Key points
- Kuwait's Central Statistical Bureau estimated 4,881,254 residents at the start of 2025, up from 4,385,717 at the 2021 census.1
- CITRA's Data Privacy Protection Regulation counts health information and any audio file of a person's voice as personal data.2
- A service provider notifies CITRA within 72 hours of learning of a personal data breach, and notifies the affected person within the same period.2
- CITRA's Data Classification Policy places medical records in the third tier, private sensitive data, which must be encrypted when transmitted between locations.3
- wai drafts in Arabic or English, a person at the clinic approves and sends, the doctor signs, and records stay in Kuwait.
Summary
A Kuwait City clinic can use AI for notes and the front desk in 2026 within CITRA's Data Privacy Protection Regulation, which covers health information and voice recordings. The doctor signs every note, a person at the clinic approves every message, breaches are reported within 72 hours and records stay in Kuwait.
Kuwait City clinics now answer an Arabic WhatsApp message the evening it arrives, and doctors leave with every note signed. wai drafts the replies and the notes, a person at the clinic approves or signs each one, and the records stay in Kuwait under CITRA's privacy and classification rules.
Part of the Kuwait MOH hub, with the framework explained, a readiness checklist and 7 guides.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee an evening Arabic WhatsApp enquiry from Salmiya drafted for your coordinator to approve, and a dermatologist's note written during the consult, in fifteen minutes.
| Body or rule | Requirement | What to ask | How wai meets it |
|---|---|---|---|
| CITRA Data Privacy Protection Regulation | Health information and voice recordings are personal data | How are consult recordings handled | Notes drafted for the doctor to sign, access limited by role |
| CITRA Data Privacy Protection Regulation | Tell people where data is stored and for how long | Which country holds every copy | Records hosted in Kuwait, set up with the clinic |
| CITRA Data Privacy Protection Regulation | CITRA and the person notified within 72 hours of a breach | Who sends each notice | Every message, draft and approval logged and exportable |
| CITRA Data Classification Policy | Medical records are tier three, encrypted in transit | Is data encrypted in transit and at rest | AES-256 at rest and TLS 1.3 in transit |
| Consent | Consent can be withdrawn at any time | How does a patient revoke access | Revocable permissions in the patient's wai Profile |
The private care market in Kuwait City
Kuwait's Central Statistical Bureau estimated the population at 4,881,254 at the start of 2025, against 4,385,717 counted in the 2021 general census.1 Kuwait City clinics serve Kuwaiti families alongside resident workers from many countries, and the Bureau publishes separate statistics for Kuwaiti and non-Kuwaiti workers in the public and private sectors.1
The rules a clinic in Kuwait City works under
The Communication and Information Technology Regulatory Authority, CITRA, was established under Law 37 of 2014.2 Its Data Privacy Protection Regulation applies to providers that operate a website, smart application or cloud computing service, or that collect or process personal data, in Kuwait.2 It defines personal data to include health information and any audio file including the person's voice, which covers the recording behind a scribed consult.2
The regulation requires a provider to tell people the storage period and storage location of their data, keep records of processing that name any country data is transferred to, and give round-the-clock contact with a data protection officer.2 After a breach, the provider notifies CITRA within 72 hours of learning of it and notifies the affected person within 72 hours as well.2 A person may withdraw consent at any time and ask for their data to be destroyed.2
CITRA's Data Classification Policy sets four tiers and lists medical records in the third, private sensitive data.3 Data in the third and fourth tiers must be encrypted when transmitted between locations, a rule the policy applies to the private sector as well as government.3
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. wai is compliant with these rules and built for clinics in Kuwait City. Records are encrypted at rest and in transit, access is limited by role in the database, and every message, draft, approval and signature sits in a log the clinic can export.
The languages Kuwait City patients write in
Arabic leads at the front desk, with English alongside it for much of the resident workforce. wai is built for Arabic-first care and works in any language.45
A patient can answer intake questions by voice in Arabic, and the doctor reads the answers in English before the visit.5 Each reply is drafted in the language and register the patient used, and a person at the clinic approves it before it is sent.
What a demo shows in Kuwait City
A WhatsApp message in Kuwaiti Arabic arrives at 9:40pm from a woman in Salmiya asking whether the dermatologist in Sharq can see her before her sister's wedding next week. wai keeps it in her thread, reads the doctor's busy times from Google Calendar, Outlook or Apple Calendar, and drafts an Arabic reply with the two earliest open slots. The coordinator approves it that evening.
A missed call during a procedure becomes a drafted text in the same thread. In the consult the scribe drafts the note, the dermatologist edits and signs it, and the invoice and any insurer's claim are prepared from the signed note for the team to check. The patient gets a wai Profile for her letters and results, with permissions she can revoke.
For health systems, government and insurers in Kuwait
Hospital groups, insurers and public programmes can commission a system built on wai for one defined care pathway, with records hosted in Kuwait, Arabic-first patient messaging, and data, configuration and model rights written into the contract. See wai for organisations.
Where to start
First, add a line to intake in Arabic and English telling patients the scribe records the consult and the doctor signs the note, using the consent form template. Second, write the 72-hour breach routine and name the clinic's data protection contact.2
Third, classify the clinic's data against CITRA's four tiers, with medical records in the third.3 Fourth, count last month's enquiries by channel, language and hour, then book a Kuwait City demo and bring that count.
Bring a week of Kuwait City enquiries, Arabic messages included, and see the drafts your coordinator would approve.
Frequently asked questions
Which privacy rules apply to clinic software in Kuwait?
CITRA's Data Privacy Protection Regulation applies to providers that run websites, apps or cloud services, or process personal data, in Kuwait, and it counts health information as personal data.2
How fast must a breach be reported in Kuwait?
Within 72 hours of learning of it, to CITRA and to the affected person.2
How does CITRA classify medical records?
As tier three, private sensitive data, which must be encrypted when transmitted between locations.3
Does wai work in Arabic?
Where are a Kuwait City clinic's records hosted?
In Kuwait. wai hosts each clinic's records in its own country, under that country's rules.
Who signs a note the scribe drafts?
The treating doctor. Every note stays a draft until the doctor reviews, edits and signs it.
Sources
- 1Central Statistical Bureau, State of Kuwait, 2026Central Statistical Bureau, home page, population estimate at the start of 2025 and General Census 2021 (Arabic)Read 15 October 2026Read source
- 2Communication and Information Technology Regulatory Authority (CITRA)Data Privacy Protection Regulation, version 1.8Read 15 October 2026Read source
- 3Communication and Information Technology Regulatory Authority (CITRA), 2026Data Classification PolicyRead 15 October 2026Read source
- 4wai, 2026wai changelog, intake answered by voice in any languageRead 15 October 2026Read source
- 5wai, 2026wai changelog, intake answered by voice in any languageRead 15 October 2026Read source
Every Kuwait City enquiry answered in Arabic the evening it arrives, every note signed before the doctor drives home.
Fifteen minutes with a clinician who uses wai daily, on your own enquiries and consults. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits