Healthcare Software Development in Qatar: An Engineering Guide
Qatar's health system is centrally planned, already digitised and investing in AI. Here is what a software team has to design for before writing the first line of code.
Qatar is a distinctive place to build healthcare software. The system is largely public and centrally planned, the main providers already share a clinical record, and the country has in-country hyperscale cloud. Privacy law also treats health data as a special category that needs regulator permission before you process it. If you plan for these facts, delivery goes smoothly. If you discover them halfway through, they stall the project.
This guide summarises research our team did into the Qatari digital-health landscape and what it means for engineering decisions. We run an office in Doha, and this is the checklist we use. It is engineering guidance, not legal advice. For the full picture across all three of our markets, see our healthcare specialization.
The strategic context: Health for All 2024–2030
The Ministry of Public Health's third National Health Strategy 2024–2030, titled 'Health for All', has three pillars: improved population health and wellbeing, excellence in service delivery and patient experience, and health-system efficiency and resilience. Each pillar points to a type of software:
- Population health: prevention, chronic-condition and engagement programmes that run continuously, not only at visits.
- Service delivery and patient experience: patient portals, booking, remote follow-up and bilingual Arabic/English apps that patients actually use.
- Efficiency and resilience: integration, analytics and automation that reduce manual work between institutions.
Commentary in the local press has also linked the strategy to expected growth in the medical-devices and digital-health devices sector. For product teams, that suggests demand for connected devices and the software around them.
An already-digitised system: integrate, don't duplicate
Hamad Medical Corporation runs Oracle Cerner as its clinical information system. According to HMC, the system has supported integrated care across the public sector since 2012, links to Primary Health Care Corporation facilities, and was integrated with Qatar Biobank in 2023. A new product therefore rarely starts on a blank page. Usually it has to fit around an established system of record.
In practice we scope integration in discovery. We work out which system owns each piece of data, what interfaces exist, which party approves access, and what the new product must never store itself. Our default is HL7 FHIR resources for any new interfaces, with clear mapping documentation wherever older formats are involved.
PDPPL: health data is 'special nature' data
Qatar's Personal Data Privacy Protection Law, Law No. 13 of 2016, is administered by the National Cyber Security Agency. Health data is 'personal data of a special nature', and processing it requires prior permission from the regulator. The regulator's guidelines, summarised by Clyde & Co, add obligations that change how a project is planned:
- A data privacy impact assessment before new processing of special-nature data.
- Records of processing activities, kept up to date by trained staff.
- Privacy by design, embedded from the design stage through the product lifecycle.
- Breach notification within 72 hours to the regulator and affected individuals.
- Fines of up to QAR 5,000,000 for non-compliance.
The engineering consequence is simple. The data map, DPIA and permission application are work items on the delivery plan from week one. Consent capture, withdrawal, access, correction and erasure become product features with acceptance criteria, not text in a privacy policy.
Hosting health data in Qatar
In-country hosting is practical. Microsoft opened an Azure datacenter region in Qatar in 2022, and Google Cloud launched its Doha region in 2023. For health products we default to hosting production data, backups and logs in Qatar, and we document every flow that leaves the country, including email, push notifications, error tracking and AI model calls.
AI providers need particular care. If a feature calls a hosted model, check where inference runs, whether prompts are retained, and whether the data could be used for training. Where those answers are unclear, an open-weight model hosted in your own Qatari cloud account is often the cleaner option.
A realistic delivery sequence
Healthcare projects in Qatar rarely go wrong because of code. They go wrong because approvals, integrations and data decisions come up late. The sequence we use puts those items at the front:
- Weeks 1–2: discovery. Map users, workflows, systems of record and every category of personal data. Flag special-nature data and any cross-border flow.
- Weeks 2–4: privacy and integration groundwork. Draft the DPIA, prepare the permission application and agree interface access with each system owner.
- Build in thin slices. Ship one complete workflow end to end, including audit logging, consent and Arabic/English UI, before adding more scope.
- Shadow mode for any AI. Run models alongside clinicians on real cases and measure agreement before outputs reach users.
- Go-live with runbooks. Incident response, breach notification and access reviews are rehearsed before launch, not written afterwards.
Exact timings depend on the institution and the data involved. The order matters more than the dates: approvals and integration access are usually on the critical path, so they start first.
AI in Qatari healthcare: already in national programmes
AI is already in production in Qatar. Since June 2024, PHCC has used Lunit INSIGHT MMG in its Screen for Life breast-screening programme, where two radiologists read each mammogram with reference to the AI's results. That is the model we recommend for clinical AI: it supports a professional and does not replace one.
Research governance is also active. In late 2024 MOPH ran its National Health Research Ethics Workshop on AI in health research with the NCSA, Qatar University and HBKU. If an AI feature depends on research datasets, plan for ethics review alongside the privacy work. Our AI in healthcare service covers how we scope, evaluate and monitor these systems.
How we build healthcare software for Qatar
- Discovery with the data map first. Identify systems of record, data owners, special-nature data and every cross-border flow before estimating anything.
- In-country hosting by default, with encryption in transit and at rest, role-based access and an append-only audit log of every read and write of health records.
- Consent and rights as features. Granular consent, simple withdrawal, and self-service access and correction where the use case allows.
- Bilingual from day one. Arabic and English with full RTL support in web and mobile apps, tested with real users.
- Clinical AI with a human in the loop. Show sources and uncertainty, record overrides, and evaluate against local data before going live.
Our consumer health experience includes Ealthiness, a mobile fitness and wellbeing companion we designed and built end to end, covering guided exercises, live run tracking, mood graphs and activity insights. We have also done engineering for the US senior-care platform A Place For Mom. With a team in Doha, workshops and acceptance testing run in the local time zone. To discuss a project, contact us.
