Regional data-protection resource
One practical starting point for dental clinics evaluating Teliyadu OralOS across different legal and operational environments. It brings the existing HIPAA, Ethiopia, Kenya, Uganda, Tanzania, and Rwanda resources together and adds selected official frameworks from other African and Middle Eastern markets.
Last reviewed 21 July 2026 · English source edition
Africa and the Middle East are not single legal markets. Countries can differ on health-data classification, patient consent, regulator registration, breach notification, record retention, government access, data localization, and cross-border transfers. Free zones and healthcare regulators can add another layer.
A law appearing in this guide does not mean Teliyadu OralOS is commercially launched, legally approved, locally hosted, integrated with public systems, or ready for patient data in that country. Those decisions require a market and deployment review.
The official links below are starting points. Clinics should verify the current law, implementing regulations, regulator decisions, healthcare rules, and authoritative language version with qualified local counsel.
Each clinic's tenant-owned records are separated in a dedicated PostgreSQL schema. This is a technical isolation control, not a country compliance certificate.
Clinic access is separated across the current Admin, Dentist, Receptionist, and Nurse roles. The clinic still has to assign and review access appropriately.
Patient-record reads and financial mutations are audit-logged. Local law and clinic policy determine how logs must be reviewed and retained.
The platform uses encrypted transport, encrypted AWS storage, and automated database backups. These safeguards are only part of a complete privacy and security program.
Production infrastructure is hosted in AWS eu-central-1 (Frankfurt). Teliyadu does not claim local hosting or local data residency in African or Middle Eastern countries.
Patient mobile identity is scoped to one clinic rather than shared across clinics. This does not remove a clinic's obligations for identity verification and patient rights.
A clinic normally controls why patient records are created and used, while a software provider may process data on its behalf. Those roles and instructions must be confirmed in the applicable contract; terminology and responsibility vary by country.
HIPAA is a United States framework; it is not an African or Middle Eastern regional law. It may still matter when a U.S. covered entity, business associate, patient-data flow, contract, or other regulated relationship is involved. HHS distinguishes covered entities from business associates and requires written business-associate arrangements in relevant relationships.
The Privacy Rule, Security Rule, and Breach Notification Rule address different parts of handling protected health information. Encryption, access controls, tenant isolation, backups, and audit trails can support a security program, but technical features alone do not establish HIPAA compliance.
The African Union Convention on Cyber Security and Personal Data Protection (often called the Malabo Convention) provides continental context. It does not replace each country's laws, ratification status, regulator rules, healthcare obligations, or transfer requirements.
Ethiopia
The Proclamation establishes a national framework for processing personal data, including sensitive personal data. A dental clinic should review its lawful basis, notices, patient-rights process, processor arrangements, security measures, retention, and any transfer of data outside Ethiopia.
Kenya
Kenya's framework regulates controllers and processors, gives individuals data rights, and treats health information as sensitive personal data. The Office of the Data Protection Commissioner publishes health-sector and registration guidance.
Uganda
Uganda's Act regulates the collection, processing, use, and disclosure of personal data and sets responsibilities for data collectors, processors, and controllers. The Personal Data Protection Office oversees the framework.
Tanzania
The Act establishes data-protection principles, rights, controller and processor duties, and the Personal Data Protection Commission. Its application across Mainland Tanzania and Zanzibar includes qualifications that need local interpretation.
Rwanda
Rwanda's law covers controllers and processors inside Rwanda and can also reach processing of data about people located in Rwanda. It expressly includes health status and medical records within sensitive personal data.
Nigeria
The Act created the Nigeria Data Protection Commission and regulates the processing of personal data. Clinics should treat patient records as high-risk information and examine the Act together with current Commission guidance.
Ghana
Ghana's Act is administered by the Data Protection Commission and establishes rules for organizations processing personal data and rights for individuals.
South Africa
POPIA sets conditions for lawful processing by public and private bodies and is overseen by South Africa's Information Regulator. Health information requires careful handling under the applicable special-personal-information rules.
Morocco
Law No. 09-08 regulates processing of personal data and established the CNDP. The CNDP publishes formalities for processing and transfers, and its primary materials are available in French and Arabic.
Egypt
Egypt has a national personal-data protection framework. Its current implementation, licensing, executive rules, and interaction with health-sector requirements should be checked at the time of deployment.
United Arab Emirates
The UAE has a federal personal-data law, separate health-information legislation, and distinct regimes in financial free zones such as DIFC and ADGM. The applicable rules depend on the clinic, license, location, data, and processing activity.
Saudi Arabia
Saudi Arabia's PDPL regulates personal-data processing, including sensitive data, and is supplemented by implementing and transfer regulations and official guidance from SDAIA.
Bahrain
Bahrain's law regulates personal-data processing and identifies health information as sensitive personal data. The Personal Data Protection Authority publishes the law and related decisions.
Oman
Oman's Personal Data Protection Law is supplemented by executive regulations issued under Ministerial Decision 34/2024. Both should be read together for a current deployment assessment.
Qatar
Qatar's law establishes a national personal-data privacy framework, with official guidance published for regulated entities and individuals. Sector-specific healthcare requirements may add obligations.
Jordan
Jordan's law took effect in 2024 and created a national framework administered through the Ministry of Digital Economy and Entrepreneurship's data-protection bodies.
This index ensures the expansion review does not stop at the countries summarized above. It is a planning scope, not a list of launched or supported countries. Markets without a detailed summary require fresh country-specific legal assessment before a deployment decision. Regional groupings are for navigation and may differ from other geographic conventions.
Algeria, Egypt, Libya, Morocco, Sudan, and Tunisia
Benin, Burkina Faso, Cabo Verde, Côte d'Ivoire, The Gambia, Ghana, Guinea, Guinea-Bissau, Liberia, Mali, Mauritania, Niger, Nigeria, Senegal, Sierra Leone, and Togo
Angola, Cameroon, Central African Republic, Chad, Democratic Republic of the Congo, Equatorial Guinea, Gabon, Republic of the Congo, and São Tomé and Príncipe
Burundi, Comoros, Djibouti, Eritrea, Ethiopia, Kenya, Madagascar, Malawi, Mauritius, Mozambique, Rwanda, Seychelles, Somalia, South Sudan, Tanzania, Uganda, Zambia, and Zimbabwe
Botswana, Eswatini, Lesotho, Namibia, and South Africa
Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the United Arab Emirates
Israel, Jordan, Lebanon, the Palestinian territories, and Syria
Egypt, Iran, Iraq, Turkey, and Yemen
Share the clinic country, legal entity, number of locations, intended users, patient-data categories, messaging and payment workflows, required integrations, retention needs, and any local-hosting requirement. Teliyadu can then confirm which product, contract, and configuration questions can be answered and which require local legal or regulatory advice.
Contact us to confirm market availability and configuration. A demo or discussion does not authorize processing patient data or establish compliance.
Discuss your market