Can patient data be stored in the Bitrix24 cloud?

We do not keep health data in cloud Bitrix24 records. Under Article 13 of UAE Federal Law No. 2 of 2019, health information and data related to health services provided in the UAE may not be stored or processed outside the country except in cases set by the health authority in coordination with the ministry, and according to Bitrix24, bitrix24.ae cloud accounts are hosted in Frankfurt. So diagnoses, test results and photos stay in the clinic's medical system. The law does not split data into admin and clinical, so whether even bookings and payments can be kept in the cloud is for the clinic's lawyer to decide. If not, or if the clinical side is needed in the CRM, we install on-premise Bitrix24 on a server in the UAE.

Can we send WhatsApp broadcasts to patients?

Yes, to people who gave you their number and agreed to receive messages, and a request to stop must be honoured: that is what WhatsApp rules require. DHA-licensed clinics must write the texts under the DHA standards for medical advertising on social media, where WhatsApp counts as social media too: no "the best", "100%", "no side effects" or "immediate results", and posts that name the clinic are approved by the medical director. Cabinet Resolution No. 56 of 2024 (Article 1) treats marketing text messages and marketing messages through social media apps as telemarketing, just like calls.

Bitrix24 · clinics and beauty salons in Dubai

Bitrix24 for clinics and beauty salons in Dubai

Q: How does Bitrix24 help with no-shows?

Bitrix24 Booking sends the client WhatsApp messages: the booking details, a request to confirm the visit via a link (one day ahead by default), a reminder on the day and a message if the client is running late. Unconfirmed bookings are highlighted, the receptionist gets an activity, and a freed slot can go to a client on the waitlist. For services with a repeat cycle, automation rules remind clients about the next visit if they agreed to such messages.

We build the CRM around how people in Dubai book a doctor or a stylist: enquiries from the website, WhatsApp, social media and the phone land in one schedule, confirmations and reminders go out to the client automatically, and repeat visits are planned in the CRM rather than left to the receptionist's memory. Clinical records stay in the clinic's medical system, while client consents for messages, calls and photos are kept in the client record

1 daybefore the visit the client gets a WhatsApp request to confirm the booking: this is the Bitrix24 Booking default

25 yearsis the minimum retention period for health data after the last procedure under UAE law

9am-6pmare the only hours for marketing calls under UAE telemarketing rules

from 10,000AED standard CRM setup

Where clinics and salons lose clients

Four places where a booking turns into an empty slot in the schedule or into a risk for the clinic

Booked but did not show up

The receptionist cannot always call everyone the day before, and a freed slot is rarely offered to anyone else in time. The doctor or stylist waits and the room stands empty

Bookings in five places

The phone, the receptionist's WhatsApp, social media messages, the website form and the paper diary at reception. Two clients end up booked for the same time, and a message that arrived at night cannot be found in the morning

Clients on a personal phone

A stylist or coordinator handles clients through their personal WhatsApp. When they move to another salon, the regular clients go with them

Health data in chats

A patient sends scans and test results over WhatsApp, and the receptionist forwards them to the doctor in a personal chat. The data ends up outside the medical system, while the clinic is responsible by law for keeping it confidential

What we build in Bitrix24

A schedule for doctors and stylists

Doctors, stylists, rooms and devices are set up in Bitrix24 Booking as resources, each with its own working hours and appointment length. A doctor and a room, or a stylist and a device, are booked together, and every receptionist sees at once which time is taken

Booking from the website and social media

There are three types of booking form: the earliest available time, all free slots on a chosen day, or a choice of specialist. The form goes on the website, into social media posts and into messenger chats, and the booking lands in the CRM straight away

Confirmations and reminders

The client gets WhatsApp messages: the booking details, a request to confirm the visit via a link (one day ahead by default), a reminder on the day and a message if they are running late. Unconfirmed bookings are highlighted, the receptionist gets an activity, and a freed slot can be offered to clients on the waitlist

Every enquiry in one record

Messages from WhatsApp (via the official API) and social media, calls and website forms arrive in Bitrix24 and are routed by branch, language or service line. Conversations run from the clinic or salon number, not from an employee's personal phone

Repeat visits

For services with a clear cycle, such as a follow-up, a touch-up, colouring or a facial, an automation rule sets the date of the next visit: the client gets a reminder if they agreed to such messages, and the receptionist gets a task. Clients who have not come in for a long time show up as a separate list

Services, payments and revenue

Services from Booking appear in the CRM product catalogue automatically, and the price and discount from the deal show up in the booking. The statistics show revenue by specialist and room, and treatment packages are tracked with the number of visits left

What lives in the CRM and what stays in the medical system

Bitrix24 does not replace the clinic's electronic medical record (EMR) system. We split the data so that the receptionist sees everything needed for booking, and medical information stays in the system built for it

In Bitrix24

Name, phone, language, branch, specialist, date and time of the visit, enquiry source, payments, consents for messages and calls, chats about the booking

admin data

In the medical system

Complaints, diagnoses, prescriptions, test results, scans, before-and-after photos, consent to treatment. In Dubai, clinics exchange health data through NABIDH, the DHA health information exchange

clinical data

UAE Federal Law No. 2 of 2019 on the use of ICT in health fields bars storing, processing, generating or transferring outside the UAE any health information and data related to health services provided in the country, except in cases defined by a health authority decision issued in coordination with the ministry (Article 13). According to Bitrix24, bitrix24.ae cloud accounts are hosted in AWS data centres in Frankfurt
The law does not split data into admin and clinical, so where the CRM is hosted is decided together with the clinic's lawyer. We do not set up fields for diagnoses, test results or photos in cloud Bitrix24. Scans a patient sends over WhatsApp are kept in the chat history, so how to handle them is also agreed with the lawyer. If the lawyer treats booking data as health data too, or if the clinical side is needed in the CRM, we install on-premise Bitrix24 on your server in the UAE: the Booking module is available on-premise too
Health data is kept for at least 25 years from the date of the last procedure (Article 20). If it gets into the CRM, that period has to be taken into account for the CRM as well
Under the definition in Article 1 of the law, health information can be audible too, and on the phone patients often tell the receptionist how they feel. Where call recordings are stored (in the cloud, on the PBX or on a server in the UAE) is decided before telephony is connected. Telephony in the UAE
Patient information must be kept confidential and may not be used for non-health purposes without the patient's written approval, except in cases set by the law, such as an insurer audit or a request from the judicial authorities or the health authority (Article 16)
The personal data protection law (Federal Decree-Law No. 45 of 2021, Article 2) does not apply to health data that has its own legislation. Health data in a clinic is governed by Law No. 2 of 2019, while the client base of a beauty salon falls under the personal data law, unless the salon is in a free zone with its own data protection law
Clinics in Dubai Healthcare City also follow the DHCC Health Data Protection Regulation No. 7 of 2013: health data may leave DHCC only for a jurisdiction with an adequate level of protection, and only with the patient's authorisation or when it is needed for their care (Section 67)

Consents kept in the client record

Every consent is stored with its date, channel and term, and lists for broadcasts and marketing calls are built only from clients who gave consent and have not withdrawn it

WhatsApp messages

Under WhatsApp rules, a business may message people who gave it their number and agreed to receive messages, and a request to stop must be honoured whatever channel it comes through. The record shows what the consent covers: visit reminders only, or news and offers as well

WhatsApp Business Policy

Marketing calls and messages

Marketing calls are allowed from 9am to 6pm (Article 5), only from numbers registered to the company and never to numbers on the DNCR (Article 4). A client who says no on the first call is not called again; one who does not answer is called back no more than once a day and twice a week. Marketing text messages and marketing messages through social media apps count as telemarketing too (Article 1)

Cabinet Resolution No. 56 of 2024

Photos, videos and reviews in ads

A patient's image or words may be used in an ad only with their written consent for a specific purpose and period, and for patients under 18 a parent gives separate consent. The record holds the date, purpose and term of the consent, and an automation rule reminds you when it expires and the post should come down

DHA standards 2026

Disclosure of health information

We note whom the patient has allowed in writing to receive information about them, such as a relative or an employer. Consent to treatment stays in the medical records, and we do not duplicate it in the CRM

Law No. 2 of 2019, Article 16

Ads and broadcasts without medical promises

The DHA standards for medical advertising on social media (circular CIR-2026-00000144 of 17 August 2026) cover private clinics and professionals licensed by the DHA, and WhatsApp counts as social media there too. The same rules apply to influencers who promote the clinic's services

Absolute and exaggerated claims are banned: "the best", "the only", "the safest", "unique", "100%", "guaranteed success", "no side effects", "immediate results", "miracle". Ads must not frighten people, play on anxiety or claim that a service is better or safer than anyone else's. The risks of a procedure have to be stated plainly
Before-and-after photos: the same person, the same lens, no editing, and a note that results vary from person to person
A post that names the clinic is approved in advance by the medical director. In Bitrix24 the approval runs as a workflow: the marketer drafts the broadcast, the director approves it, and the approved version and date stay in the history
Reminders that the clinic sends from its own number through the WhatsApp Business Platform go out as utility templates with no promotion. Add an offer to a reminder and Meta treats the template as marketing, so offers go out separately and only to clients who agreed to receive news and offers
WhatsApp rules forbid using it for telemedicine or to send or request health information if applicable regulations prohibit passing such information to systems that do not meet heightened requirements for handling it. So clinic messages carry only the date, time, branch and specialist name, with no diagnoses, test results or procedure names. The built-in Booking messages include the resource name, so rooms and devices in the schedule get neutral names
The WhatsApp and telemarketing rules are the same for a clinic and a beauty salon

An AI agent on the front line

At night and at weekends an AI agent answers messages: it offers free times from the Bitrix24 schedule, books the client in and answers questions about prices, the address and parking. We set it up so that it does not advise on or ask about symptoms and treatment, and passes such questions straight to the receptionist. More on the AI agents page

How the rollout goes

Review

We look at where bookings come from, how visits are confirmed, where health data sits today and which consents you collect

Schedule and booking

We set up specialists, rooms and devices, the booking forms and the messages to clients

Channels and integrations

We connect WhatsApp, social media, telephony and the website, and integrate Bitrix24 with the medical system if it has an API

Launch

We train receptionists, doctors and stylists, stay on support and refine the system as you go

How much it costs

Standard Bitrix24 CRM setup starts from AED 10,000, and the quote is fixed in dirhams after the review, before the work starts. In the Bitrix24 cloud, Booking is part of the Professional plan and above; the Bitrix24 licence and WhatsApp messages are paid separately. Integration with the medical system is quoted after the review, and after launch we maintain the system under support packages from AED 1,250 a month

Experience: bookings, reminders and repeat visits

For the HAVAL car dealership network our AI agents book clients into the service centre and remind them about scheduled maintenance and add-on services. For Apartico, a rental business with more than a thousand properties, an AI agent gives the first reply to enquiries, qualifies them and helps the manager with booking, confirmation and feedback after check-in. Both projects are in Russia and in other industries, but the mechanics of booking, reminders and repeat visits are the same. HAVAL case · Apartico case

This is not legal advice. The rules come from UAE Federal Law No. 2 of 2019 on the use of ICT in health fields (Articles 1, 4, 13, 16 and 20), Federal Decree-Law No. 45 of 2021 on personal data protection (Article 2), Cabinet Resolution No. 56 of 2024 on telemarketing (Articles 1, 4 and 5), DHCC Health Data Protection Regulation No. 7 of 2013 (Section 67) and the DHA standards for medical advertising on social media (circular CIR-2026-00000144 of 17 August 2026). Hosting locations are taken from the Bitrix24 GDPR page, Booking features from the Bitrix24 helpdesk and pricing page, and WhatsApp rules from the WhatsApp Business Policy and Meta documentation as of October 2026. Decide with the clinic's lawyer what to keep in the CRM and how to collect consents