Dubai Autism Center — Positioning Memo
*Internal document. Source material for the pitch deck, parent-facing FAQ, partnership conversations, and regulator briefings. Not for public publication.*
---
The strategic frame
Most platforms in the UAE child + special-education space are doing one of two things:
1. **Generic global SaaS with UAE customers bolted on.** They write GDPR-equivalence privacy policies, host data in the US or Frankfurt, name no UAE law on their site, and treat the Emirates as a market rather than a jurisdiction.
2. **Pakistani or South-Asian-origin AR/AI plays with UAE distribution partnerships.** They have impressive logos (UNICEF, Google, ECA Anjal Z, ZHO, MAAN), make "clinically proven" claims without medical licensing, and run behavioural tracking on disabled children's webcam streams without naming a single UAE law.
The first group is too generic. The second group is too aggressive. Neither is built for the UAE child-of-determination context the way it actually exists in 2026, with the new Child Digital Safety Federal Law in force and PDPL maturing in parallel.
That gap is our positioning. Not "we have more features" — every competitor will close that quickly. **"We are the only platform in this space that is genuinely UAE-native, regulation-first, and disability-respectful by design."**
This memo lists the dimensions where we differentiate, in plain language, ranked by how much each will move the needle in conversations with parents, ECA / KHDA / ADEK, and Dr. Rashid's network of clinicians and educators.
---
The ten dimensions of differentiation
1. UAE-native compliance, not borrowed compliance
Most platforms list "GDPR" and "SOC 2" and stop there. We name PDPL, the UAE Child Digital Safety Federal Law, Wadeema's Law, the Federal Nurseries Law, KHDA, ADEK, SPEA, FAEE, and Federal Law No. 29 of 2006 on People of Determination — and we map specific platform behaviours to specific articles. Parents and regulators see the difference within thirty seconds of opening our compliance page. Competitors cannot match this without a serious rewrite.
2. The Child Digital Safety Law moat
The UAE CDS Federal Law took effect January 2026 with a one-year implementation window. Every existing competitor was built before this law existed. They are all retrofitting. We launch CDS-Law-aligned from day one — explicit parental consent, one-tap withdrawal, no behavioural advertising on child surfaces, no commercial use of child data, no third-party tracking on under-13 surfaces. This is a roughly twelve-month window where being early matters. After that the law becomes table stakes, but we will already own the position.
3. No therapeutic over-claim
Some competitors call themselves "clinically proven" and operate in therapy and rehabilitation contexts without DHA, DoH, or MOHAP licensing. That is a regulatory exposure for them and for any clinic that uses them. We deliberately do not make therapeutic claims unless we hold the relevant authorisation. The M-CHAT screener is framed as awareness and signposting, not diagnosis, and always routes to a licensed UAE clinician. This is conservative on purpose. Conservative wins trust with parents and with KHDA / ADEK inclusion teams.
4. AI governance on the record, not in the small print
We name our AI sub-processor (Anthropic, Claude Haiku for cost efficiency, Sonnet/Opus for higher-stakes tasks). We commit publicly to no training on customer data, no retention of child PII in long-term AI logs, and no AI-driven decisions about a child without a human reviewer. Most competitors have an AI page that lists features and a privacy page that does not even mention AI. The disconnect is glaring once anyone looks for it. Ours is consistent across pages.
5. No webcam, no biometrics, no body-tracking on children
A category of platforms uses real-time AI body-pose analysis on disabled children via webcam and stores attention, motor, and engagement metrics. Some of them additionally run third-party session-replay tools like Microsoft Clarity on the same surfaces. We do neither. NOUR talks to parents and educators. The platform never points a camera at a child. This is a deliberate product choice with a privacy benefit, and it is unusually easy to communicate to parents in one sentence.
6. In-region data residency
Primary data residency is UAE, with EU (Frankfurt) as secondary. No identifiable child data is processed in jurisdictions without a PDPL-compliant transfer basis. Most competitors run on US infrastructure with a Frankfurt secondary at best. For UAE families, in-region matters. For ECA, KHDA, and ADEK conversations, it matters more.
7. Bilingual and Emirati-voiced from day one
Arabic is not a translation layer dropped on at the end. NOUR speaks Emirati-dialect Arabic — calibrated through the UAE-dialect Arabic content bank Dr. Rashid is providing — alongside English. Cartoon characters Zain and Layla are designed for UAE families, not generic Western personas relabelled. Every flow has been built to work fluently right-to-left, not retrofitted with mirrored CSS.
8. Child-of-determination respect, not lip service
We treat additional-needs data as sensitive personal data under PDPL Article 5, requiring explicit, separate consent. We avoid the diagnostic language a competitor uses casually. We design with sensory-friendly defaults — reduced motion, predictable navigation, no surprise audio. Federal Law No. 29 of 2006 on People of Determination is not just on the compliance page; it is in the product brief.
9. Transparent sub-processor list, named and minimal
We list every sub-processor by name, region, and legal transfer basis. We commit to thirty days' notice before any change. We deliberately keep this list short — Anthropic, Vercel, Supabase, a UAE-licensed payment processor, transactional email — and we exclude the typical analytics and marketing bloat (Google Analytics, HubSpot, Mixpanel, Microsoft Clarity, Bugsnag) from any surface where child data appears. Most competitors list ten-plus sub-processors with no transfer basis named.
10. Public DPIA and post-incident transparency
We commit publicly to running a Data Protection Impact Assessment before launch and updating it for every material change. We commit publicly to publishing a post-incident summary if a breach affecting child data ever occurs. No competitor in this space currently makes either commitment publicly. It is unusual, it is credible, and it costs us almost nothing to deliver because the work is something we should be doing anyway.
---
Where these talking points go
| Audience | Use which dimensions |
|---|---|
| Parents (FAQ page, demo conversations) | 2, 5, 7, 8 — the human-readable ones |
| ECA Anjal Z / ZHO / MAAN partnership conversations | 1, 6, 8, 10 — the institutional credibility ones |
| KHDA / ADEK / SPEA inclusion teams | 1, 3, 8, 10 — regulator language |
| Dr. Rashid's clinician network | 3, 4, 8 — the "we won't put your licence at risk" ones |
| Pitch deck for fixed-fee or rev-share commercial | 2, 4, 6, 10 — the moat ones |
| Investor / strategic partner | 1, 2, 4, 6 — the structural ones |
---
The two-line elevator version
> Dubai Autism Center is the first child-of-determination platform built for UAE law as it actually stands in 2026 — Child Digital Safety Federal Law aligned, Wadeema-respectful, PDPL-compliant, and bilingual in Emirati Arabic and English from day one. We deliberately do not run webcam tracking, behavioural advertising, or therapeutic claims we are not licensed to make.
This works in a Dubai school WhatsApp group and on a slide. Use it.
---
What we should not say
A few traps to avoid even when the temptation is strong:
- **"Clinically proven."** Don't. We are not a medical device. If we ever become one, we will get the licence first.
- **"AI replaces the clinician."** Don't. NOUR assists. The clinician decides. This framing protects everyone.
- **"GDPR-compliant."** Technically maybe true, but it is the wrong headline for UAE. Lead with PDPL and CDS Law. Mention GDPR only when speaking to a European partner.
- **Naming competitors directly.** We don't need to. The market knows who they are. Saying "the platform that uses webcam body-tracking" is enough; saying their name on the record creates a fight we don't need.
- **"World's first."** Avoid this. Competitors have used it. Parents and regulators have seen it before. We have stronger, narrower, more defensible claims to make.
---
What we should track to know this is working
Three signals over the next ninety days:
1. **Compliance page → demo booking conversion rate.** If our compliance page is doing strategic work, parents who read it should convert at a higher rate than parents who don't. Track this in analytics (admin surfaces only, never on child surfaces).
2. **Regulator and institutional partner mentions of compliance language.** If KHDA, ADEK, ECA, or a partner clinician volunteers our compliance posture as a reason for partnership, that is the strongest signal that this positioning is doing real work.
3. **Inbound from competitor-fatigued nurseries and centres.** If we hear "we left \[competitor\] because of \[reason that maps to one of these dimensions\]," log it and use it as case-study material — anonymised, never naming the competitor.
If after ninety days none of these signals shows up, the positioning needs sharpening, not the product.
---
Reusing this for the wider portfolio
The same ten-dimension structure ports cleanly to:
- **Green Roots Early Learning Center** — replace child-of-determination framing with general early-years framing; everything else holds.
- **newworld.education** — add the cross-border education/curriculum compliance overlay (Cambridge, Pakistan Matric); the UAE-native compliance frame still holds for UAE diaspora families.
- **drrashidalameri.com** — different audience entirely (consulting / mentor brand), so dimensions 1, 4, 6, 10 are the relevant ones for any data-handling claims; the rest don't transfer.
The compliance template document is the public companion to this internal memo. They should be kept in lockstep — anything claimed in the public document must be deliverable, and anything claimed here must be defensible if a regulator or journalist asks.