Technical security
- Mandatory HTTPS and HSTS, plus security headers (CSP, X-Frame-Options…).
- Hashed passwords (Argon2/bcrypt) and a password-strength policy.
- 2FA for admins and rate limiting on sign-in.
- Protection against CSRF, XSS and SQL injection (Laravel defaults, plus review).
- API: Laravel Sanctum with short-lived tokens and refresh.
- Uploads: type and size validation, storage outside the public path, and temporary signed URLs for private images and video.
- Encryption at rest for sensitive health data and backups.
- Card data is never stored in the platform; it is handled by the gateway only (PCI DSS is out of our scope).
- Penetration testing and a vulnerability scan before launch.
- Encrypted daily backups with restore testing.
Privacy and compliance
- Saudi Personal Data Protection Law (PDPL): health data is a sensitive category; explicit consent, purpose limitation, rights of access, correction and deletion, and breach notification.
- Hosting location: preferably inside the Kingdom or in a jurisdiction compatible with data-transfer requirements (confirmed with the client's policy).
- Privacy policy and terms in both languages, with consent at registration.
- A clear clause covering activity tracking and the AI assistant.
- A cookie policy with a consent banner.
- The right to export a trainee's data and delete their account (from the app and web).
- Admin access to health data is restricted by reason and logged.
- A medical disclaimer: programs are general and do not replace medical advice.