Why the family dashboard deliberately shows less than it could
We can stream a pilgrim's precise location and heart rate to relatives. We do not. A note on consent, dignity and the difference between care and surveillance.
The single most requested feature from families is a live map dot. The second most requested is live heart rate. We ship neither by default, and the reasoning is worth stating plainly because it will keep coming up.
What a pilgrim consents to
A pilgrim in iḥrām has stepped out of ordinary life. Continuous observation by relatives — however loving — reimports it. Consent is collected per audience and per data type, at setup, in the pilgrim's own language, with the pilgrim holding the switch.
- Default to family: status only — safe, resting, in a rite, or needs attention — plus the city, not the coordinate.
- On SOS or a confirmed strain alert: precise location is released to family and to the group leader automatically.
- Health metrics are never shown as raw numbers to anyone but the pilgrim and, if the pilgrim opts in, the medical officer.
- Every escalation is logged and visible to the pilgrim afterwards: who saw what, and when.
The institutional version of the same rule
Operators see their own pilgrims. Agencies see aggregate compliance and named exceptions, not continuous tracks. Service providers see a booking, a name and an arrival window — nothing about health, location or spending. The tiers exist so that no single account can assemble a complete picture of a private person's pilgrimage.
“Care is bounded and asks permission. Surveillance is unbounded and assumes it.”
We are aware this costs us a demo that would sell well. It is the right trade.
Last updated 30 April 2026