muslimah.health Privacy Policy

This Privacy Policy explains how muslimah.health collects, uses, stores, and shares information when you use the muslimah.health mobile app, website, backend services, support tools, subscriptions, and Nura/personal assistant features.

muslimah.health handles reproductive health, cycle, fertility, pregnancy, postpartum, nutrition, skincare, worship, location, and optional photo information. Some of this data may be considered sensitive personal information, health information, or special-category data depending on where you live.

During onboarding, we ask you to confirm that muslimah.health may process your personal health and related app data to provide app features, and that you accept the Privacy Policy and Terms of Use.

If you use Nura or the personal assistant, we process your messages, conversation history, current time/timezone, and relevant app context needed to respond. Depending on the feature, this may include cycle, health, worship, reminder, note, or preference data.

Nura may suggest updates to your app data. The backend is designed to require a confirmation step before write actions are executed. Do not enter information into Nura that you do not want processed by our assistant systems and service providers.

Skincare face analysis is optional. If you use it, your original face photos are stored locally in the app on your device so muslimah.health can show your baseline and progress scan UI.

For analysis, muslimah.health sends a temporary copy of the photo through our authenticated backend to the analysis provider. The photo is used only to produce visible, non-diagnostic cosmetic observations, and the server-side copy is removed after the analysis completes or fails.

We do not use skincare photos for medical diagnosis, skin-age scoring, beauty scoring, behavioral advertising, or retailer targeting. We may keep structured observations, scan metadata, routine data, and consent records as described in this policy.

Meal photo logging is optional. When you capture a meal photo or select one or more images from your photo library, muslimah.health prepares only those chosen images and uploads them through our authenticated backend and cloud storage. The app does not continuously monitor your camera or photo library.

The selected images and any description you enter may be processed by an AI analysis provider to propose foods, ingredients, portions, calories, and nutrients. These results are estimates for your review and correction; they are not medical or dietary diagnoses.

Uploaded meal photos may remain linked to your nutrition records so they can be displayed in food-log history and synced across supported sessions or devices. Meal photos, storage references, and related analysis data are handled under the storage and retention terms in this policy.

Barcode scanning is optional. The app uses the live camera view on your device to decode an EAN or UPC and sends the decoded number to our backend for a product-catalog lookup. muslimah.health does not upload or retain a photo or video of the barcode camera view solely to perform that lookup.

Ingredient-label analysis is a separate optional tool. If you capture a label photo, a copy is sent through our authenticated backend and AI analysis provider to extract draft product and ingredient information. You must review the extracted fields before choosing to submit them. Product details you submit may be stored, checked for duplicates, and moderated for the shared product catalog.

We do not sell your personal information or use your health data for behavioral advertising. We share information only as needed to operate the product, comply with law, protect users, or process transactions.

• Database services for synced app data, plus Supabase/Postgres services used by website waitlist, blog, and admin features.
• Cloud hosting and object-storage providers, including AWS services for backend hosting and user-selected meal photos, and Vercel for the website.
• Apple and Google for sign-in, app distribution, in-app purchases, subscription management, and store server notifications.
• Expo push notification services for push delivery.
• Aladhan API for prayer-time calculations when location-based prayer times are used.
• Vercel Analytics for website usage analytics.
• AI and automation service providers used to power Nura/personal assistant features, optional meal-photo analysis, skincare face-analysis observations, ingredient-label extraction, or support-reply drafting.

We may also disclose information if required by law, to protect rights and safety, to investigate abuse or security incidents, or during a business transfer such as a merger, financing, acquisition, or sale of assets.

When you grant location permission or save a location in the app, we may store your city, country, latitude, longitude, timezone, and prayer calculation preferences so prayer times, fasting schedules, worship notifications, and Hijri-date features can work across sessions and devices. You can disable location access in your device settings. If location is disabled, the app may use stored or manually provided location information, or location-dependent features may be less accurate.

Notification permission is used to send reminders, prayer or worship notifications, app messages, and support-reply notifications. Push notification tokens are stored so notifications can be delivered and can be revoked when you disable notifications or sign out.

Camera permission is requested only when you choose a feature that needs it, such as capturing a meal photo, taking optional skincare face-scan photos, scanning a skincare barcode, or photographing an ingredient label. Barcode decoding occurs on your device as described above; photo-based features send only the images you choose to the services described in this policy.

Photo-library permission is used only when you choose to import meal photos or skincare face-scan photos. muslimah.health receives the images you select through the system picker, not unrelated photos in your library. You can limit, deny, or revoke camera and photo access in your device settings, but the related optional features may then be unavailable.

We use reasonable technical and organizational safeguards, including HTTPS/TLS in transit, authenticated API access, token-based sessions, rate limits on selected endpoints, database access controls, and account deletion workflows. No system is completely secure, and we cannot guarantee that unauthorized access will never occur.

Synced account data is generally retained while your account is active. Local app data may remain on your device until you sign out, clear app data, or uninstall. When you delete your account, we delete associated app data from active backend tables where the account deletion workflow applies, but we may retain limited records where required for legal, security, fraud-prevention, accounting, app-store, backup, or dispute purposes.

We may keep a record of your onboarding consent, including consent version, acceptance time, and the policy links shown to you, so we can demonstrate that consent was captured.

If we discover a security incident involving personal or health information, we will notify affected users and regulators where required by applicable law.