VPN for Healthcare: A Confidential Data Layer for Medical AI in MENA

The market problem

Healthcare AI in MENA is ambitious even if blocked by usable data. As clinical models and analytics require longitudinal medical histories, protected health information cannot simply move across systems, vendors, or borders.

This paper prepared by our team frames this as a structural problem: the requirement and approach to building a privacy-preserving transport layer.

Executive Summary:

Yma Health and Super Protocol describe an anonymization middleware service — informally, a “VPN for Healthcare”.

The service retrieves records from EHR/HIS systems, anonymizes them with medical-context awareness, and passes only de-identified but clinically meaningful data to AI applications.

The key move is to treat anonymization as infrastructure: a regulated channel between health data sources and AI workloads.

Why the UAE matters first

The UAE already has core health data rails: NABIDH in Dubai, Malaffi in Abu Dhabi, and Riayati at federal level.

The policy environment also recognizes anonymization, secure processing, consent, access control, and secondary use as operational questions.

That makes the UAE a practical starting point for a MENA-wide pattern: local trust, regional repeatability.

Strategic scenarios

The concept can serve regulators, large provider groups, certified EHR vendors, and international AI companies entering the region.

Each stakeholder gets a different promise: governance, scalable transformation, compliance-safe feature expansion, or regulated market access.

Research takeaway

The next wave of healthcare AI in MENA will not be won by the model alone. It will be won by the secure data layer that lets regulators, providers, and AI vendors trust the work being done.

The regulatory and oversight framework:

The UAE has already built a strong foundation for secure, data-driven healthcare:

Health Information Exchange (HIE) platforms

• NABIDH (Dubai, Dubai Health Authority -DHA). NABIDH is the official health information exchange platform for Dubai, connecting public and private providers and enabling secure exchange of electronic medical records.

Official website: https://nabidh.dha.gov.ae

• Malaffi (Abu Dhabi, Department of Health — DoH). Malaffi is the region’s first HIE platform, connecting all healthcare providers in Abu Dhabi and creating a centralized, unified patient record with a strong focus on data privacy and security.

Official website: https://www.malaffi.ae/
Data security and privacy: https://www.malaffi.ae/providers/data-security/

• Riayati / National Unified Medical Record (NUMR, federal, MoHAP). Riayati is the federal initiative to unify medical records across the UAE and enable safe, real-time exchange of health information between key HIE platforms and providers.

Integration announcement (Riayati, Malaffi, NABIDH): https://mohap.gov.ae/en/w/uae-health-authorities-announce-successful-integration-between-riayati-malaffi-and-nabidh-

Regulatory framework for health data protection and secondary use:

The UAE already has core health data rails: NABIDH in Dubai, Malaffi in Abu Dhabi, and Riayati at federal level. The policy environment also recognizes anonymization, secure processing, consent, access control, and secondary use as operational questions. That makes the UAE a practical starting point for a MENA-wide pattern: local trust, regional repeatability. At the same time, the landscape sets forth serious requirements: below listed are key policies and acts overseeing all aspects of health data interpretation:

DHA Policy for Health Data & Information Sharing (2024)
The policy defines principles and conditions for sharing and secondary use of health data, including the need for effective anonymization when patient consent is not obtained.

Source: https://dha.gov.ae/uploads/082024/Policy_for Health Information
Sharing_EN202480306.pdf

DHA Policy for Health Data Protection and Confidentiality (2022)
This policy sets requirements for protecting personal health information, secure environments, and alignment with federal ICT in Healthcare law.

Source: https://dha.gov.ae/uploads/082022/Health Data Protection and
Confidentiality Policy_EN2022810559.pdf

DHA Standards for Health Information Consent and Access Control
(2025). The standards set guidance around consent, access control and responsibilities of entities accessing PHI.

Source: https://dha.gov.ae/uploads/012025/Standards for Consnet and Access Control2025129762.pdf

DHA Health Information Assets Management policies. These are complementary policies dealing with classification, retention, and management of health information assets.

Source: Overview page: https://dha.gov.ae/en/licensing-regulations-Nabidh

DHCC Health Data Protection Regulation adds specific requirements for health data protection in Dubai Healthcare City while referencing DHA policies and UAE federal laws.

Source: https://www.dhcc.ae/frontend/images/docs/10-Health Data Protection Regulation.pdf

National AI and digital health strategy

UAE National Strategy for Artificial Intelligence 2031. The strategy aims to position the UAE as a global AI leader by 2031 and explicitly includes healthcare as a priority sector, with emphasis on data infrastructure and governance.

Source: https://u.ae/en/about-the-uae/strategies-initiatives-and-awards/strategies-plans-and-visions/government-services-and-digital-transformation/uae-strategy-for-artificial-intelligence

MoHAP National Centre of Excellence for AI in Healthcare (2023) confirms the federal ambition to build a systematic AI infrastructure for the health sector.

Source: https://mohap.gov.ae/en/w/mohap-launches-health-sector-s-first-national-centre-of-excellence-for-ai

Dubai State of AI report (Digital Dubai) highlights healthcare as one of the leading domains for AI adoption and links progress to secure data sharing and strong governance.

Source: https://www.digitaldubai.ae/docs/default-source/publications/dubai-state-of-ai-report.pdf

Concrete AI-for-security use cases

In the NABIDH context and broader DHA communications, AI is already framed not only as a clinical tool but also as an enabler of patient privacy and data security (for example, monitoring access and preventing PHI leakage).

In parallel, confidential computing is becoming a practical way to reconcile AI with strict healthcare regulations. A leading provider of such tech platforms, Super Protocol, has demonstrated how trusted execution environments (TEEs) and verifiable confidential AI clouds can:

• protect sensitive medical data and model IP;
• accelerate compliance and regulatory reviews (including FDA-related workflows) by giving auditors cryptographic evidence of what ran, where, and under which conditions.

Against this backdrop, the joint Yma Health + Super Protocol solution, informally called a “VPN for Healthcare”, provides a practical and scalable answer to a central question: how can real medical data be used in AI scenarios without exposing patient identities or breaching local regulations?

Below case-study described our practical application of leading tech and internal know-how:

• The current Yma Health and Super Protocol solution.
• The partnership model between Yma Health, Super Protocol and Casta.

Yma Health & Super Protocol: “VPN for Healthcare”

Overview:

Yma Health and Super Protocol have jointly developed an anonymization middleware service — a “VPN for Healthcare” — that:

• automatically retrieves medical records from EHR systems;
• performs intelligent anonymization using a medical foundation model (MedGemma) from Google DeepMind;
• passes only de-identified but clinically meaningful data to AI applications;
• runs in a confidential computing environment powered by Super Protocol.

The solution has already been tested with real clients in the UAE, including:

• Simplex Himes — a certified EHR major provider in MENA region that sought to extend their capabilities in the AI functionality without violating DHA policies on health data sharing and protection.
• JointSpace Clinic in UAE — a physical therapy clinic using the solution to analyse treatment histories and personalize communication, while preserving patient trust and privacy.

Technical foundation:

Our key architectural elements were:

Confidential computing on Super Protocol

• All components (anonymization and AI inference) run inside Trusted Execution Environments (TEE).
• Code and environment configurations are cryptographically attested, and execution reports are published as immutable records.
• Super Protocol uses a decentralized, zero-trust design and can orchestrate workloads across independent infrastructure providers.

Anonymization middleware

• The anonymization and preprocessing logic runs on CPU-based TEEs and does not require GPUs.
• Middleware retrieves data from EHR / HIS systems and prepares it for LLM-based anonymization and downstream AI processing.

“Smart” anonymization using MedGemma

• The solution uses Google MedGemma 27B, an open medical model family tailored to clinical text and images, where
• MedGemma processes medical records and removes PHI and quasi-identifiers while preserving clinical context and data utility.
• The model is served via vLLM with an OpenAI-compatible API and high throughput.

Confidential GPU inference

• MedGemma inference ran on NVIDIA Blackwell (HGX B200) GPUs in confidential mode, provided by Nebius AI Cloud through Super Protocolʼs infrastructure.
• Both data and models remain within the TEE boundary, protecting patient privacy and AI IP.

Super Protocol confidential tunnels

• External access is exposed through a tunnel server and tunnel client, both running in TEEs.
• The application is not directly exposed to the public internet; access requires valid tokens and TLS certificates.
• The same tunnel mechanism secures communication between internal components.

Regulatory alignment

The solution developed by us was immediately designed to align with core UAE’s DHA and DoH principles:

• Effective anonymization of direct identifiers and quasi-identifiers, such that anonymized data is no longer considered personal and can be used for secondary purposes under DHA policy, without re-identification risk.
• Secure processing environments, in line with DHA policies on Health Data Protection and ICT in Healthcare law, requiring strong technical and organizational controls for PHI.
• HIE compatibility, allowing future integration with NABIDH, Malaffi and Riayati as trusted sources and sinks of medical data.

Application use-cases in the UAE and across MENA:

National Standard for Anonymization in Medical AI

The formed platform heralds a novel approach to create a standardized anonymization gateway for all AI use cases in healthcare in the UAE, with initial focus on Dubai and Abu Dhabi:

• a unified security layer for AI integrations with EHR and HIE systems;
• formal alignment with DHA and DoH policies;
• a scalable architecture that can later extend to GCC and wider MENA.

Solution description

Concept: all requests from clinics, hospitals and HIE platforms to AI systems (local or international) pass through a national anonymization gateway where:

• data from EHR / HIE is first processed by the Yma Health + Super Protocol anonymization layer;
• only LLM-anonymized, de-identified data leaves the gateway;
• all components of the gateway operate inside TEEs with cryptographic attestation and auditable reports.

Key properties:

• Technology-neutral: the gateway works with local AI systems and with external vendors where permitted by regulators.
• Verifiable security: regulators and auditors can verify that the code and environment match the approved baseline for processing PHI.
• Scalable: the architecture supports onboarding many institutions and AI vendors with consistent standards.

Confidential Health Data Platform and Research Environment (Data Lake / Research Platform)

Objective

To build a confidential platform for secondary use of anonymized health data, enabling:

• safe training and validation of AI models;
• clinical and academic research;
• controlled access for pharmaceutical companies to aggregated data and cohort selection.

Platform capabilities

• Import of anonymized data from NABIDH, Malaffi, Riayati and large hospital groups.
• Formation of compliant tools for cohort building (by diagnoses, procedures, demographics and other variables);
• running analytical jobs and model training in confidential mode;
• access control and auditing of who runs which workloads.
• Integration potential with national AI initiatives, such as the MoHAP AI Centre of Excellence.

Confidential AI Enablement Layer for Large Hospital Networks

Objective

To provide large hospital networks in the UAE with a managed security layer for all AI integrations:

• integrating AI assistants, patient engagement tools and analytical systems;
• minimizing regulatory and privacy risks;
• avoiding the need to build complex confidential infrastructure in-house.

Solution format

For a network of multiple clinics or hospitals:

• a confidential anonymization gateway (Yma Health + Super Protocol) is deployed as a managed service;
• connectors are configured to the networkʼs EHR/HIS, CRM and existing HIE connections;
• on top of this layer, the network can use Yma Health’s Workspace platform for patient communication, reactivation and conversation analytics;
• plug in third-party clinical AI tools (decision support, scribes, etc.).

MENA Gateway for Global Health AI Companies

Objective

To build a regulatory and technical gateway for international health AI companies (for example, AI scribes, diagnostic support, patient engagement platforms) entering the MENA market:

• giving them compliant access to de-identified data and hospital integrations;
• preserving UAE and GCC requirements regarding PHI storage and processing.

Regulatory context

• DHA and federal regulations impose strict conditions on the use and cross-border transfer of PHI, and require robust technical and organizational measures for any processing of health data.
• DHCC regulations and ICT Health Law reinforce these requirements and specify when and how health data may leave the country or be accessed by external parties.

The MENA Gateway offers international vendors:

• a local TEE-based environment for processing patient data within the region;
• LLM-based anonymization before any data reaches their models if they are hosted outside the region;
• a single set of technical and contractual interfaces to work with hospitals and regulators.

Operating model

• Hospitals and clinics send data to the MENA Gateway; data is anonymized inside TEEs.
• Depending on the architecture the international vendorʼs model can be deployed inside Super Protocolʼs TEEs in the region (so data never leaves local infrastructure), or only anonymized, non-identifiable data is sent outside the region.

The Gateway provides:

• a standardized API for integrations with hospitals and HIE platforms;
• reporting and attestation evidence for regulators and customers;
• a single contractual and compliance layer for both providers and AI vendors.