Manaa · مناعة · ADHICS compliance
Cyber immunity for healthcare: ADHICS compliance in one platform.
Manaa is a bilingual cyber compliance platform for the health sector: compliance campaigns, audits, findings and CAPA, incidents, exemptions, risk and no-code administration. Built to scale to every licensed facility in a health sector.
- ADHICS, UAE IA, ISO/IEC 27001 and NIST CSF
- Every screen in Arabic and English
- For the regulator, every facility and their auditors
Manaa · Compliance overview
ADHICS campaign · live12
Open findings
4
CAPA due this week
2
Exemptions to review
Authorized vendor to
- Ministry of Finance
- Ministry of Interior
- DGE Abu Dhabi
- Etihad Aviation
- EDGE Group
Delivered for
- Hindustan Unilever
- Nokia
- Linde
- USA Today
- JSL
Procurement-ready
- Abu Dhabi Government Procurement Gate
- UAE Ministry of Finance, federal procurement
- Registered ADNOC vendor
- National ICV certificate
Product tour
See Manaa at work
Real screens from Manaa, shown with sample data for a health sector regulator.
One view for the whole sector
Compliance, findings, incidents and exemptions for every facility in one place.
Campaigns that run on schedule
Recurring self-assessments open each cycle automatically, remind facilities and flag defaulters.
Arabic and English
Every screen switches between Arabic and English.
Why it matters
Compliance that can’t live in spreadsheets
ADHICS applies to every entity in Abu Dhabi that handles health information. The regulator, each facility and its auditors need one shared, auditable record.
Hundreds of controls
ADHICS, UAE IA and ISO/IEC 27001 each bring their own controls, evidence and deadlines.
Evidence everywhere
Policies, screenshots and reports sit in email and shared drives, and go out of date between audits.
Findings that never close
Without owners, due dates and escalation, findings and corrective actions drift until the next audit.
Platform
Everything compliance needs, in one place
One platform for the regulator’s team, every facility in scope and the audit companies that review them.
Compliance campaigns
Self-assessments for one facility or thousands. A maker answers, the facility’s checker approves and the regulator reviews.
Evidence library
Upload a file once, link it to every answer it supports and keep it current with a valid-until date.
Audits
Plan audit projects, assign audit companies, record workpapers and control results, and issue reports and certificates.
Findings and CAPA
Each finding gets a CAPA plan with its root cause and actions, approved by the regulator and closed with evidence.
Incidents
Report from the web or a phone, named or anonymously. Triage, investigate with 5 Whys or fishbone, and approve the closure.
Exemptions
Request an exemption with the reason, the risk and your safeguards. Approve, renew, end or revoke it, on record.
Risk register
Score risks by impact and likelihood, track inherent and residual risk, review on schedule and see the heat map.
Reports and dashboards
Reports in PDF, Word or CSV, in English or Arabic, with every export kept as a version. Build your own dashboards.
No-code administration
Design approval workflows and forms without code, set notification rules and publish new versions safely.
Frameworks
The standards you answer to, side by side
A standards library with version comparison and control mapping, and evidence you upload once and reuse.
ADHICS
The Abu Dhabi Healthcare Information and Cyber Security Standard from the Department of Health, for every entity that handles health information in Abu Dhabi.
UAE IA
The UAE Information Assurance Regulation from TDRA, for government entities and designated critical entities.
ISO/IEC 27001
The international standard for information security management, in its 2022 and 2013 versions.
NIST CSF 2.0
The NIST Cybersecurity Framework, for organizations that align with international practice.
How it works
From campaign to closed finding
- 01
Launch
The regulator sets up a campaign, picks the framework and launches it to the facilities in scope.
- 02
Assess
Each facility’s maker answers with evidence, and its checker approves before submission.
- 03
Review
The regulator reviews each submission, asks for clarification on specific answers and raises findings.
- 04
Close
Facilities complete each CAPA with evidence, and the regulator checks it before closing the finding.
Who it’s for
For regulators, facilities and auditors
Health regulators
Run sector-wide campaigns, audits, incidents and exemptions across every licensed facility, with live dashboards.
Hospitals, clinics and groups
Answer campaigns, keep evidence current and close findings, for one facility or a whole group.
Audit companies
Plan fieldwork, record workpapers and control results, and issue reports and certificates in one place.
Payers and health technology providers
Show the regulator and your partners how you protect health information.
Track record
Trusted by UAE government entities and global brands.
Authorized vendor to five UAE government entities, with projects delivered for Hindustan Unilever, USA Today, Nokia and Linde.
- Startups and enterprises served by our engineering teams
- 150+
- Startups and enterprises served by our engineering teams
- Average rating on Clutch, Trustpilot and Glassdoor
- 4.9/5
- Average rating on Clutch, Trustpilot and Glassdoor
- Client satisfaction rate
- 98%
- Client satisfaction rate
- UAE government entities we are an authorized vendor to
- 5
- UAE government entities we are an authorized vendor to
Hear it from our clients
Client testimonial
E-commerceClient testimonial
HealthcareClient testimonial
E-commerceClient testimonial
E-commerce
Security
Built to the standard it measures
Multi-factor sign-in
Every user signs in with an authenticator app, and approvals can be delegated on record.
Roles and scopes
Roles decide what people can do, and scopes decide which records they see.
Tamper-evident audit log
Every change is kept in a tamper-evident log.
Connects to your systems
API keys, webhooks, incidents from security tools, and license, HR and service desk connectors.
Book a demo
See Manaa run a live compliance campaign
Tell us your facilities and frameworks. A product specialist will walk you through a campaign, an audit and a CAPA, in Arabic or English.
- A live demo, not slides
- Mapped to your frameworks
- A reply within one business day
4.9/5 average rating · 98% client satisfaction · 150+ clients served
FAQ
Questions buyers ask
What is ADHICS?
ADHICS is the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health – Abu Dhabi (DoH). It sets the information and cyber security requirements for entities that handle health information in the emirate.
Who must comply with ADHICS?
Any entity in Abu Dhabi that generates, accesses, stores, uses, processes or transmits health information, including healthcare facilities, payers and healthcare technology and service providers.
What does Manaa do?
Manaa runs cyber compliance for the health sector in one bilingual platform: compliance campaigns and self-assessments, audits, findings and CAPA, incidents, exemptions, the risk register, reports and no-code administration.
Which frameworks does Manaa support?
ADHICS, the UAE Information Assurance Regulation, ISO/IEC 27001 (2022 and 2013) and NIST CSF 2.0. New frameworks and versions can be imported, compared and mapped to existing controls.
Can Manaa replace our current compliance platform?
Yes. Facilities, people and their history can be migrated in a package that is checked in a dry run, imported in resumable chunks, reconciled and signed off, and undone if needed.
Is Manaa available in Arabic?
Yes. Every screen is available in Arabic and English, and notifications and reports can go out in either language.
How does Manaa handle incidents?
Facilities report an incident from the web or a phone, with their name or anonymously, and the regulator’s incident team is alerted straight away. The team confirms the category and severity, investigates the root cause, follows the actions and has a second investigator approve the closure.
How can a health entity procure Manaa?
Abu Dhabi government entities can buy through the Abu Dhabi Government Procurement Gate, where Birbal AI is a registered supplier, and federal entities through the UAE Ministry of Finance. Birbal AI holds a National In-Country Value (ICV) certificate, and private hospitals and clinics can contract with us directly.
Make ADHICS compliance continuous
See Manaa run a live campaign for your facilities.
Book a Manaa demo