Afiyah · Policy notice · 29 October 2026
HIPAA and healthcare partners.
Clear legal roles and service-specific safeguards matter more than a badge. HIPAA applies when the actual relationship and processing bring it into scope.
Finding your country preference…
Applicability and roles
HIPAA applies to US covered entities and their business associates. A consumer health app is not automatically covered because it holds health information. Before Afiyah processes protected health information for a covered entity, establish the permitted role, business associate agreement where required, subcontractor terms and responsibilities for safeguards, rights and incidents.
Service and vendor boundaries
Public chat, marketing analytics, enquiry forms and lead CRM are not channels for protected health information. An approved provider account is not enough: the exact service, configuration, permitted use, contract, access, retention and onward processing need assessment. A required Notice of Privacy Practices must identify the responsible covered entity and actual service.
Safeguards and evidence
Applicable Privacy, Security and Breach Notification obligations require documented risk analysis, appropriate controls, staff responsibilities and a tested incident process for the arrangement. Policies, encryption and a signed agreement alone do not prove compliance. Afiyah does not claim HIPAA certification or a completed independent HIPAA audit through this page.
Health records and statutory retention
Clinical records follow the law applicable to the service and the responsible healthcare organization. For health information within the scope of UAE Federal Law No. 2 of 2019 on ICT in health fields, Article 20 provides a minimum of 25 years from the last health procedure. This is not a blanket period for every website enquiry or ordinary wellbeing entry. HIPAA does not itself set a universal medical-record retention period; its documentation requirements are a separate category. A provider may need to retain its original record independently of an Afiyah account deletion.
Other laws still apply
HIPAA does not replace GCC health-data and privacy requirements. US consumer health processing outside HIPAA may still be subject to FTC and state requirements, including health-breach notification where applicable. EU or UK rights arise where their territorial rules apply, not merely because someone can open the website. Each service needs its own applicability assessment.
Questions and complaints
Contact privacy@getafiyah.com for privacy, permissions, deletion or security concerns, and contact@getafiyah.com for service complaints. Include a brief description and a safe reference; do not attach health records, identity documents, passwords or card details to an initial email. We verify identity and authority before releasing or changing personal data. You may complain to the competent regulator or court without first giving up any statutory right.