Regulatory information
ThakaaMed is built for the new era of AI in healthcare — and built to lead it. Our systems explain their decisions, stay observable in production, and keep the clinician in command. This page is the authoritative statement of where every product stands.
Clinical decision support, engineered around one principle · the treating clinician decides.
Every ThakaaMed clinical output is produced for a licensed clinician to review, accept, amend, or reject. Diagnosis, treatment, and the duty of care remain with the treating clinician and their institution — our systems are built to inform that judgement, read alongside the source images and the patient record, never to replace it.
Product regulatory status
SFDA authorization is granted per device, not per company. This table is the authoritative statement of where each ThakaaMed product stands.
| Product | What it is | SFDA status |
|---|---|---|
| Dental IQ | AI dental radiograph analysis — software as a medical device | SFDA Medical Device Marketing Authorization (MDMA) held — granted June 2026 |
| Chest IQ | AI chest X-ray analysis | In development toward SFDA marketing authorization; not yet authorized |
| Stroke IQ | AI stroke imaging triage | In development toward SFDA marketing authorization; not yet authorized |
| Retina IQ | AI retinal screening | In development toward SFDA marketing authorization; not yet authorized |
| SAIF Labelling Platform | Medical data labelling and model development | Development platform — not a medical device, so no SaMD authorization is required |
| ClinicOS | Dental practice management, booking, and patient communication | Practice-management software — not a medical device, so no SaMD authorization is required |
Dental IQ — what the authorization covers
Dental IQ’s MDMA covers AI-assisted detection of a defined set of radiographic findings on panoramic, bitewing, and periapical dental radiographs, for review by a licensed dentist. The itemised list of authorized findings by modality is available to procurement, clinical-governance, and regulatory reviewers on request.
Certification and conformity status
Where we stand, framework by framework — published so a reviewer can verify our position at a glance, and updated the moment a status advances.
| Framework | Status | What that means |
|---|---|---|
| ISO 13485:2016 | QMS operating — SFDA-audited February 2026 | ThakaaMed operates a medical-device quality management system built to ISO 13485:2016. It was audited by the SFDA in February 2026 as part of the Dental IQ authorization route, and quality-system documentation is available to procurement and clinical-governance teams on request. We do not publish a registrar certificate number, so we describe the system as operating rather than certified. |
| ISO/IEC 27001:2022 | ISMS in implementation — certification targeted H2 2026 | An information security management system aligned to ISO/IEC 27001:2022 is running today: internal audit, access review, supplier management, backup verification, and vulnerability management, all evidenced. The certification audit is targeted for H2 2026, and this row will be updated the day it completes. |
| IEC 62304 | Lifecycle-compliant — the standard has no certification scheme | Every ThakaaMed product is developed under a software lifecycle built to comply with IEC 62304, inside the quality management system above. IEC 62304 has no certifying body, so we state it as engineering practice. |
| Saudi PDPL | In scope — obligations met | ThakaaMed processes personal data under the Saudi Personal Data Protection Law. PDPL carries no certification scheme; compliance is an obligation we meet in how the systems are built and operated. |
| ISO/IEC 42001 (AI management) | Programme in development | We are building an AI management system against ISO/IEC 42001 — governance for the AI itself, adopted ahead of it being asked of us. It is how we intend to lead in this era, not just participate in it. |
Positions on additional jurisdictions and frameworks are available to reviewers on request.
Interoperability & data protection
ThakaaMed products support HL7® FHIR® R4 for clinical data exchange and DICOM for imaging interoperability; conformance documentation is available on request via contact@thakaamed.com. Personal data is processed in accordance with the Saudi Personal Data Protection Law, and data is encrypted with AES-256 at rest and TLS 1.3 in transit, with role-based access control and full audit logging.
HL7® and FHIR® are the registered trademarks of Health Level Seven International. Use of these trademarks does not constitute endorsement by HL7.
Where your data lives
The question procurement asks last and should ask first. These answers are architectural, not contractual — they describe how the system is built, not what we promise to do with it.
| Question | Answer |
|---|---|
| Where does the AI model run? | On ThakaaMed-developed models, executed on hardware ThakaaMed or the customer controls. Patient images are not sent to a third-party AI or large-language-model provider for inference. |
| Where is patient data stored? | In the deployment the customer chooses. On-premise deployments keep patient data inside the customer's own network and are isolated from the public internet by default. Saudi-region deployments keep data in-Kingdom. |
| Which deployment models are available? | On-premise, Saudi-region hosted, or hybrid. High-security environments, hospital groups, and multi-location practices typically run on-premise. This is a customer decision, not a tier we upsell. |
| Which third parties receive patient data? | For an on-premise deployment, none. No sub-processor receives patient images or clinical records, because the data never leaves the customer's infrastructure. For hosted deployments, the sub-processors in scope are disclosed in the data-processing agreement before signature. |
| Is patient data used to train ThakaaMed models? | Not from a customer deployment without a specific written agreement covering it. Where a customer does agree to contribute data, it is governed by that agreement and handled under our labelling and governance process — it is never a default of using the product. |
| Does data leave the Kingdom? | Not for on-premise or Saudi-region deployments. If a customer outside Saudi Arabia requires a different region, residency is agreed in writing before deployment. |
This page is maintained as the authoritative statement of ThakaaMed’s regulatory position. If a claim elsewhere on this site or in any ThakaaMed material is stronger than what is written here, this page governs. Last reviewed 12 September 2026.
Questions about our regulatory posture?
Procurement, compliance, and clinical-governance teams can request quality-system documentation, the itemised authorized-findings list, conformance documentation, and regulatory letters directly from our team.
Speak with our team