1 Scope & Service Definition
Welcome to Murshid Companion (also referred to as "the App", "Patient Portal", or "رفيق مرشد"). Murshid Companion is developed, operated, and maintained by FES HealthTech (“we”, “our”, or “us”).
Murshid Companion is a personal, patient-facing digital mobile health application designed exclusively to empower subscribers and patients to follow dietary protocols, monitor daily hydration and nutrition adherence, access scheduled appointments, complete clinical assessment forms, and maintain private, authenticated communication with their treating licensed healthcare provider or nutrition clinic.
⚠️ Important Notice: By installing, creating an account on, or interacting with Murshid Companion, you agree to the collection and handling of your information as outlined in this Privacy Policy. If you do not agree with our policies and practices, please do not use the App.
🚨 Emergency Medical Disclaimer:
Murshid Companion is an adherence tracking and clinic communication assistant; it is NOT an emergency response system, acute diagnostic tool, or replacement for emergency medical personnel. If you experience an acute medical emergency, severe allergic reaction, or critical symptom, call your local emergency medical services immediately (e.g., 997, 911, or 112) or go to the nearest hospital emergency department.
2 Zero-Knowledge Architecture & End-to-End Encryption (E2EE)
We believe that health information is among the most sensitive personal data that exists. Therefore, Murshid Companion is built upon the foundational principle of Zero-Knowledge Security:
🛡️ Pairwise Cryptographic Isolation Standard:
For every clinic or specialist you link with, Murshid Companion automatically generates a dedicated 32-byte Curve25519 (X25519) cryptographic keypair stored securely inside your device's hardware-backed security enclave (Apple Keychain on iOS / Android Keystore on Android). All clinical meal plans, water intake, adherence scores, and follow-up form answers transmitted between your phone and your specialist are sealed using AES-256-GCM authenticated encryption.
What this means for you:
- No Server Decryption: Neither FES HealthTech, our cloud hosting providers, nor any unauthorized third parties have access to your private cryptographic keys. We cannot read, decipher, analyze, or monetize your diet plans, medical notes, or logged weights.
- Pairwise Isolation: If you connect with multiple clinics, each connection operates under completely separate, mathematically independent cryptographic keys. Link A cannot decipher data intended for Link B.
- Metadata Minimization: Cloud coordination documents carry only opaque ciphertext blobs and non-sensitive timestamps.
3 Data We Collect & Where It Is Stored
We adhere to strict data minimization practices. We only handle the minimal data necessary to provide reliable clinic synchronization:
A) Authentication Credentials (Cloud-Stored)
When you sign in using Google Sign-In or Apple Sign-In, Firebase Authentication processes and verifies your identity token. We store:
- Your unique cryptographic authentication ID (UID).
- Your verified email address.
- Your display name (as supplied by the identity provider).
Notice: We never receive, process, or store your passwords. All authentication utilizes industry-standard OAuth 2.0 protocols.
B) Clinical & Lifestyle Data (Stored Locally on Your Phone)
The vast majority of your health data is stored directly in an encrypted, on-device local database on your phone and remains strictly on your device unless you initiate an encrypted backup or send updates to your doctor:
- Nutritional Plans: Meal structures, caloric targets, macros, recipe notes, and meal swaps provided by your clinic.
- Hydration Telemetry: Daily water intake targets, glass counters, and logged milliliters.
- Adherence Logs: Daily checklist completion for meals, prescribed vitamins/supplements, workouts, and wellness habits.
- Biometrics & Measurements: Self-recorded weight, body measurements, and form survey submissions.
- Appointments: Upcoming clinic appointment dates, times, reminders, and status.
C) Transit Telemetry & Link State (Ephemeral Cloud Transit)
When communicating with your clinic, our cloud servers temporarily hold:
- Encrypted Payload Envelopes: High-entropy ciphertext containing your progress telemetry or completed forms, readable solely by your specialist.
- Public Keys: 32-byte public keys required to derive ECDH shared secrets between you and your healthcare provider.
- Link Channel State: An active, suspended, or unlinked status indicator.
4 How We Use Your Data
We process your data strictly for legitimate operational purposes:
- To verify your identity upon opening the app and maintain session security.
- To schedule and deliver localized on-device reminders (such as water intake and meal schedules) strictly on your device (100% Local Notifications) without remote server dispatch or device token collection.
- To transmit encrypted telemetry packages directly to your authorized healthcare provider.
- To detect app crashes, network timeouts, or operational failures via anonymized diagnostic counters.
What we NEVER do: We do NOT sell your data. We do NOT share your data with data brokers. We do NOT use your health data for commercial profiling, automated credit scoring, or commercial advertising.
5 Third-Party Services & Infrastructure
To deliver a resilient, high-availability mobile experience, we partner with world-class, security-certified cloud infrastructure providers:
- Google Cloud & Firebase (Google LLC): Cloud Firestore and Firebase Authentication for secure identity verification and transient encrypted sync envelopes. All data in transit is protected by TLS 1.3 encryption.
- Apple Inc.: Apple Sign-In authentication security on iOS devices.
All service partners are bound by strict Data Processing Agreements (DPAs) compliant with ISO 27001, SOC 2, and international privacy standards.
6 Clinic Linking & Unlinking Rights
Connecting with a clinic is 100% voluntary and requires scanning a QR code or entering a secure 6-digit PIN code provided directly by your healthcare practitioner.
Your Right to Disconnect: You have the absolute right to suspend or unlink your connection with any clinic at any time directly through the app settings. When you unlink:
- Automatic telemetry updates to that clinic stop immediately.
- Your past plan history remains preserved locally on your phone so you never lose your personal records.
- You can purge your local records completely with a single tap whenever you wish.
7 Google Drive Backups Security
Murshid Companion offers an optional automated cloud backup feature. When enabled:
- Your entire local database and cryptographic keys are compressed and encrypted locally into a secure
.mcbcontainer file using AES-256-GCM. - The encrypted container is uploaded directly and solely to your personal Google Drive storage space under your own private Google account credentials.
- FES HealthTech servers never touch, hold, or store your backup files. Only you can restore your data onto a replacement device.
8 Prohibition of Direct Use by Children & Mandatory Adult Guardian Account Custody
Direct use, account creation, or independent operation of Murshid Companion by children or minors (individuals under 18 years of age) is strictly prohibited, whether with or without the knowledge or permission of their parents. The App is not designed for or marketed to children, and we do not permit minors to directly operate the App under any circumstances.
👨👩👧 Mandatory Parental/Guardian Account Custody for Pediatric Care:
If a child or pediatric dependent is receiving clinical nutrition or dietary care through a linked clinic, all monitoring, plan reception, water tracking, and form submissions must be conducted solely and exclusively through the authenticated personal account of their adult parent or legally appointed guardian on the child's behalf.
We do not knowingly collect personal information directly from children. If we discover that an account is being operated directly by an unsupervised minor, we will take immediate steps to terminate the account and purge its authentication credentials in full compliance with COPPA, GDPR-K, and Saudi Personal Data Protection Law (PDPL).
9 Your Legal Rights & Data Deletion (GDPR / PDPL)
Depending on your jurisdiction (including Saudi Arabia PDPL, UAE Data Law, EU GDPR, and California CCPA), you possess specific fundamental rights regarding your personal data:
- Right to Access & Portability: View and export all your local diet plans, daily telemetry, and personal records.
- Right to Rectification: Edit or correct any inaccurate biometrics, weight logs, or contact details.
- Right to Erasure (Right to be Forgotten): You may request complete deletion of your account and all associated cloud records at any time.
How to Delete Your Data:
• In-App: via Settings → Account Options & Policies → Delete Account & Data (or from the top Options Menu ⋮ on the Clinic Connect screen for unlinked users).
• Web Request: submit a direct request through our dedicated Data Deletion Request Page.
🏥 Notice Regarding Clinical Records Maintained by Your Specialist:
Deleting your Murshid Companion account immediately terminates your subscriber account, unlinks all clinics, and purges your data from the companion platform. However, it does not automatically delete historical medical or clinical records already archived by your treating specialist or clinic. Clinics operate as independent data controllers for their patient health records. If you wish to request the modification or deletion of your medical file stored at the healthcare center, please contact your healthcare specialist or clinic administration directly.
Note: For new subscribers who have not linked to any clinic, account deletion is immediate, complete, and unconditioned, leaving zero clinical footprint.
10 Policy Updates & Contact Us
We may update this Privacy Policy periodically to reflect enhancements in our cryptographic standards, features, or regulatory requirements. Any material changes will be announced via an in-app notice or notification prior to taking effect.
For questions, privacy inquiries, or data protection officer communications, please contact us at:
FES HealthTech — Data Protection Office
Email: privacy@feshealthtech.com
Support: support@feshealthtech.com
Official Website: murshid.feshealthtech.com