Privacy Policy

Who We Are

MESC is a well-being platform offered by coach Rawan Al-Sayed. It lets you book individual sessions and group courses and join the MESC community. The platform is the entity that determines the purposes and means of processing your personal data, and it complies with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations.

Personal Data We Collect

We collect the following categories of data. Providing some is required to deliver the service; the rest is optional: • Account data (required to create an account): name, email, phone number linked to WhatsApp, country, and a password (stored as a one-way hash that cannot be recovered). When you sign in with Google we receive your name, email and profile picture (if any); we never see or store your Google password. • Booking data (required to complete a booking): the session or course type, its date and time, and the booking status. • Preliminary assessment data for individual sessions: marital status, children and their ages, employment status, nationality and country of residence, prior diagnosis or therapy, duration of the difficulty, and current challenges and symptoms. Some of this is sensitive health data; it is requested to prepare the session and is not used for any other purpose. • MESC community data (optional): what you enter in your introduction card and your photo, detailed in the MESC Community Privacy Policy. • Technical data: temporary verification codes and the cookies needed to keep you signed in.

How and Why We Collect Data

We collect your data in two ways: • Directly: when you create an account, book, fill in a form, or complete your community card. • Indirectly: from Google when you choose to sign in with it, and from the cookies necessary for signing in. We use your data for specific purposes only: creating and managing your account; confirming your bookings; sending reminders and notifications about them by email or WhatsApp; preparing sessions; creating the session event in the platform's Google Calendar with a Google Meet link and sending an invitation to your email; and operating the MESC community for those who join. We do not use your data for advertising, and we never sell or rent it to anyone.

Legal Basis for Processing

We rely on: • Your consent: when signing in with Google, when you voluntarily provide the preliminary assessment data to prepare your session, and when joining the MESC community (a separate, explicit consent to the community privacy policy). • Performance of a contract: to complete the booking you requested and deliver the agreed service. You may withdraw your consent at any time as described in the "Your Rights" section.

How We Process Your Data

Your data goes through these stages: • Collection: from the forms on the platform and from Google when you choose so. • Storage: in the platform's database, with access limited to those who need it to deliver the service. • Use: for the purposes stated in this policy only. • Sharing: with the service providers listed in the disclosure section, and only as needed to run the service. • Destruction: when you delete your account or the purpose of the data has ended, as described in the retention section.

Cookies & Sign-In

We use secure (httpOnly) cookies for one purpose only: keeping you signed in while you browse. We use no advertising-tracking or third-party marketing cookies. You can sign in with a Google account, or with your email and password after verifying your email with a code sent to you.

Disclosure to Third Parties & Transfer Outside the Kingdom

We use service providers to run the platform and share with them only what they need to perform their role: • Google: for sign-in, creating and managing Google Calendar events, and generating Google Meet links. • Cloudinary: for storing images uploaded to the platform, including the community card photo. • A WhatsApp messaging service: for verification codes and booking confirmations. • An email service: for booking notifications and reminders, and to deliver preliminary assessment answers to the coach. Some of this data may be processed on servers located outside the Kingdom of Saudi Arabia given the nature of these services. We transfer your data outside the Kingdom only as far as needed to deliver the service, and disclose it to no other party unless required by applicable law.

Storage, Retention & Destruction

Your data is stored in the platform's database and in the services listed above, each according to its role. We keep your account and booking data for as long as your account is active, so you can review your session history from your account page at any time. You can submit a request to delete your account and data from your Account page; we review and carry it out within 7 business days of receiving it, destroying your account and personal data, including the preliminary assessment data and your MESC community card. In booking and payment records we remove your identity (name, email, phone and notes) and keep the amounts, dates and statuses only as far as financial and tax rules require, and we remove your email from Google Calendar invitations for past sessions where we can; if that is not possible, we will tell you. We will notify you of the outcome by email or WhatsApp.

Data Protection

We take appropriate technical and organizational measures to protect your data from unauthorized access, use, disclosure or alteration, including encrypting communication with the platform, storing passwords encrypted, and restricting access to authorized personnel only. Access to the preliminary assessment data, including health data, is limited to those authorized to manage bookings.

Your Rights

The Personal Data Protection Law grants you the following rights. You can submit an account and data deletion request, or leave the MESC community, from your Account page, and exercise the other rights by writing to mesc@rawanelsayed.com: • Right to know: how we collect your data, for what purpose, and on what legal basis. • Right of access: to view the personal data we hold about you. • Right to a copy: to obtain your data in a readable format — you can download a copy yourself at any time from your Account page. • Right to correction: to correct, complete or update your data; you can edit much of it directly from your account page. • Right to erasure: to ask for your data to be destroyed once it is no longer needed, by submitting the request from your Account page. • Right to withdraw consent: at any time, by submitting the leave-the-community request from your Account page or by writing to us, without affecting the lawfulness of what was done before withdrawal. • Right to complain: as described in the next section. • Right to compensation: for damage caused to you by a breach of the Law.

Complaints & Objections

If you have a complaint or an objection about how your data is processed, write to us at mesc@rawanelsayed.com describing the issue, and we will review it and reply. If it is not resolved to your satisfaction, you may take it to the competent authority, the Saudi Data and AI Authority (SDAIA).

Google User Data & Limited Use Policy

The application's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Contact Us

For any question about your data privacy or to exercise any of your rights, contact us at mesc@rawanelsayed.com.

Updates to This Policy

We may update this policy from time to time. Updates are posted on this page, with the last-updated date at the top and an update log at the bottom.

Update Log

• September 27, 2026 — First release in its current form.