Health technology contracts in Kuwait sit at the meeting point of medical regulation, data protection and commercial law. The primary statute is Law No. 70 of 2020 on the Practice of the Medical Profession and Allied Professions, Patients' Rights and Health Facilities, which licenses practitioners and private health facilities and, in Article 24, expressly permits remote medical services, home healthcare and artificial intelligence under Ministry of Health controls. Around it sit the Communication and Information Technology Regulatory Authority's Data Privacy Protection Regulation under Decision No. 26 of 2024 for CITRA-licensed service providers, its Cloud Computing Regulatory Framework, the cybersecurity regime of Decree No. 37 of 2022, and Law No. 20 of 2014 on electronic transactions. Whether the task is a patient-record platform, a telemedicine service or a clinical decision-support tool, the review starts from what the health statutes allow, what the data rules require, and who carries each obligation when something fails. This article sets out the framework we apply to healthtech contracts in Kuwait.
The regulatory map: health law, data rules and the contract
A healthtech deployment in Kuwait is regulated on two tracks at once. On the health track, Law No. 70 of 2020 governs who may practice medicine, how private health facilities are licensed, what rights patients hold, and how medical liability is assessed. On the data track, the Communication and Information Technology Regulatory Authority, known as CITRA, regulates personal data processing by its licensed service providers through its Data Privacy Protection Regulation, adopted by Decision No. 26 of 2024 issued on 7 February 2024, replacing the earlier regulation adopted by Decision No. 42 of 2021.
The contract is where the two tracks meet. A vendor hosting patient records, a platform routing telemedicine consultations, or an analytics tool reading clinical data touches regulated medical activity and regulated personal data at once. The review maps each obligation to the regime that enforces it: licensing to the Ministry of Health, data to CITRA's framework, professional questions to the Medical Liability Committee and the courts. A commercially elegant clause still fails if it assigns a duty to a party the regulation does not allow to perform it.
Who may provide the care: professional and facility licensing
Health services in Kuwait may be delivered only by licensed professionals through licensed facilities. Article 1 of Law No. 70 of 2020 defines a health facility as any place equipped to provide medical services or healthcare for diagnosis, treatment, prevention, health improvement or rehabilitation, and defines the owner of a private health facility as the natural or legal person licensed to establish, operate and manage it. Article 55 provides that no private health facility may be established, operated or managed, and no branch may be opened, without a license from the Health Licensing Department, and requires the facility to insure against risks arising from buildings, devices and medical equipment, covering patients, companions, staff and visitors.
Article 58 adds ownership conditions that matter to healthtech structuring: a private clinic or dispensary license requires a licensed Kuwaiti physician, limited to one clinic with no branch, and a hospital or health center license requires a licensed Kuwaiti practitioner or a legal person whose owner or partner is one. A technology company cannot treat the medical layer as a simple service purchase; the licensing architecture decides who must own and manage the clinical entity.
Telemedicine and artificial intelligence under Article 24
Article 24 of Law No. 70 of 2020 is the statutory door for healthtech. It permits the provision of medical services, home healthcare and remote healthcare, and it permits the use of artificial intelligence, advanced technologies, modern communications, digital means and electronic media, subject to the conditions and controls set by the Ministry of Health. Remote consultation, remote monitoring, AI-assisted triage and digital therapeutics all sit inside this permission, but the permission is conditional: the Ministry's conditions and controls govern how these services may actually be delivered.
For the contract, Article 24 has two consequences. First, the parties should verify which Ministry of Health conditions apply to the specific service model before signing, because the statute delegates the detailed rules to the Ministry and the detailed requirements can change as the Ministry issues new controls. Second, the contract should allocate responsibility for holding the professional licenses and facility license that the service requires, because a platform cannot practice medicine itself. The vendor supplies technology; a licensed facility and licensed practitioners supply the care. Contracts that blur that line create regulatory exposure for both sides.
Patient rights and the medical file
Chapter Four of Law No. 70 of 2020 sets out patient rights that a healthtech contract must respect rather than renegotiate. Article 26 gives the patient the right to comprehensive medical services and healthcare according to established medical principles, covering prevention, diagnosis, treatment, rehabilitation and guidance. Article 27 gives the patient the right to be informed honestly and accurately about everything relating to his or her health condition. Article 28 requires every patient to have a dedicated file at the health facility that provided treatment, consultation or care, documenting all information and data relating to the patient and the health condition, including procedures, tests, results, diagnoses, treatments, follow-ups and devices implanted or used.
Article 28 also gives the patient, or the patient's legal representative, the right to request a detailed or summary medical report from the treating physician or the person the facility assigns. A records platform contract should therefore treat patient access as a statutory feature, not a product option: the system must be able to produce the patient's file and reports, and exit clauses must guarantee that the facility can still meet Article 28 after the vendor relationship ends. Article 22 adds documentation duties for prescriptions, reports and certificates, which must be clear, accurate, signed, dated and filed in the patient's medical file.
CITRA's Data Privacy Protection Regulation
CITRA adopted its current Data Privacy Protection Regulation by Decision No. 26 of 2024, issued on 7 February 2024 and approved by the Authority's board at its meeting No. 14 of 2023 held on 5 December 2023. The decision repealed the previous privacy regulation adopted by Decision No. 42 of 2021 and its amendments, and it took effect from publication in the Official Gazette and on the Authority's website. The regulation applies under its Article 1 to service providers licensed by CITRA that collect, process or store personal data, whether the processing takes place inside or outside Kuwait, and it requires a lawful basis for processing, transparency toward the data subject, and safeguards appropriate to the sensitivity of the data.
Health data sits at the top of the sensitivity scale. The consent theme runs through the Kuwaiti framework: processing of personal data requires a legal basis, and sensitive data demands the highest standard of protection. In a healthtech contract, the data processing schedule should list the categories of data collected, the purposes, the lawful basis for each purpose, who may access the data, retention periods and deletion mechanics. Marketing uses, model training and product analytics should be separated from the treatment purpose, because the consent collected for care does not automatically extend to commercial reuse of the same data.
Data classification and cloud hosting of health records
CITRA's Data Classification Policy, issued by Decision No. 95 of 2021, divided data into four levels, and level three covered private sensitive data, which includes medical records. CITRA repealed the policy in February 2024 by Decision No. 34 of 2024, so the tiered scheme no longer imposes binding classification or storage duties, but it remains a useful reference when a facility designs its controls. A healthtech vendor proposing to host patient data should still be able to state how sensitive each dataset is and how its architecture protects it.
The Cloud Computing Regulatory Framework adds hosting rules. Its Article 4.1.4 treats health, genetic and vital data as special categories of personal data, and obliges cloud service providers and their subscribers, in both the government and private sectors, to refrain from using personal data to infer the identity of subscribers without clear and explicit written permission. Where a Kuwaiti facility plans to move records to a cloud region outside Kuwait, the review checks the framework's requirements, the consent rules of Law No. 20 of 2014 and any sector guidance before the migration plan is approved. The contract should record the approved hosting locations and require advance notice and approval before the vendor adds a region.
Cybersecurity duties and the National Center for Cybersecurity
Decree No. 37 of 2022 established the National Center for Cybersecurity, under the supervision of a minister appointed by the Cabinet, with a mandate covering civil, military, security and private sector establishments inside Kuwait. The decree aims to build a national cybersecurity system protecting information, communications and operations conducted by electronic means, and health facilities and telehealth applications sit inside its scope. A healthtech contract should treat cybersecurity as a compliance duty with a named regulator, not as a marketing feature.
Practically, the security schedule should cover access control, encryption, logging and audit trails, vulnerability management, incident detection and notification timelines, and cooperation with the National Center for Cybersecurity. The vendor should commit to notifying the facility within a defined period after confirming a breach affecting patient data, and the facility keeps the right to inform patients and regulators. Article 51 of Law No. 70 of 2020 reinforces this confidentiality culture, binding officials to secrecy even after their roles end.
Electronic transactions, records and signatures
Law No. 20 of 2014 on electronic transactions provides the general framework for electronic records and transactions in Kuwait, and it gave the Central Bank of Kuwait oversight of electronic payment of funds, which matters when a healthtech platform takes payment for consultations or subscriptions. The law protects personal data entered into electronic processing systems: information relating to a person's health condition must be kept private, employees may not unlawfully inspect, disclose or publish it, and disclosure requires the consent of the data subject or a court order.
For the contract, this anchors two drafting points. First, the parties should state that electronic records, consents and signatures generated by the platform are intended to have legal effect under Law No. 20 of 2014, and the system design should preserve the integrity and attribution of each record. Second, staff access to health data inside the vendor's support and operations teams should be limited, logged and contractually bounded, because unlawful inspection by an employee is exactly the conduct the law targets.
Liability, insurance and the clinical-commercial split
Law No. 70 of 2020 dedicates a chapter to medical liability, and Article 23 illustrates the standard: a practitioner performing surgery or medical interventions must obtain the patient's written informed consent, supported by the relevant documents, and the practitioner's obligation is to exercise the care of a diligent professional. Clinical judgments made through a platform remain the responsibility of licensed professionals and the licensed facility, and no indemnity clause can move that professional accountability onto a software vendor.
What the contract can and should allocate is commercial risk: service levels, uptime, support response times, correction of defects, liability caps for commercial losses, and insurance. Article 55 of Law No. 70 of 2020 requires private health facilities to maintain insurance with a licensed insurer against risks from buildings, devices and medical equipment, covering patients, companions, staff and visitors. The vendor's own professional indemnity and cyber cover should be evidenced in the contract file. Where the platform's output supports clinical decisions, the contract should state that clinicians retain the duty to review and may override the output, and the vendor should commit to documenting model changes and known errors.
Subprocessors, cross-border flows and service continuity
Healthtech stacks rarely run on one vendor. Hosting providers, messaging gateways, analytics tools, payment processors and AI model providers may all touch patient data. The contract should require the vendor to list its subprocessors, identify which of them can access personal data, give advance notice of new subprocessors or changed hosting locations, and accept a review route with a fallback if the facility withholds approval. Backups and remote technical access paths should be mapped as carefully as primary storage, because support access from outside Kuwait is itself a cross-border flow.
Continuity planning is a patient-safety issue in this sector. If clinical staff lose access to records during a shift, the facility needs a tested answer: who provides a usable copy, how quickly, and who communicates with the care team. The service schedule should set recovery time and recovery point objectives, require regular restore tests, and describe degraded-mode operation during an outage. These clauses should be tested before launch, not negotiated during the first incident.
Exit, records return and the contract checklist
Exit planning protects the facility's statutory duties. Because Article 28 of Law No. 70 of 2020 obliges the facility to maintain each patient's file and produce reports on request, the contract must guarantee export of the complete record set, including histories, attachments and audit trails, in a usable documented format, within a defined transition period and at a pre-agreed cost. Deletion by the vendor should be evidenced in writing, and access should survive a contested transition or a regulator's inquiry.
A practical Kuwait healthtech contract file contains: the parties' licenses and the facility's Health Licensing Department license; the data processing schedule with purposes, bases, categories, retention and deletion; approved hosting locations and the subprocessor list; the security schedule; service levels with continuity and restore testing; consent and patient access flows aligned to Articles 23 and 28; insurance certificates under Article 55; and the exit plan with a tested sample export. Each item names an owner and a verification date.
When we review a Kuwait healthtech contract
When we review a healthtech contract for a Kuwait deployment, we start from the licenses: the facility's license under Article 55 of Law No. 70 of 2020, the practitioners' licenses, and whether the service fits Article 24's permission for remote services and artificial intelligence. We then map the data: what is collected, the basis for each purpose, where it is hosted, and how CITRA's regulation under Decision No. 26 of 2024 shapes handling duties where a CITRA licensee sits in the chain. We test security and continuity against Decree No. 37 of 2022, and we read exit clauses against the facility's continuing duty to keep and produce patient files under Article 28. The result is a written report identifying the clauses that must change before signature.
See also: our Kuwait telecom and IT guide and our Kuwait data protection guide, plus our commercial and corporate practice.
Frequently asked questions
Is telemedicine legal in Kuwait?
Yes. Article 24 of Law No. 70 of 2020 permits medical services, home healthcare and remote healthcare, and the use of artificial intelligence and digital means, under Ministry of Health conditions and controls. The service must still run through licensed practitioners and structures.
Can a technology company own a clinic in Kuwait?
Not directly. Article 58 of Law No. 70 of 2020 requires a clinic license to be held by a licensed Kuwaiti physician, and a hospital or health center license by a licensed Kuwaiti practitioner or a legal person whose owner or partner is one. Technology companies typically contract with licensed entities instead.
Which regulator handles health data in Kuwait?
CITRA regulates personal data processing by its licensed service providers under the Data Privacy Protection Regulation, Decision No. 26 of 2024. The Ministry of Health regulates the medical side, and the National Center for Cybersecurity oversees cybersecurity under Decree No. 37 of 2022.
Is patient data treated as sensitive?
Yes. The Cloud Computing Regulatory Framework lists health and genetic data among special categories of personal data in Article 4.1.4. CITRA's Data Classification Policy, which had placed medical records in level three, private sensitive data, was repealed by Decision No. 34 of 2024, so the tiered scheme now serves as guidance rather than a binding rule.
Can patient records be hosted on cloud servers?
Cloud hosting is possible, but the Cloud Computing Regulatory Framework, CITRA's privacy regulation where a licensee sits in the chain, and the consent rules of Law No. 20 of 2014 shape where and how it may be hosted. The contract should record approved locations and require consent before new regions or subprocessors are added.
Who is liable when a platform-supported diagnosis goes wrong?
Clinical responsibility stays with the licensed practitioner and facility under Law No. 70 of 2020's medical liability chapter. The vendor carries the commercial obligations it accepts, such as service levels, defect correction and indemnities.
What happens to patient records when the contract ends?
The facility remains obliged to maintain patient files under Article 28 of Law No. 70 of 2020, so the contract should guarantee a complete tested export, a transition period and written evidence of vendor deletion.
How do we start a review of a healthtech contract for Kuwait?
Collect the draft contract, system description, data flow map, subprocessor list and licenses, then contact our office in Kuwait through the contact page. We will confirm scope, timeline and needed documents before starting.