The short answer: a Saudi telemedicine platform is only as compliant as the licensed provider running it and the evidence its software keeps. The national telehealth rules approved by the Saudi Health Council expect practitioners registered with the Saudi Commission for Health Specialties (SCFHS), informed consent recorded before every virtual encounter, a structured entry in the patient's medical record afterwards, and compliance with the national health-information-exchange policy. The National Health Information Center's (NHIC) application guidelines add that telehealth data should be stored inside the Kingdom and consultations encrypted. Design those requirements into the architecture from day one and the licensing conversation with the Ministry of Health (MOH) becomes paperwork, not a rebuild.
Virtual care is already mainstream in the Kingdom: the MOH says its Seha Virtual Hospital supports more than 242 hospitals across 48 main specialties and is recognised by Guinness World Records as the world's largest virtual healthcare provider. Private providers entering the space are measured against that benchmark by patients and regulators alike.
Who regulates telehealth in Saudi Arabia
Telehealth sits on three layers of rules, plus the sector regulators that apply to any digital health product.
- The legal basis. Royal Order No. 47455 (9/8/1441H) made an exception to Article 13 of the Law of Practicing Health Professions so that practitioners may examine and treat patients through telehealth, under regulations set by the MOH. The MOH's Legal Regulations for Telehealth Services describe the licensing route: private facilities are licensed through the MOH licensing department before activating telehealth services, and public facilities obtain pre-approval from the MOH's Digital Health Centre of Excellence. The copy on the MOH site is marked as valid until 2022, so confirm the current licensing steps with the MOH before launch.
- The national rules. The Governing Rules of Telehealth, prepared by NHIC and approved by the Saudi Health Council board, set the baseline: telehealth may be practised by any healthcare professional registered with SCFHS; a licensed healthcare facility follows the policies of the Saudi Telehealth Network (STN) rather than applying for a separate telehealth licence, while a telehealth service provider that is not a facility must apply for one; and facilities declare their telehealth activities to the STN before starting, then update that declaration at least once a year.
- The technical guidance. NHIC's Telehealth Application Guidelines translate the rules into practice: patient identification, consent, data management, hosting, encryption and recording.
- Sector regulators. Devices used in telehealth fall under the Saudi Food and Drug Authority's medical-device regulations, patient data under the Personal Data Protection Law (PDPL), and insurance claims under the Council of Health Insurance's national exchange, NPHIES.
What the rules mean for your platform
The table below maps each requirement to the feature that produces the evidence. Article numbers refer to the Governing Rules.
| Requirement | What the rules say | What to build |
|---|---|---|
| Practitioner registration | Telehealth is practised by professionals registered with SCFHS; clinicians outside the Kingdom must register to treat patients located in KSA (2.4.1, 2.4.4) | SCFHS licence number and expiry captured at onboarding; scheduling blocked when a licence lapses |
| Patient identity | The professional must have sufficient evidence to identify the patient (3.1.13); the guidelines list name, government ID, date of birth, gender and medical record number | National ID or Iqama capture matched to the medical record number at every encounter |
| Consent | Informed consent recorded, preferably online, before any activity; patients may withdraw at any time without giving a reason (3.1.17, 3.1.18) | Versioned e-consent with timestamp, withdrawal button and audit trail |
| Medical record | Every activity recorded with clinician, patient and remote locations, date and time, activity type, prescriptions or investigations, technical incidents and adverse events; ICD coding at the end (3.3.1, 3.3.2) | Structured encounter note with mandatory fields and an ICD coding step before close |
| Failures and emergencies | Protocols for technical incidents and medical emergencies during an activity (3.1.21, 3.1.22) | Escalation path, phone fallback and an incident log attached to the encounter |
| Hosting and encryption | Guidelines: store data within Saudi Arabia, prefer a cloud provider approved by the Communications, Space & Technology Commission, encrypt the session | In-Kingdom region for data, media servers and backups |
| Devices | Medical devices follow SFDA regulations (3.1.5) | Remote-monitoring peripherals checked for SFDA registration |
Two corrections to common assumptions. First, NHIC is the standards body, not a system you connect to: the rules ask for compliance with the national health-information-exchange policy and interoperability standards, and the guidelines ask that platforms be accessible for integration with national health platform services. Second, the guidelines require encryption, not specifically end-to-end encryption; more on that below.
Data protection: health data is sensitive data
Under the PDPL, health data is classed as sensitive data, and a controller must notify SDAIA of a personal-data breach within 72 hours of becoming aware of it (DLA Piper's PDPL summary). Transfers outside the Kingdom are allowed only where the destination offers adequate protection or appropriate safeguards are in place, and must be limited to the minimum data needed. Read together with NHIC's hosting guidance, the practical rule is simple: keep patient records, recordings, logs and backups in Saudi Arabia, and treat any third-party service that processes them abroad (video APIs, transcription, analytics, AI models) as an exception that needs a documented assessment.
In-Kingdom capacity exists today — Google Cloud's Dammam region opened in November 2023, and Oracle Cloud runs regions in Riyadh and Jeddah. Our multi-region deployment guide covers how to stay resilient without leaving the Kingdom.
Reference architecture
A compliant platform usually has six building blocks:
- Patient app for iOS and Android, built with React Native or Flutter, with booking, video, chat, e-consent and prescriptions in one place.
- Clinician console on the web for schedules, the encounter note, ICD coding, referrals and e-prescribing, which the rules allow when national prescription regulations are respected (3.2.2).
- Video layer on WebRTC. The WebRTC security architecture (RFC 8827) forbids unencrypted media, so every call is encrypted in transit. Calls that pass through a selective forwarding unit (SFU) are decrypted at that server unless you add end-to-end encryption, which is one more reason to run your SFU and TURN servers on in-Kingdom infrastructure rather than a foreign video API.
- Scheduling and reminders by SMS, push and the WhatsApp Business API, with no clinical detail in message bodies.
- Integration layer on HL7 FHIR: to the hospital EHR for history, and to NPHIES, the Council of Health Insurance's exchange built on FHIR 4.0.1, for eligibility checks, prior authorisation and claims.
- Audit and reporting that can produce the annual evaluation report declared facilities send to the STN (3.3.5) without a manual data hunt.
Arabic-first design
Saudi patients expect Arabic by default, with English one tap away. That means right-to-left layouts throughout, Arabic voice input for describing symptoms, a bilingual medical glossary so that clinical terms display consistently, Hijri and Gregorian dates side by side, and the option to filter clinicians by gender and language. Arabic interfaces also need Arabic error messages and consent text written in plain language, which the guidelines ask for when informing patients about a telehealth service.
How to evaluate a build or a vendor
Ask these questions before you sign:
- 1.Where is every copy of patient data stored, including video recordings, chat attachments, logs, backups and transcription output?
- 2.Can the platform show, for any encounter, the consent record and every field the Governing Rules list for the medical record?
- 3.How is SCFHS registration captured and re-checked, and what happens when a licence expires mid-schedule?
- 4.Is the NPHIES integration live, or on a roadmap?
- 5.What happens when the video drops, or when a patient deteriorates during a call?
Three pitfalls come up repeatedly: consumer video APIs that route media through servers outside the Kingdom; remote-monitoring devices added without checking their SFDA status; and forgetting the declaration and annual evaluation report to the STN, which are operational duties, not one-off launch tasks.
How Mantiqi can help
Mantiqi designs and builds telemedicine patient apps, clinician consoles and the FHIR and NPHIES integration layer — see our mobile app development and web platform services and our healthcare industry page. If you are adding AI to the front door, read our guide to AI patient triage in Saudi hospitals. Licensing and clinical governance stay with your licensed facility and legal counsel; we build the platform to produce the evidence they need. Contact us to scope your project.