waiRead 14 October 2026Read source
Your records in your own country, with every answer on file.
Fifteen minutes on where your data would sit and how you take it with you. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits