Health App Regulation in Bangladesh 2026: Can an App or AI Give Medical Advice?

Health app regulation in Bangladesh: where software ends and medical practice begins

Health app regulation in Bangladesh has no single statute and no app licence, and that gap is the source of most of the risk. A symptom checker, an AI chatbot, a doctor-booking platform and an e-prescription tool all sit under the same overlapping laws: the Bangladesh Medical and Dental Council Act 2010, which reserves allopathic treatment to registered practitioners; the Drugs and Cosmetics Act 2023, which treats software used for diagnosis or treatment as a medical device and controls health advertising; the Consumer Rights Protection Act 2009; and, for the data behind the product, the Personal Data Protection Act 2026.

The practical question for founders, hospitals and investors is not whether a product uses artificial intelligence. It is whether the product, as patients actually experience it, is giving medical advice. This guide sets out where the legal line sits in October 2026, which features cross it, how advertising rules apply to app copy, why disclaimers do less than teams assume, and how liability is shared between platform, doctor and vendor. Telemedicine operations and patient-data compliance are covered in separate TRW analyses linked below.

Summary: A Bangladesh health app may inform, organise, monitor and support doctors, but personalised diagnosis, treatment and prescribing remain the work of a registered medical practitioner. Software used for diagnosis, monitoring or treatment can be a medical device under the Drugs and Cosmetics Act 2023, health and treatment claims in advertising need prior regulatory approval, and a "not medical advice" disclaimer does not cancel what the product actually does.

Key point: Section 22 of the Bangladesh Medical and Dental Council Act 2010 prohibits allopathic treatment without registration, and section 71 of the Drugs and Cosmetics Act 2023 bars publishing any advertisement containing a claim about the use of a drug or about cure or treatment without the licensing authority's prior approval. Together they set the outer boundary for any app that talks to patients about their health.

At a glance

Swipe or scroll →

Table of Contents

Why health app regulation in Bangladesh turns on function, not labels

Bangladesh regulates people, premises, products and claims. It does not yet regulate apps as a category. That means health app regulation in Bangladesh works by asking which existing regime each feature engages. A product that lets patients book appointments engages consumer law and data protection. A product that tells a patient what condition they probably have, or which medicine to take, engages the law on medical practice. A product that analyses readings to detect or monitor disease may engage the medical-device rules. A product that sells or delivers medicines engages drug licensing.

Labels do not change that analysis. A regulator, a court or a complaining patient will look at the outputs, the reliance invited and the claims made. Calling a feature "wellness" or "information" in the terms of use does not alter what it does on screen. The same model can sit inside a low-risk note-taking tool for doctors and a high-risk patient-facing diagnostic chatbot; the legal position follows the deployment, not the model.

Four questions that decide the legal posture

Before launch, every patient-facing feature should be tested against four questions. First, does the output relate to an identified person's own symptoms, readings or history, or is it general information? Second, does it tell the person what condition they have, how urgent it is, or what to do about it? Third, does a registered doctor review the output before it reaches the patient or before anyone acts on it? Fourth, does the feature touch medicines, by recommending, prescribing, selling or advertising them? The more answers point to personalised clinical content without a doctor, the closer the product moves to regulated medical practice.

The regulators in the picture

Several bodies have a hand on the issue: the Bangladesh Medical and Dental Council for doctors, the Directorate General of Health Services for private clinics, the Directorate General of Drug Administration for medicines, devices and drug advertising, and the Directorate of National Consumer Rights Protection for consumer complaints. None has issued an app-specific rulebook, so a product team has to assemble the obligations itself.

The practice of medicine: BMDC registration and the doctor's role

The Bangladesh Medical and Dental Council Act 2010 re-enacted and replaced the Medical and Dental Council Act 1980. Section 22 prohibits allopathic treatment without registration, section 28 penalises fraudulent representation or registration, section 29 prohibits the use of false titles, and section 30 penalises prescribing prohibited medicines.[1] The statute regulates the human practitioner. It does not license software, and nothing in it allows a company to deliver allopathic treatment through an algorithm in place of a registered doctor.

For health app regulation in Bangladesh, section 22 is the anchor provision. A product that takes a patient's symptoms and returns a personalised diagnosis and treatment plan, with no registered doctor exercising judgment on that patient, is doing what the statute reserves to registered practitioners. The company may argue that it merely supplies information. That argument weakens with every feature that personalises the output, ranks likely conditions, sets urgency or names a medicine and a dose.

"Doctor" personas and the section 29 problem

Section 29 of the 2010 Act bars misleading use of names and designations, and a contravention is punishable with up to three years' imprisonment, a fine of up to Tk 1 lakh, or both. On 12 March 2025 the High Court Division ordered that the title "Doctor" may not be used before a name without an MBBS or BDS degree, and directed legal action against anyone using it in breach of the order.[3] A chatbot branded "Dr Shastho" or a "virtual doctor" persona invites exactly the reliance that the title rules exist to prevent. Name the service, not a fictional clinician, and make clear who the human doctors are.

What the BMDC ethics code expects of doctors who work with apps

The BMDC Code of Professional Conduct, Etiquette and Ethics bites on every registered doctor who lends their name, time or licence to a platform. It requires a doctor to examine the patient where necessary and to prescribe only with adequate knowledge of the patient's problem. It says a doctor should not associate with a non-qualified person in providing any form of healing, treats improper delegation of medical duties to someone who is not a registered practitioner as misconduct, and requires a doctor with a commercial interest not to let that interest affect prescribing, treatment or referral.[2]

Those principles map directly onto AI products. A doctor who signs off a protocol that lets a chatbot issue treatment advice to patients the doctor never sees is exposed to a charge of improper delegation. A doctor who is paid per referral generated by an AI triage tool must manage the commercial interest. The code also bars practice information that solicits or canvasses for patients and promotion through unsolicited calls, emails or leaflets, and lists censure, suspension or removal from the register as sanctions.[2] Platforms should assume that BMDC scrutiny will reach the doctors on their panel, and design their workflows so those doctors can comply.

Clinics, telemedicine and the 1982 Ordinance

Where a health app moves from software into service delivery, it can engage the regime for clinics. The Medical Practice and Private Clinics and Laboratories (Regulation) Ordinance 1982 regulates medical practice and the functioning of private clinics and laboratories, which operate under licence from the Director-General of Health Services.[4] A platform that employs doctors, runs a diagnostic service, collects samples or operates a physical or hybrid clinic should check whether its operating model needs that licensing, rather than assuming that being "online" places it outside the Ordinance.

Doctor-led telemedicine is the safest home for clinical functions. In a telemedicine model a registered doctor identifies the patient, takes consent, evaluates the information, decides on management and refers where remote care is unsuitable. TRW's analysis of running a telemedicine platform in Bangladesh covers the BMDC telemedicine guidance, doctor onboarding and platform terms in detail, so this article does not repeat it. The point here is narrower: a chatbot with no doctor in the patient journey is not telemedicine merely because the company also employs doctors elsewhere.

Government plans for digital health rules

The Ministry of Health and Family Welfare's Bangladesh Digital Health Strategy 2023–2027 lists a legal framework for remote consultation and e-prescription among its expected outputs, proposes a Digital Health Act covering data security, privacy and accountability, and envisages an accredited set of health apps, with health app accreditation identified as a priority for scaling up digital health.[12] None of those instruments has yet been made. Products launched now should be built so they can meet an accreditation or standards regime later, rather than relying on the current absence of one.

AI symptom checkers, triage and diagnosis

AI symptom checkers are where health app regulation in Bangladesh is most contested. The legal risk scales with personalisation and autonomy. At the low end sits general health education: an article on dengue warning signs, or a symptom glossary. In the middle sit monitoring and navigation tools that track readings against clinician-set thresholds and tell the user to contact a doctor. At the high end sit products that take an individual's symptoms and return a likely diagnosis, an urgency rating or a treatment instruction directly to the patient.

Information, navigation and advice are different products

A patient-facing statement such as "these symptoms can have many causes; you should speak to a doctor today" is navigation. "Your symptoms are consistent with a urinary tract infection; take this antibiotic" is diagnosis and treatment, whatever the footer says. Product teams should map every output into one of four states: permitted automation; doctor review before display; doctor review before action; and prohibited automation. Diagnosis, prescribing, dosage, pregnancy, paediatric questions, mental-health crisis and emergency advice belong in the last three states unless a clinician-led validation file justifies otherwise.

Triage is a clinical decision

Founders sometimes treat triage as lower risk than diagnosis. Patients do not experience it that way. An instruction that a patient does not need emergency care is a clinical judgment with immediate consequences, and an error is hard to reverse. A defensible triage feature has red-flag rules written and approved by named clinicians, conservative defaults when the model is uncertain, a working route to a human doctor or emergency services, testing in both Bangla and English where both are offered, and records showing what the system said and why.

The draft National AI Policy points the same way

Bangladesh has no AI statute. The Draft National AI Policy 2026–2030, reported in January 2026, sorts AI uses into prohibited, high-risk, limited-risk and low-risk tiers and places healthcare in the high-risk tier, requiring algorithmic impact assessments and strict human oversight. It provides that certified medical professionals keep decision-making authority over life-altering clinical decisions, proposes strict liability for deployers of high-risk AI, envisages an independent oversight committee created by Act of Parliament and anticipates a permanent AI Act by 2030.[10]

In July 2026 the Posts, Telecommunications and Information Technology Minister, Faqir Mahbub Anam, said the elected government was drafting a human-centric national AI policy and guidelines for AI use in the public sector.[11] The policy is not law, but it signals how regulators and courts are likely to reason: clinical AI is high-risk, a clinician must stay in control, and the deployer carries the risk of the system it puts in front of patients. Building to that standard now is cheaper than retrofitting it.

When software becomes a medical device under the Drugs and Cosmetics Act 2023

The Drugs and Cosmetics Act 2023 (Act No. 29 of 2023) repealed the Drugs Act 1940 and the Drugs (Control) Ordinance 1982. Its definition of "drug" in section 2(5) expressly includes medical devices, and section 2(33) defines a medical device to include any instrument, apparatus, machine, implant, diagnostic reagent (in vitro, in vivo and in silico) or software used, alone or in combination, for purposes including the diagnosis, prevention, monitoring, treatment or alleviation of disease, and for providing information through the examination of specimens from the human body.[5]

That definition matters for health app regulation in Bangladesh because it brings software into the drug regulator's perimeter by reference to intended medical purpose. A booking tool or a records viewer is unlikely to be a device. An algorithm that reads an ECG, grades a retinal image, interprets a lab result or calculates a dose looks much more like one. Because drugs, including medical devices, cannot be manufactured, sold, stocked, distributed or displayed for sale without a licence or outside its conditions under section 14, a diagnostic software product may need a DGDA position before commercial launch.[5]

Practical steps on device status

DGDA has not published a standalone framework for AI or software as a medical device that we could verify, and its device registration practice was built for physical products. The sensible approach is to write an intended-purpose statement in operational terms, assess the functions that analyse patient data or drive a clinical decision, and seek DGDA's view on classification and registration for those functions. Keep the analysis on file and revisit it whenever claims or features change.

Prescriptions, medicines and online pharmacy features

Medicines are where a health app's exposure becomes sharpest. Section 40 of the Drugs and Cosmetics Act 2023 prohibits selling antibiotics or any other drug, other than over-the-counter medicines, without a registered physician's prescription, with a fine of up to Tk 20,000.[5] An app that recommends a prescription-only medicine to a patient and links to a pharmacy checkout invites that sale without a prescription. Prescription-only items should be locked behind a valid prescription issued by a registered doctor after a genuine consultation.

Section 14(2) prohibits using the internet or any web-based process to sell, stock, distribute or display drugs for sale without a licence or outside licence conditions, and the schedule sets the penalty at up to five years' rigorous imprisonment, a fine of up to Tk 5 lakh, or both.[5] Section 72 adds that a physician may not advise in a prescription any medicine that is not registered under the Act, subject only to a narrow carve-out for medicines imported with the licensing authority's prior approval.[5] A prescribing engine must therefore draw only on registered products.

Separate the decision from the supply

A well-built product separates five steps that are often blurred: the clinical decision, the issue of the prescription, pharmacy fulfilment, medicine advertising and delivery. Each step can involve a different party, licence and record. A model that suggests options to a doctor, who then checks contraindications, interactions and dose and signs the prescription, is a decision-support tool. A model that generates a patient-facing prescription automatically, under a general protocol a doctor signed months ago, is not. Under section 30 of the 2010 Act, prescribing prohibited medicines is a separate offence for the doctor.[1]

Drug and health advertising limits for apps

Marketing is the fastest way for a health app to move itself into the clinical perimeter. The Drugs and Cosmetics Act 2023 defines "advertisement" to include any notice, leaflet, circular or document published or circulated through newspapers, periodicals, radio, television, online media or any other medium, along with any announcement made orally or by light or sound, commercial circulars, package inserts and labels.[5] App-store listings, social posts, influencer scripts, push notifications and in-app banners are all capable of falling within it.

Section 71(1) prohibits any person, without the licensing authority's prior approval, from publishing or promoting, or taking part in publishing or promoting, any advertisement containing a claim about the use of a drug or a claim relating to cure or treatment. The penalty is up to three years' imprisonment, a fine of up to Tk 5 lakh, or both.[5] Because "drug" includes medical devices, the provision is wide enough to reach claims about diagnostic software as well as about medicines.

Claims that create risk

Read every claim as a patient would. "AI-powered symptom checker" is broad. "Diagnoses 50 common illnesses in seconds" is a treatment-related claim. "Your 24/7 virtual doctor" invites clinical reliance and engages the title rules. "Get antibiotics without visiting a clinic" describes an outcome the Act restricts. Consumer law adds a second layer: section 44 of the Consumer Rights Protection Act 2009 punishes deceiving buyers through false advertisement with up to one year's imprisonment, a fine of up to Tk 2 lakh, or both.[7]

Keep a claims register that links each public statement to its evidence, owner, approval and withdrawal route. Investor decks deserve the same discipline. A company that tells investors its system "automates diagnosis" while telling regulators it only provides education has a credibility problem that will surface in due diligence, warranties and any dispute. Doctors on the platform should not appear in promotional material in a way that breaches the BMDC prohibition on canvassing for patients.[2]

Disclaimers and liability under health app regulation in Bangladesh

A disclaimer is useful only when it accurately describes the product. "This is general information, not medical advice" works for a library of health articles, not for a feature that analyses a patient's own symptoms and tells them what to take. A small-print disclaimer that contradicts the interface, the marketing and the onboarding flow is weak evidence that the company never intended patients to rely on the output.

Consumer law reaches health services

The Consumer Rights Protection Act 2009 contains offences for false advertising (section 44), failing to supply a promised product or service properly (section 45), acts endangering the life or safety of a service recipient (section 52) and negligence by a service provider causing financial loss, harm to health or death (section 53).[6] Failure to deliver a promised service after payment carries up to one year's imprisonment, a fine of up to Tk 50,000, or both, and a complainant whose complaint is proved receives 25 per cent of the fine realised.[7] A paid subscription that promises "a doctor in five minutes" and fails to deliver is an obvious target.

Negligence, discipline and the draft patient safety laws

Beyond consumer law, a patient harmed by a clinical output can sue in negligence, may complain to the BMDC about the doctors involved and, in serious cases, may pursue criminal negligence provisions in the Penal Code 1860. TRW's guide to medical negligence in Bangladesh explains those routes. In October 2025 the interim government published two drafts, a Healthcare Workers and Institutions Protection Ordinance and a Patient Safety and Redress Ordinance, the latter proposing incident reporting, out-of-court settlement and tribunals for negligence and patient-rights cases; neither was enacted.[13]

The elected government has picked up the subject. In June 2026 the Health Services Division formed a committee to draft a Health Protection Act intended to protect doctors, health workers and patients and create a unified legal framework for health service management, with 20 working days to produce a draft.[14] Any such law is likely to sharpen incident-reporting and redress duties for every provider, including digital ones. Health apps should build incident logs and complaint handling now.

Who carries the risk

Responsibility follows the workflow. A health app company can be at once a software supplier, a platform for independent doctors, a direct service provider and a referrer to pharmacies, each with its own duties. The doctor carries professional responsibility for clinical decisions they make or adopt. The company that designs the interface, sets the thresholds, chooses the model and markets the service should expect scrutiny even when the underlying model came from a third party. Contracts allocate cost and indemnity between the parties; they do not make an unlawful workflow lawful or bind a regulator.

Health data and AI: the 2026 Act in brief

Every health app processes sensitive data. The Personal Data Protection Act 2026 (Act No. 63 of 2026) received presidential assent on 10 April 2026 and replaced the interim government's 2025 ordinance.[8] Health-related data is sensitive personal data, which requires specific consent unless another listed condition applies, including the discharge of medical duties by health workers and emergency action where life or health is at risk. Data subjects may also withdraw consent to automated decision-making.[9]

Two points matter for AI products. Consent to a consultation is not consent to train a model, run marketing analytics or share data with a model vendor, so consent screens should separate those purposes. And where a product makes automated decisions about a patient, the patient's rights over that processing must be designed in, not bolted on. TRW's analyses of patient data in the cloud and the Bangladesh data protection law cover hosting, transfers, processors and breach response.

A compliance roadmap for launching a health app

The following sequence reflects how we prepare a health or AI product for launch, funding or hospital procurement. It produces evidence as well as compliance, because evidence is what a regulator, investor or court asks for first.

Swipe or scroll →

Comparing product models under health app regulation in Bangladesh

The table below maps the main product models. It is a risk map, not a statutory safe harbour. On a phone, scroll it sideways.

Most successful products start in the first three rows and add higher-risk features only once governance and evidence support them. Our consumer protection practice reviews claims, terms and complaint handling, and our corporate governance and compliance practice builds the clinical and AI governance framework around the product.

What investors and acquirers should check

Regulatory diligence should start with the product as used, not as described. Ask for a live walkthrough of every patient journey, including emergencies, children and a failed vendor connection, identify every output generated without doctor review, and request a redacted sample record showing the model version, the doctor's action and the consent captured.

Then test the paper. Look for doctor agreements and the BMDC registration-check process, any clinic licence, the medical-device and DGDA analysis, medicine and pharmacy arrangements, advertising approvals, the claims register, complaint and incident logs, data maps and vendor contracts with model-change controls. Compare the website, app-store copy and investor deck against the regulatory memo. Price remediation rather than relying on a general compliance warranty. TRW's guide to M&A due diligence in Bangladesh sets out the wider process.

What to watch in 2026 and beyond

Four developments will shape health app regulation in Bangladesh over the next year. First, the national AI policy: whether the elected government adopts the high-risk treatment of healthcare and the deployer-liability model in the January 2026 draft.[10] [11] Second, the Health Protection Act now being drafted, and whether it carries forward the patient safety and redress ideas of the 2025 drafts.[13] [14]

Third, the rules promised by the Digital Health Strategy on remote consultation, e-prescription and health app accreditation.[12] Fourth, the regulations and commencement notifications under the Personal Data Protection Act 2026. Products that keep a registered doctor in control, approve their claims and document their evidence will absorb these changes; products that rely on disclaimers will not.

If you are launching, funding, buying or procuring a health or AI product, the earliest decisions carry the most weight: which features are clinical, who the responsible doctor is, which claims you make and what evidence supports them. Contact TRW to arrange a review before launch.

Frequently asked questions

Can a health app give medical advice in Bangladesh?

An app can give general health information and help patients reach a doctor. Personalised diagnosis and treatment are allopathic practice, which section 22 of the Bangladesh Medical and Dental Council Act 2010 reserves to registered practitioners. Personalised clinical advice should therefore come from, or be reviewed by, a registered doctor.[1]

Is there a licence for health apps in Bangladesh?

No app-specific licence exists yet. Obligations come from the laws on medical practice, clinics, medicines and devices, consumer protection and data. The Digital Health Strategy 2023–2027 envisages health app accreditation and a legal framework for remote consultation and e-prescription.[12]

Is an AI symptom checker legal in Bangladesh?

A symptom checker that gives general information and directs users to a doctor is generally lower risk. One that returns a personalised diagnosis, urgency rating or treatment to the patient without doctor review moves towards regulated medical practice and may be a medical device. The draft National AI Policy treats healthcare AI as high-risk.[5] [10]

Can health app software be a medical device?

Yes. The Drugs and Cosmetics Act 2023 defines medical device to include software used for diagnosis, prevention, monitoring, treatment or alleviation of disease, and includes medical devices within the definition of drug. Seek DGDA's view on classification for clinical functions.[5]

Does a "not medical advice" disclaimer protect a health app?

Not on its own. A disclaimer helps for genuinely general content, but it does not neutralise a feature that analyses a patient's symptoms and tells them what condition they have or what to take. The interface, marketing and workflow must match the disclaimer.

Can an app advertise medicines or treatment benefits?

Only with prior approval. Section 71(1) of the Drugs and Cosmetics Act 2023 bars advertisements containing claims about the use of a drug or about cure or treatment without the licensing authority's prior approval, and the definition of advertisement covers online media.[5]

Can an AI chatbot issue prescriptions in Bangladesh?

No. Prescription-only medicines may be sold only on a registered physician's prescription, and prescribing is a clinical act for a registered doctor. A model can suggest options to a doctor, but the doctor should review, decide and sign.[1] [5]

Can an AI assistant be called "Doctor" in an app?

It is unwise. Section 29 of the 2010 Act prohibits misleading titles, and in March 2025 the High Court Division ordered that "Doctor" may not be used without an MBBS or BDS degree. A "virtual doctor" persona invites reliance the law is designed to prevent.[3]

Who is liable if a health app gives wrong advice?

Potentially several parties. The company may face consumer complaints and negligence claims, the doctors involved may face BMDC discipline, and contracts decide how the platform, clinic and model vendor share losses. Consumer law covers negligent services causing harm to health.[6]

Does the Personal Data Protection Act 2026 apply to health apps?

Yes. Health-related data is sensitive personal data under the Act, which generally requires specific consent unless a listed ground such as treatment by health workers or emergency care applies, and users may withdraw consent to automated decision-making.[8] [9]