I found a nice trick, I configured my FCB 1010 to help in tweaking the parameters for the H9.
Each of the 10 footswich select a parameter (from KB0 to KB9) and the right expression pedal set the value of the choosen parameter. It works!
That's really clever. I wouldn't have thought that would be possible with a FCB 1010.
The H9 supports the same MIDI protocol as the Factor pedals; so that document you found is the best source of documentation for it. We'll have to copy that over to the documentation section for the H9 and check to see if it needs any updating.
H9 Control itself uses a different MIDI sysex protocol, but the protocol H9 Control uses is encrypted to make it impossible for anyone to connect to your device over Bluetooth and start messing with it. Because of the encryption, it's not possible for other applications to use it, but I don't think there would be any advantage to using it anyway over the existing MIDI sysex protocol.
Now, If I have time, I will write a small software to do it with my tablet. It will be more convenient than on the device itself (but if your android soft is around the corner, I'd rather not waste my time on that).