Data Protection Impact Assessment (DPIA) — Sehtak Platform

Prepared under: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), Article 21 Controller: Sehtak Health Technologies LLC (DHCC registration pending) Assessor: [DPO — to be appointed] Version: 1.0 (Draft — pending DPO sign-off) Date: [Effective on platform launch] Review cadence: Annual, or whenever a material processing change occurs

Why a DPIA Is Required

PDPL Article 21 requires a DPIA when processing is likely to result in a high risk to individuals, particularly when it involves:

• Sensitive personal data at scale (Art. 15) — Sehtak handles clinical records on a national scale.
• Automated decision-making or profiling — Sehtak uses an LLM to draft clinical notes.
• Cross-border transfers — not performed for PHI, but assessed to confirm that.
• Systematic monitoring — applicable to telehealth recordings and audit logs.

All five criteria apply to the Sehtak platform. This DPIA assesses the five highest-risk flows.

1. Description of the Processing

Sehtak is a UAE-first healthcare operating system connecting clinics, pharmacies, diagnostic centres, and patients through eight application surfaces that share a common API and database. Core flows:

1. Patient registers (direct, or via UAE Pass SOP3 identity verification). 2. Patient books an appointment (via patient app, facility microsite, or WhatsApp). 3. Clinic staff check the patient in, run an insurance eligibility check, and open an encounter. 4. Doctor records vitals, diagnosis (ICD-10-CM), prescription (DDC + RxNorm), and orders. 5. Encounter is completed. This event fans out to:

6. Pharmacy dispenses against the e-prescription. 7. Invoice generation, payment via Tap Payments, payment link delivered via WhatsApp.

• HIE submission (NABIDH for Dubai, Malaffi for Abu Dhabi, Riayati for Northern Emirates) via asynchronous BullMQ queues.
• Insurance eClaim submission (DHPO eClaimLink for Dubai, Shafafiya for Abu Dhabi) via a separate queue.
• Patient notification (WhatsApp first).

Data subjects are patients, their family members linked under a guardian, clinical and administrative staff, and facility owners.

Data categories include account identifiers, Emirates ID, clinical records (diagnoses, medications, vitals, lab results, imaging reports, allergies, immunisations), insurance policy and claim data, and payment metadata. See docs/compliance/privacy-policy.md §3.

All PHI processing occurs on UAE-resident infrastructure in AWS me-central-1. See CLAUDE.md §17.

2. Necessity and Proportionality

2.1 Is each processing purpose necessary?

2.2 Data minimisation

• Sehtak stores only codes and structured fields that are needed for the clinical, regulatory, or billing purpose. Free-text narrative is retained when the doctor records it — this is within the scope of provision of healthcare services.
• AI scribe transcripts are purged at 30 days — the minimum that allows quality review.
• HIE payloads and eClaim XML are purged from the in-transit cache at 24 hours.
• IP addresses on audit logs are truncated when no longer needed for security investigation.

2.3 Proportionality

Processing scale is proportionate to the public-interest purpose (providing healthcare). Alternatives considered:

• Federated storage without a central database: rejected — breaks eClaims submission and HIE interoperability.
• Patient-held health records only: rejected — does not meet the clinical or regulatory workflow needs of facilities.
• Third-party cloud LLM for scribing: rejected — see §4.1 (breaches Federal Law No. 2 of 2019).

3. High-Risk Flows — Individual Assessments

Likelihood: 1 Rare / 2 Unlikely / 3 Possible / 4 Likely / 5 Almost certain Severity: 1 Negligible / 2 Minor / 3 Moderate / 4 Major / 5 Catastrophic Risk = L × S (max 25). Mitigated risk is after the controls in CLAUDE.md are applied.

3.1 AI ambient scribe (clinical audio)

Description. A microphone captures the doctor-patient conversation; expo-audio (mobile) or the Web Audio API (web) streams chunks to the API. The API posts them to the self-hosted Whisper large-v3 service on EC2 g5.xlarge (me-central-1) which returns a rolling transcript. When the doctor requests a SOAP note, the transcript is de-identified and sent to the self-hosted Qwen 2.5 72B Instruct AWQ LLM on EC2 g5.12xlarge (me-central-1). The SOAP draft is returned, the doctor reviews and edits, and the encounter is saved.

Residual risk — acceptable given that every SOAP note is human-reviewed before acceptance and no open-source model has strong Arabic medical benchmark performance as of 2026.

3.2 NABIDH submissions (HL7 v2.5.1 with PHI)

Description. On encounter completion, a BullMQ job builds an HL7 v2.5.1 message (ADT^A01/A08, RDE^O11, ORU^R01, ORM^O01, VXU^V04, or MDM^T02) and POSTs it over HTTPS to the DHA NABIDH endpoint, authenticated by the Sheryan Facility ID in MSH-4. See CLAUDE.md §7.

3.3 DHPO eClaims (XML with Emirates ID and diagnoses)

Description. On encounter completion, a second BullMQ job generates a DHPO claim XML containing the Emirates ID (mandatory), ICD-10-CM diagnoses, and CPT/HCPCS/DDC activities, and posts it over SOAP to the DHA eClaimLink endpoint. DDC is synced twice weekly from DHA. See CLAUDE.md §10.

3.4 Facility microsites (patient booking form)

Description. Each facility has a public subdomain at [slug].sehtak.ae (or a custom CNAME) that exposes an unauthenticated booking form. A patient enters name, phone, Emirates ID (optional), reason for visit, and a preferred slot. The form creates an appointment with channel = FACILITY_SITE and sends a WhatsApp confirmation.

3.5 Telehealth recordings

Description. Daily.co hosts the video session. When the patient consents, the session is recorded. The recording URL is stored in video_sessions.recording_url.

4. Why Self-Hosted Qwen 2.5 72B on EC2 me-central-1 Is the Only Compliant Choice

This is the most frequently challenged design decision. This section records the legal and technical analysis.

4.1 The legal constraint

Federal Law No. 2 of 2019 on the Use of ICT in the Areas of Health, Article 13, prohibits the transfer of health data outside the UAE without Ministry of Health authorisation. UAE law does not recognise a HIPAA-style de-identification safe harbour: even de-identified clinical text (symptoms, diagnoses, treatment plans with no direct identifiers) falls within the Law's scope because it describes a patient's health.

PDPL Article 22 adds a second gate: personal data may only cross borders if the receiving jurisdiction provides an adequate level of protection or an appropriate safeguard is in place. Both conditions must be satisfied; the 2019 Health Law does not yield to PDPL adequacy findings.

4.2 What was ruled out

4.3 What was chosen

• Qwen 2.5 72B Instruct AWQ — Arabic is officially listed in the Qwen 2.5 model card among 29+ supported languages.
• vLLM on EC2 g5.12xlarge (4× NVIDIA A10G, 96 GB VRAM) in me-central-1, inside a private VPC.
• Whisper large-v3 via faster-whisper on EC2 g5.xlarge (1× A10G, 24 GB VRAM) in me-central-1, same VPC.
• Endpoints exposed only on internal VPC DNS (llm.internal:8000, whisper.internal:8080). No public routes, no NAT egress on these subnets.
• Weights loaded from S3 me-central-1 into GPU memory at startup.

4.4 Residual legal risk

Low. The processing is end-to-end inside UAE infrastructure. De-identification in packages/ai/src/deidentify.ts runs before every LLM call as a belt-and-braces safeguard. Every AI output is reviewed by a licensed clinician.

5. Risks Identified Beyond the Five Flows

These are noted for completeness and tracked in the risk register, not expanded into full assessments in v1 of this DPIA.

• Family link abuse — a guardian retains access after the minor becomes an adult. Mitigation: family links auto-review on 18th birthday; guardian prompted to reconfirm or revoke.
• Staff off-boarding — a former doctor retains access. Mitigation: facility_staff_links.endDate gate; nightly job revokes expired sessions.
• Desktop app local cache — a Tauri install on a shared workstation leaks patient list. Mitigation: OS-user-scoped encrypted SQLite; auto-lock on 15 min idle; wipe on logout.
• Push token hijack — pushing notification to an old device. Mitigation: devices.lastSeenAt tracked; tokens expire at 90 days inactive.
• Insurance eligibility cache poisoning — Mitigation: eligibility results keyed by (patient, insurance, facility, day) and signed by DHPO response hash.

6. Consultation

The following stakeholders must review and sign off on this DPIA before the platform goes live:

Patient representatives will be consulted through a usability study during Phase 2 (see CLAUDE.md §24).

7. Review Cadence

• Annual review by the DPO, recorded in a new version of this document.
• Ad-hoc review whenever any of the following occurs:
• A new data category is introduced.
• A new processor is engaged.
• A new inference model is deployed.
• A regulatory change (new DHA circular, MOHAP directive, DOH ADHICS update, PDPL amendment).
• A material security incident (high or critical severity, per incident_reports.severity).

8. Sign-Off

This DPIA is a draft and is not yet approved. It will be finalised and signed before the first patient is onboarded.