Privacy & Security Policy

Last updated: April 2026

PhysioFlow is committed to protecting patients' personal and clinical data with the highest level of security. Data processing complies with the General Data Protection Regulation (GDPR) of the European Union, as well as applicable health data protection regulations in each country of use, including HIPAA (USA), PIPEDA (Canada), and other equivalent international regulations.

1. Data we collect

We collect only the data strictly necessary to provide clinical services:

  • Identification data: name, phone, email
  • Clinical data: diagnosis, session history, pain scales, body maps
  • Medical documents voluntarily attached
  • Payment records (amounts, status)
  • Assigned exercise programs

2. Purpose of data processing

Your data is used exclusively for:

  • Clinical history management and therapeutic follow-up
  • Appointment scheduling and exercise programs
  • Administrative and billing management
  • Treatment-related communication

Your data will never be sold, transferred, or used for commercial or advertising purposes.

3. Security & storage

The following security measures are implemented:

  • Data encryption in transit via HTTPS/TLS
  • Access restricted exclusively to authorized professionals
  • Mandatory authentication to access the system
  • Automatic periodic backups
  • Infrastructure hosted on internationally certified secure cloud servers

4. Data access

Only the following have access to the data:

  • The physiotherapist or clinic responsible for the treatment
  • Staff expressly authorized by the data controller

Data is not shared with third parties unless required by law or with the patient's explicit consent.

5. Patient rights

In accordance with the GDPR and equivalent international regulations, patients have the right to:

  • Access: request a copy of their personal data
  • Rectification: correct inaccurate or incomplete data
  • Erasure: request deletion of their data ("right to be forgotten")
  • Objection: object to the processing of their data
  • Portability: receive their data in a readable, transferable format
  • Restriction: request limitation of processing

To exercise these rights, contact your physiotherapist directly.

6. Voice recordings

The app allows recording voice notes linked to patient records and clinical sessions. When using this feature:

  • Microphone access is requested only when the professional activates recording
  • Audio files are stored securely on encrypted servers
  • Recordings are accessible only to the authorized professional
  • AI transcription, translation or rewriting is performed only when explicitly requested by the professional from a voice note; the result must be reviewed before it is added to the clinical record
  • Patients may request deletion of any recording at any time

7. Important medical disclaimer

This app is a clinical management support tool and does NOT replace the clinical judgment of a healthcare professional.

  • Data entered is the responsibility of the physiotherapist recording it
  • The app does not perform automatic diagnoses or medical recommendations
  • All therapeutic decisions must be based on in-person clinical assessment
  • In case of medical emergency, contact emergency services (911/112)

8. Data retention

Clinical data is retained for the minimum period required by the applicable health regulations in the country of use. As a general reference, clinical records are kept for a minimum of 5 to 10 years from the last appointment, in accordance with international health standards. After this period, data is securely and irreversibly deleted.

9. Cookies & advertising measurement (Meta)

We use our own and third-party cookies —including the Meta Pixel from Meta Platforms, Inc.— to measure the performance of our advertising campaigns and understand which content drives more sign-ups.

  • The Pixel and advertising cookies only load if you accept the consent banner.
  • If you reject consent, the app works normally and no advertising cookies are loaded.
  • We measure anonymous conversions (guide download, registration request). No patient clinical information is shared with Meta or any advertising third party.
  • For advanced attribution we use Meta's Conversions API (CAPI), which sends event data (e.g. SHA-256 hashed email) to Meta's server to complement the Pixel, complying with Meta's data policies.
  • Data sent to Meta is processed under Meta's Commercial Terms and its Data Processing Terms; Meta acts as a data processor for the purpose of measuring conversions.
  • Captured data (UTM source/medium/campaign) is retained for analytics purposes for up to 24 months.

You may withdraw your consent at any time by clearing your browser cookies; the banner will be shown again.

Contact & complaints

If you have any questions about how your data is processed or wish to exercise your rights, please contact the clinic directly. If necessary, you may also lodge a complaint with the data protection authority in your country. This policy may be updated periodically to reflect regulatory changes.

Privacy & Security Policy

Last updated: April 2026

PhysioFlow is committed to protecting patients' personal and clinical data with the highest level of security. Data processing complies with the General Data Protection Regulation (GDPR) of the European Union, as well as applicable health data protection regulations in each country of use, including HIPAA (USA), PIPEDA (Canada), and other equivalent international regulations.

1. Data we collect

We collect only the data strictly necessary to provide clinical services:

  • Identification data: name, phone, email
  • Clinical data: diagnosis, session history, pain scales, body maps
  • Medical documents voluntarily attached
  • Payment records (amounts, status)
  • Assigned exercise programs

2. Purpose of data processing

Your data is used exclusively for:

  • Clinical history management and therapeutic follow-up
  • Appointment scheduling and exercise programs
  • Administrative and billing management
  • Treatment-related communication

Your data will never be sold, transferred, or used for commercial or advertising purposes.

3. Security & storage

The following security measures are implemented:

  • Data encryption in transit via HTTPS/TLS
  • Access restricted exclusively to authorized professionals
  • Mandatory authentication to access the system
  • Automatic periodic backups
  • Infrastructure hosted on internationally certified secure cloud servers

4. Data access

Only the following have access to the data:

  • The physiotherapist or clinic responsible for the treatment
  • Staff expressly authorized by the data controller

Data is not shared with third parties unless required by law or with the patient's explicit consent.

5. Patient rights

In accordance with the GDPR and equivalent international regulations, patients have the right to:

  • Access: request a copy of their personal data
  • Rectification: correct inaccurate or incomplete data
  • Erasure: request deletion of their data ("right to be forgotten")
  • Objection: object to the processing of their data
  • Portability: receive their data in a readable, transferable format
  • Restriction: request limitation of processing

To exercise these rights, contact your physiotherapist directly.

6. Voice recordings

The app allows recording voice notes linked to patient records and clinical sessions. When using this feature:

  • Microphone access is requested only when the professional activates recording
  • Audio files are stored securely on encrypted servers
  • Recordings are accessible only to the authorized professional
  • AI transcription, translation or rewriting is performed only when explicitly requested by the professional from a voice note; the result must be reviewed before it is added to the clinical record
  • Patients may request deletion of any recording at any time

7. Important medical disclaimer

This app is a clinical management support tool and does NOT replace the clinical judgment of a healthcare professional.

  • Data entered is the responsibility of the physiotherapist recording it
  • The app does not perform automatic diagnoses or medical recommendations
  • All therapeutic decisions must be based on in-person clinical assessment
  • In case of medical emergency, contact emergency services (911/112)

8. Data retention

Clinical data is retained for the minimum period required by the applicable health regulations in the country of use. As a general reference, clinical records are kept for a minimum of 5 to 10 years from the last appointment, in accordance with international health standards. After this period, data is securely and irreversibly deleted.

9. Cookies & advertising measurement (Meta)

We use our own and third-party cookies —including the Meta Pixel from Meta Platforms, Inc.— to measure the performance of our advertising campaigns and understand which content drives more sign-ups.

  • The Pixel and advertising cookies only load if you accept the consent banner.
  • If you reject consent, the app works normally and no advertising cookies are loaded.
  • We measure anonymous conversions (guide download, registration request). No patient clinical information is shared with Meta or any advertising third party.
  • For advanced attribution we use Meta's Conversions API (CAPI), which sends event data (e.g. SHA-256 hashed email) to Meta's server to complement the Pixel, complying with Meta's data policies.
  • Data sent to Meta is processed under Meta's Commercial Terms and its Data Processing Terms; Meta acts as a data processor for the purpose of measuring conversions.
  • Captured data (UTM source/medium/campaign) is retained for analytics purposes for up to 24 months.

You may withdraw your consent at any time by clearing your browser cookies; the banner will be shown again.

Contact & complaints

If you have any questions about how your data is processed or wish to exercise your rights, please contact the clinic directly. If necessary, you may also lodge a complaint with the data protection authority in your country. This policy may be updated periodically to reflect regulatory changes.

We use cookies

We use our own and third-party cookies (Meta) to measure our advertising campaigns and improve your experience. They only load if you give your consent. You can reject them without affecting the app's functionality. See privacy policy