01
Executive thesis
Most healthcare marketing compliance failures are not decisions to break a rule. They are content that reached publication without anyone identifying which rules applied. A social post about a device, a before-and-after image, a claim about recovery time, a retargeting audience built from a condition page: each engages a different authority, a different obligation and often a different reviewer, and none of them looks like a compliance question to the person producing it.
The corrective is triage. Before content is produced, a small set of questions determines which review path it takes. Most content takes the shortest path. A minority needs specialist review, and the value of triage is that it identifies which minority, early, rather than discovering it after publication.
This article provides that triage structure. It deliberately does not tell you what is permitted. That determination belongs to qualified counsel with the specific facts, and any article claiming otherwise should be treated with suspicion.
02
What is publicly established
The following are statements from official sources, cited so you can read the primary text. They are starting points for scoping, not a summary of applicable law.
| Source | What the official text states | Where to verify |
|---|---|---|
| SDAIA, Personal Data Protection Law | Health data is defined as personal data related to an individual’s health status or the health services received | PDPL, official English text |
| SDAIA, PDPL implementing regulations | Appropriate organizational, technical and administrative measures are required to protect health data | Implementing regulations |
| SFDA | Specified regulated products, including medical devices and certain health products, require prior advertising approval and must avoid misleading claims | SFDA notice |
| Google Ads policy | Healthcare advertising and destinations must follow applicable law and industry standards; some content is prohibited, and some permitted only with limitations or certification | Google Ads healthcare policy |
Two cautions on this table. The official Arabic legal text governs, and English translations are for convenience. And platform policy is enforced independently of law, so content can be lawful and still be rejected, or permitted by a platform and still be unlawful.
03
Why one generic compliance checklist is insufficient
A single checklist assumes one rule set applies to all content. In healthcare marketing, at least five variables change which controls are engaged.
Who is advertising. A licensed facility, an individual practitioner, a product distributor and a marketing agency acting on behalf of a client do not all carry the same obligations.
What is being advertised. A consultation service, a regulated medical device, a medicine, a cosmetic procedure and a health awareness message sit under different regimes. The SFDA position on regulated products is distinct from anything governing a general service page.
What is being claimed. Descriptive content about a service is different from a claim about outcomes, superiority or safety. Claims require substantiation and, depending on the product, prior approval.
Who the audience is. Targeting by health condition or health interest engages both platform restrictions and privacy obligations. Google restricts personalised targeting related to health conditions and sensitive health interests.
What data is collected. Any content that captures information about a person’s health status or services received engages PDPL obligations, and health data carries heightened protection.
A checklist that ignores these produces two failures at once: it over-controls routine content, which slows everything down and trains people to bypass it, and it under-controls the small share that genuinely needs specialist review.
04
The regulatory triage questions
Run these before production, not before publication. Each yes routes the item to a review path.
1. Does it name, show or promote a regulated product? Medical devices, medicines, supplements or other SFDA-regulated categories. If yes, confirm the product category and whether prior advertising approval is required.
2. Does it make a claim about outcomes, effectiveness, safety or superiority? Including implicit claims through imagery or patient narrative. If yes, substantiation is required and the claim needs review.
3. Does it show a patient, a patient’s body, or patient-derived content? Before-and-after images, testimonials, case narratives, review responses. If yes, consent, privacy and claims review all apply. See Before-and-After Images, Testimonials and Treatment Claims: A Risk Framework.
4. Does it identify a practitioner and their credentials or scope? If yes, verify every credential is substantiated and consistent with the professional register.
5. Does it collect, store or transmit information about a person’s health status or services received? Forms, chat, booking, analytics events, audience lists. If yes, PDPL obligations apply and privacy review is required. See Patient Privacy in Analytics: What Healthcare Websites Should Not Send.
6. Does it target an audience based on a health condition or health interest? If yes, platform restrictions and privacy obligations both apply.
7. Is it a paid placement on a platform with its own healthcare policy? If yes, the platform policy must be checked in addition to legal review, and it may be stricter.
8. Is it published in Arabic? If yes, the Arabic text is what will be read and assessed, and it requires review in Arabic rather than approval of an English source.
Content answering no to all eight is routine and can follow standard editorial review. In most organizations that is the majority of output.
05
The pre-publication escalation map
| Trigger | Review required | Who decides | Record retained |
|---|---|---|---|
| No triggers fired | Editorial review | Content lead | Version and publication date |
| Practitioner credentials or scope | Credential verification | Medical affairs or HR records | Verification source and date |
| Clinical content | Clinical review by relevant specialty | Named clinician | Reviewer name, specialty, date |
| Outcome, efficacy or superiority claim | Substantiation review, then legal | Legal or compliance | Evidence relied on, approval record |
| Regulated product | Product category confirmation, approval pathway check | Regulatory affairs, then legal | Category determination, approval reference |
| Patient imagery, testimonial or case content | Consent, privacy and claims review | Privacy lead and legal | Consent record, scope of use, expiry |
| Personal or health data collection | Privacy review, data flow assessment | Privacy lead | Data inventory entry, lawful basis |
| Health-based audience targeting | Platform policy and privacy review | Privacy lead and paid media | Audience definition, policy check date |
The right-hand column is the part organizations skip and later regret. If a regulator or platform asks why something was published, the answer needs to be a record rather than a recollection. Retain what was approved, by whom, on what basis and when, including the version of the content approved.
06
Worked scenarios by content type
The following scenarios are illustrative. They demonstrate the triage process. They do not state whether any specific content would be permitted, which is a determination for qualified counsel.
Scenario 1. A service page for a physiotherapy clinic. Triggers: practitioner credentials if named. No product, no outcome claim, no patient content. Path: editorial review plus credential verification. Routine.
Scenario 2. An Instagram post showing a patient’s results after a cosmetic procedure. Triggers: patient imagery, implicit outcome claim, likely a regulated context, Arabic publication. Path: consent record, privacy review, substantiation, legal review, platform policy check. This is the highest-risk content type most healthcare organizations produce routinely, and the one most often produced by a social media coordinator without any of the above.
Scenario 3. A Google Ads campaign for a dental implant service targeting people who visited the implant page. Triggers: health-based audience, data collection, platform healthcare policy. Path: privacy review of the audience construction, platform policy check, review of what data the page sends. Covered further in When Google Ads Work for Clinics and When They Waste Budget.
Scenario 4. A blog article explaining a condition, written by a marketing writer. Triggers: clinical content. Path: clinical review by the relevant specialty before publication, and re-review at a defined interval. No legal review needed unless a claim is made.
Scenario 5. A response to a negative review confirming the reviewer was seen last week. Triggers: patient information disclosure. This is a privacy matter regardless of intent, and it is the most common inadvertent disclosure in healthcare marketing. The safe pattern is in The Privacy-Safe Healthcare Review Response Playbook.
07
Governance roles and evidence records
Four roles must exist and be named. They can be held by one person in a small organization, but the accountabilities are distinct.
Content owner. Accountable for running triage before production and for the item being fit to publish.
Clinical reviewer. A named clinician in the relevant specialty, accountable for clinical accuracy. Review by a clinician outside the specialty is not clinical review.
Privacy lead. Accountable for data flows, consent, retention and the data inventory. Approves anything that collects or transmits health-related information.
Legal and regulatory reviewer. Accountable for claims, regulated products and anything with legal exposure. This role must be qualified in Saudi law and cannot be filled by an agency.
Records to retain for each published item: the triage outcome, every review conducted with name and date, the evidence relied on for any claim, consent records where patient content is used, the approved version, the publication date and the scheduled re-review date. Retention periods should be set with legal input.
08
Legal-review boundaries and update protocol
This is where DEMA’s role ends and where the organization’s own governance takes over. Stated plainly, because the boundary is easy to blur:
- An agency can build the triage process, run it, maintain records and flag items for escalation
- An agency cannot determine whether content complies with Saudi law
- Templates and checklists do not transfer legal risk from the advertiser to the agency
- Approval by a platform is not evidence of legal compliance
- Approval in one Gulf market does not carry to Saudi Arabia
Update protocol. Regulatory positions change and platform policies change more often. Set a review cadence for the compliance process itself: verify the official texts at least annually and after any announced change, re-check platform healthcare policies quarterly, and re-run triage on any evergreen content when a rule affecting it changes. The QA implementation of this sits in The Healthcare Marketing QA Gate: 25 Checks Before Anything Goes Live.
09
Priorities
Fix now
- Run the eight triage questions against currently published content, starting with social media and paid campaigns
- Identify any published patient imagery or testimonial without a documented consent record
- Name the four governance roles, including a Saudi-qualified legal reviewer
- Check any health-condition-based audiences currently active in advertising accounts
Build next
- Embed triage at brief stage so escalation happens before production cost is incurred
- Build the evidence record as part of the publishing workflow rather than a separate file
- Establish Arabic-language review for Arabic content by a reviewer working in Arabic
- Set the review cadence for official texts and platform policies
Measure continuously
- Proportion of published items with a complete evidence record
- Items escalated at brief stage versus items escalated after production
- Age of the last verification against each official source
- Volume of published content past its scheduled re-review date
10
Limitations and governance boundary
What this article is. An operational triage structure for organising healthcare marketing compliance work, with a map of where to escalate and what to record.
What it is not. It is not legal advice, not a summary of Saudi law and not a determination that any content is permitted or prohibited. It does not cover every authority, obligation or content type that may apply. It does not address professional licensing obligations, which are separate.
Source limitations. The official Arabic text of Saudi law governs; English versions are for convenience. Regulatory positions and platform policies change without notice. The sources listed were the current published versions at the time of writing and must be re-verified before reliance.
Where review is required. Every determination in this article’s scope requires qualified Saudi legal or regulatory review for the specific facts. Privacy determinations require a privacy lead. Clinical content requires specialty-matched clinical review.
Planned research. DEMA has scoped a Saudi healthcare marketing regulatory matrix. It is not complete, and this article contains no findings from it.
Sources.
11
Publishing faster than you can review?
Most compliance exposure in healthcare marketing comes from content that nobody identified as needing review. A Healthcare Growth Diagnosis runs the triage across your live content and campaigns, in Arabic and English, and shows where escalation should have happened. Determinations on specific items remain with your legal counsel.
Request a Healthcare Growth Diagnosis