Privacy Policy

General Notice and Mandatory Information

The responsible entity for data processing in this app and on this website is: physiopass.eu Friederike Dethleff Am Schellbruch 34 23568 Lübeck The responsible entity decides alone or jointly with others on the purposes and means of processing personal data (e.g., names, contact details, etc.).

Revocation of Consent to Data Processing

Certain data processing operations are only possible with the express consent of the data subject. Consent that has already been granted may be revoked at any time. An informal notification by email is sufficient for the revocation. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation. Right to lodge a complaint with the competent supervisory authority: The data subject has the right to lodge a complaint with the competent supervisory authority in the event of a data protection violation. The competent supervisory authority regarding data protection matters is the State Data Protection Officer of the federal state in which our company is based. The following link provides a list of data protection officers and their contact details: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Rights of the Data Subject (Art. 15–22 GDPR)

Within the framework of applicable legal provisions, the data subject has the following rights regarding their personal data: Right of access (Art. 15 GDPR): The data subject may request free information about the personal data stored about them, its origin, its recipients, and the purpose of processing at any time. Right to rectification (Art. 16 GDPR): The data subject may request the correction of inaccurate or the completion of their personal data stored with us. Right to erasure (Art. 17 GDPR): The data subject may request the deletion of the personal data stored about them, unless processing is required for exercising the right of freedom of expression, for compliance with a legal obligation, or for reasons of public interest. Right to restriction of processing (Art. 18 GDPR): The data subject may request the restriction of processing of their personal data if they contest the accuracy of the data, the processing is unlawful, we no longer need the data, or they have objected to the processing. Right to data portability (Art. 20 GDPR): The data subject has the right to receive data that we process automatically on the basis of their consent or in fulfilment of a contract, in a machine-readable format, for themselves or for a third party. Right to object (Art. 21 GDPR): If personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, the data subject has the right to object to the processing pursuant to Art. 21 GDPR, providing grounds relating to their particular situation. Automated decision-making (Art. 22 GDPR): No automated decision-making, including profiling, takes place that produces legal effects concerning the data subject or similarly significantly affects them. For this purpose and for further questions on the subject of personal data, the data subject may contact us at any time via the contact options listed in the legal notice.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content that users send to us, our app and website use SSL or TLS encryption. This means that data transmitted via this app or website cannot be read by third parties. An encrypted connection can be recognised by the "https://" address line of the browser and the lock icon in the browser bar.

Server Log Files

The website provider automatically collects and stores information in server log files that the user's browser automatically transmits to us. These are: pages visited on our domain, date and time of the server request, browser type and browser version, operating system used, referrer URL, hostname of the accessing computer, and IP address. This data is not merged with other data sources. The basis for data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.

Contact Form

Data transmitted via the contact form, including the user's contact details, is stored in order to process the enquiry or to be available for follow-up questions. This data will not be disclosed without the user's consent. The processing of data entered in the contact form is carried out exclusively on the basis of that consent (Art. 6(1)(a) GDPR). Consent that has already been granted may be revoked at any time. An informal notification by email is sufficient for the revocation. The lawfulness of data processing operations carried out until the revocation remains unaffected by the revocation. Data transmitted via the contact form will remain with us until the user requests deletion, revokes their consent to storage, or the purpose for data storage no longer applies. Mandatory statutory provisions — in particular retention periods — remain unaffected. The message is delivered by email to the contact address named in the legal notice. Delivery is carried out by Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, acting as a processor solely for the purpose of transmitting the email. Data transfer to the USA is carried out on the basis of Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. Further information: https://resend.com/legal/privacy-policy.

Cookies and local storage

The app sets no cookies. Cookies are a web browser technology and are not used in the app. Nor does the app read any advertising or tracking identifier provided by the operating system (such as the IDFA on iOS or the Advertising ID on Android), and no cross-device tracking takes place. The website loads a Google Ads conversion tag only after express consent via the notice banner (Google Consent Mode v2). Until then, ad_storage, ad_user_data, ad_personalization and analytics_storage remain set to “denied”; no advertising cookies are set. Closing the banner dismisses the notice without granting that consent. Without any consent, the website also counts in aggregate how often the notice is accepted, declined or closed and how often an app store link or a link to the therapist console is clicked. For this, the browser sends a first-party request to physiopass.eu containing only the event type and the page language; nothing is stored on or read from the device, the request carries no identifier, and the IP address, user agent and referrer are neither read nor stored for the count. The count is not linked to any person and is used only to assess the reach and the consent rate of the website and advertising. The hosting provider processes the request technically like any other page request (see section 17). The banner offers “Accept” and “Decline” with equal prominence; declining grants nothing. The store QR codes on the website point to short links on physiopass.eu (/go/ios, /go/android). A scan is counted anonymously and without any identifier, then forwarded to the store with a campaign tag; nothing else is read or stored. The OpenAI Measurement Pixel also loads only after consent and may then set the first-party __oppref cookie to attribute a click on a ChatGPT ad. Vercel Web Analytics also loads only after consent; it is a cookieless server-side page-view counter that collects pseudonymous metrics on the page visited, the referrer URL, coarse location (country/city), and device, operating system and browser. The therapist console at app.physiopass.eu likewise loads Vercel Web Analytics only after an optional opt-in in the clinic workspace; until then the tracker is not requested. That consent is stored in this origin's local storage and does not apply to physiopass.eu, because the two origins do not share local storage. Query parameters that identify a tab, program, exercise, form or similar object are stripped before a page view is sent.

The website stores five entries in the browser's local web storage. This data remains on the user's device and is transmitted neither to us nor to any third party. physiopass_lang (localStorage, retained until the user deletes it) stores the language the user has explicitly selected via the language switcher or a ?lang= parameter, so that the site appears in that language on a return visit; a language merely detected from browser settings is not stored. physiopass_lang_redirected (sessionStorage, deleted when the browser tab is closed) records that a one-off redirect to a language version has already taken place in this tab and prevents repeated redirects. physiopass_consent (localStorage, retained until the user deletes it) stores the date and time at which the notice banner was dismissed, so that it is not displayed again on every visit. physiopass_ads_consent (localStorage, retained until the user deletes it) records that the data subject accepted the Google Ads conversion tag and the OpenAI Measurement Pixel, so that the tag can be configured on a return visit. Merely closing the banner does not write this entry. physiopass_analytics_consent (localStorage, retained until the user deletes it) records that the data subject consented to Vercel Web Analytics, so that the page-view counter can be loaded on a return visit. Merely closing the banner does not write this entry either.

The therapist console (app.physiopass.eu) stores three entries in the browser's local web storage on its own origin. This data remains on the user's device and is transmitted neither to us nor to any third party. physiopass_analytics_consent (localStorage, retained until the user deletes it) is written only if the data subject opts in to Vercel Web Analytics on the therapist console, so that the page-view counter can be loaded on a return visit. Until that entry exists, the tracker is not loaded. physiopass_recent_shares (localStorage, retained until the user deletes it) stores, for each signed-in user, the programs most recently shared from the console and when they were shared, so they can be shared again. physiopass_share_default (localStorage, retained until the user deletes it) stores, for each signed-in user, which share method was last used (QR code, PDF, link, or the device share sheet), so that method is preselected next time. Consent given on physiopass.eu does not apply to app.physiopass.eu, and vice versa. The one connection is the sign-in measurement: after a sign-in, the console loads a blank page from physiopass.eu in a hidden frame. Nothing about the account is passed to it. That page applies the consent given on physiopass.eu: if ads consent was granted there, it reports to Google Ads that a sign-in took place; otherwise it only adds to the anonymous count described in this section. In addition, the therapist console sets one first-party cookie, physiopass_ui_locale, only when the user selects a language on the sign-in page or in the console. It stores the chosen language code for one year, so that the console appears in that language on the next visit, including before sign-in. The browser sends it to our server with page requests; it contains no identifier and is not shared with third parties. A language that is merely detected is not stored: to choose the initial language, the console reads the browser's language settings and the country that the hosting provider derives from the IP address and passes on in a request header, and neither is retained for this purpose.

The app stores data in the protected app area of the device. This data remains on the device and is accessible only to the app. Specifically: (a) the sign-in session, meaning the access and refresh tokens issued by Supabase Auth, so that the user remains signed in after closing the app; (b) app settings and interface state, namely the selected language, the sound and autoplay setting, the training reminder settings (enabled yes/no, time of day, weekdays), the most recently used filters and list views, and a record of which one-off hints have already been shown; (c) the progress of a workout in progress, meaning the identifiers of the exercises it contains, the current position and the name of the training plan, so that an interrupted workout can be resumed; (d) a media cache in which already downloaded exercise images and videos are temporarily stored to reduce loading times and data usage; (e) the local caches of the services used (see sections 10, 11 and 13), such as error reports not yet transmitted and the last known subscription status; and (f) a queue of workouts that could not be saved: if saving a completed workout to the database fails, the entry is kept locally and transmitted again later. Each entry consists of an identifier for the workout, the identifiers of the exercises performed, the identifier and the name of the training plan if the workout was started from one, the point in the app from which it was started, its start time, and the user identifier recorded at the start of the workout. An entry is deleted as soon as the workout has been saved successfully, and in any event no later than 30 days after its start time. Entries are not deleted on sign-out and may therefore still be present on a shared device at a subsequent sign-in. In addition, (g) an offline copy of the user's content: so that the app can show something without an internet connection, it keeps on the device a copy of the most recently loaded content of the user's account, namely the user's exercises and programs including their text, the user's favourites and recently used items, a section of the exercise catalogue, and the daily activity summaries shown on the home screen (date, minutes and mood rating). Each list is limited to 50 entries, the files are protected by the device's data protection and excluded from device backups, and they are replaced whenever the content is reloaded. The copy is deleted on sign-out, when the account is deleted and when the sign-in session ends for any other reason.

The strictly necessary storage entries, both on the website and in the app, are required in order to provide the digital service the user has explicitly requested and are therefore exempt from consent under Section 25(2) no. 2 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz; named TTDSG until 14 May 2024). The notice displayed on the website collects consent for the Google Ads conversion tag, the OpenAI Measurement Pixel and Vercel Web Analytics under Section 25(1) TDDDG and Art. 6(1)(a) GDPR if the data subject accepts. Closing the banner does not grant that consent. On the therapist console, Vercel Web Analytics is loaded only after the data subject opts in (navigation or My clinic) under Section 25(1) TDDDG and Art. 6(1)(a) GDPR; until then no page-view tracker is requested. That consent can be withdrawn at any time under My clinic. Product analytics in the app are a further exception: the analytics function is disabled when the app starts and is activated only after explicit consent; that consent is obtained under Section 25(1) TDDDG and Art. 6(1)(a) GDPR and can be withdrawn at any time in the app settings (see section 11).

The browser's local storage can be inspected and cleared in any modern browser (settings, clear browsing or site data). If these entries are deleted or blocked, the website remains fully usable; the language simply has to be selected again and the notice reappears. In the app, the progress of a workout is deleted once it is completed or discarded, and the sign-in session and the offline copy of content are deleted on sign-out. All other locally stored data is removed when the app is uninstalled or its storage is cleared via the device's system settings; the media cache is additionally capped in size and pruned periodically. If this data is deleted, the app remains fully usable; the user then has to sign in again and set their preferences again.

The provider of the conversion tag is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (see also section 14). Further information: https://policies.google.com/privacy The provider of the OpenAI Measurement Pixel is OpenAI, Inc., USA. The transfer of data to the USA is based on the EU-US Data Privacy Framework and, where required, Standard Contractual Clauses (SCCs). Further information: https://openai.com/policies/privacy-policy/ The provider of Vercel Web Analytics is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. The transfer of data to the USA is based on Standard Contractual Clauses (SCCs) and Vercel's certification under the EU-US Data Privacy Framework (DPF). Further information: https://vercel.com/legal/privacy-policy

Supabase (Database, Authentication, Storage)

Our app uses Supabase as its backend infrastructure. The provider is Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 (infrastructure operated on Amazon Web Services, AWS). Purpose: Supabase is used for user authentication (email/password login and login via a Google or Apple account, see section 14), data storage (profiles, exercises, activities, workout plans, invitations), and file storage (videos, images). Data processed: email address, name, user role, exercise programs, workout history, uploaded media files and, where the user has given explicit consent, a pain score recorded for an activity. Legal basis: Art. 6(1)(b) GDPR (contract performance — processing is necessary to provide the app's functionality) for account, exercise, activity and media data. A pain score is health data in the sense of Art. 9 GDPR and is stored only on the basis of Art. 9(2)(a) GDPR (explicit consent). Before a pain score is saved, the app shows a just-in-time consent sheet. The user can allow storage or decline. Declining stores nothing; workouts and programs continue to work. Consent can be withdrawn at any time under Settings → Privacy; withdrawal deletes the stored pain scores. Pain scores already stored before this consent was asked stay hidden and are not processed until the user allows them or deletes them. If the user does not answer, those earlier scores are deleted on a fixed date, 90 days after the feature is switched on. The pain score is not shared with the therapist. Data location: EU (Frankfurt, Germany, AWS eu-central-1). Further information: https://supabase.com/privacy.

xAI / Grok API (AI Assistant "Jana")

Our app offers an AI-powered physiotherapy assistant called "Jana". The provider is SpaceXAI LLC ("xAI"), a company based in the USA. Purpose: Answering the user's health-related questions using xAI's AI model "Grok". Data processed: Only the text of the question, together with a pseudonymous technical identifier (no name and no email address) that allows xAI to attribute misuse of its service, is transmitted to the xAI API, and only after the user has given explicit consent on a just-in-time sheet shown together with the assistant's notice. Physiopass does not store the question or the answer: the text is held in memory only while that sheet is open and is then discarded. Physiopass uses xAI's Zero Data Retention mode for these requests: xAI processes the question and the answer only transiently in order to generate the answer and deletes them as soon as the answer has been delivered, and in any event no later than one hour after the request has been processed. xAI keeps no logs, backups or other copies of them, including for security or legal purposes. xAI does not use data submitted via the API to train its models. Declining blocks every free-text question to Jana. Consent can be withdrawn at any time under Settings → Privacy; withdrawal stops future questions. Legal basis: Art. 9(2)(a) GDPR (explicit consent) for the health question, together with Art. 6(1)(a) GDPR for the associated processing. Third-country transfer: Data is transferred to the USA and may also be processed in other countries in which xAI and its sub-processors operate. The transfer is carried out on the basis of Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, which form part of xAI's Data Processing Addendum. Further information: https://x.ai/legal/data-processing-addendum.

Voice input: The question field can be filled by dictation. The app then uses the speech recognition of the operating system (Apple Speech on iOS, the speech recogniser of the device on Android), which converts the microphone signal to text. Where the language and the device allow it, recognition runs on the device; otherwise the provider of the operating system (Apple, Google or the device manufacturer) may process the audio on its servers under its own privacy terms. Physiopass receives and stores no audio and forwards none to xAI: only the recognised text appears in the question field, and it is transmitted to xAI only when the user sends the question, subject to the consent described above. Dictation needs the microphone permission and, on iOS, the speech recognition permission; both can be withdrawn at any time in the device settings, and the question can always be typed instead.

The same voice input is also available in the text fields for creating and editing exercises and programs (name, comment and exercise steps). Recognition works as described above. The recognised text appears in the respective field and is stored in the Physiopass database, like typed text, only when the user saves the exercise or program; it is not transmitted to xAI. Here, too, Physiopass receives and stores no audio.

Exercise suggestions and pictures: After an answer, the user can ask Jana to turn it into exercise suggestions. For this, the text of that answer (not the user's question) is sent to xAI under the same conditions as above (consent, pseudonymous technical identifier, Zero Data Retention) and returned as a structured suggestion, which Physiopass checks before showing it. Nothing is saved until the user adds it. For users with a Pro subscription, a picture of an exercise can additionally be generated: only the name, the starting position and the first steps of that exercise are sent to xAI's image model, without name, email address or any identifier of the user, and xAI processes them only to generate the picture. The picture is stored in the Physiopass database like an uploaded image, until the user deletes it or the account. To enforce daily limits, Physiopass records only the type, the token count and the time of each such request, without content, until account deletion. Legal basis: Art. 6(1)(b) GDPR for the picture; the suggestions rest on the consent described above.

Sentry (Error and Crash Reporting)

Physiopass uses Sentry to detect and resolve errors in its mobile app and therapist console (app.physiopass.eu). The provider is Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Purpose: error detection, crash reporting, and improving application stability. Data processed: in the mobile app, device information (model, operating system, app version); in the therapist console, browser, operating-system, and console-version information; in both applications, error logs (stack traces) and sanitized technical event trails (breadcrumbs) from immediately before the error. Screenshots and session replay (screen recordings) are disabled in both applications; no screen content, user identifier, health data, program or user content, request body, or identifying URL parameter is transmitted to Sentry. This data is used solely for debugging and is automatically deleted after 90 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stability and security of the applications). Third-country transfer: Data transfer to the USA is carried out on the basis of Standard Contractual Clauses (SCCs) and Sentry's certification under the EU-US Data Privacy Framework (DPF). Further information: https://sentry.io/privacy/.

PostHog (Product Analytics)

We use PostHog to analyse app usage. The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Data is processed on EU servers (eu.i.posthog.com, located in Frankfurt, Germany). Purpose: Understanding app usage to improve features and user experience. Data processed: pseudonymised user ID, user role, app version, platform, screen views, interactions with UI elements. No health data is collected. Legal basis: Art. 6(1)(a) GDPR (explicit consent — users are asked for their consent during onboarding). Consent can be revoked at any time in the app settings. Third-country transfer: No third-country transfer takes place — data remains on EU servers in Frankfurt. Retention period: 12 months. Further information: https://posthog.com/privacy.

Usage statistics for shared training programs

Therapists can share training programs with users via QR code, link, PDF or the device's share sheet. So that a therapist can see whether a program they shared is being used, and adjust the therapy if needed, we compile weekly statistics for each shared program and show them in the therapist account from which it was shared. Each share of a program (for example a QR code or link) counts as a separate shared program for these statistics.

What is counted. For each shared program we count: (1) how often it was opened in the app or viewed via its web link; (2) how often it was imported into the app or delivered to a recipient; and (3) for workouts started from that program in the app, including when the app is used without an account, how many sessions were started, how many were completed and how many exercises were done.

How it is counted. Counting takes place exclusively on our servers. Opens and web views are counted when the program is requested from our servers in order to display it. Session and exercise counts are derived from the workout entries that the app already saves to provide the training history. No additional data is sent from the user's device for these statistics, and no information is stored on or read from the user's device for this purpose. The counters contain only the shared program, the calendar week and the type of event. They contain no name, email address, user or account ID, device identifier, IP address or other identifier.

Protection against identifying individuals. Statistics are shown in fixed calendar weeks only. Any value from 0 to 4 is shown as "<5" instead of the exact number, and any total that includes such a value is shown only as a minimum (for example "≥12"). Session and exercise counts for a shared program are shown only once that shared program has been delivered to at least five different recipients. To check this threshold, our servers count the number of different recipients; only that number is used and it is not shown. These rules are applied on our servers before any figure leaves our systems, and they apply equally to the export as a CSV file.

Recipients. The statistics are shown only to the therapist account that shared the program. They are not disclosed to employers, health insurers or other third parties and are not used for advertising. The data is stored with our hosting provider Supabase (see section 8), which acts as our processor.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest, and that of the therapist, is to let the therapist see whether a program they shared is being used, so that they can support and adjust the therapy, without disclosing the training data of any individual. Insofar as session and exercise counts are derived from workout entries originally stored to provide the training history (Art. 6(1)(b) GDPR), this further processing is compatible with the original purpose within the meaning of Art. 6(4) GDPR: it concerns the same service and the program that the therapist provided, and only aggregated, masked counts without identifiers are produced.

Right to object. The data subject may object to this processing at any time (Art. 21 GDPR). The easiest way is the setting "Exclude me from usage statistics" in the app's settings, which also works without an account. From then on, their workouts are no longer included in these statistics. Alternatively, the data subject can object by email to the contact address in the legal notice; if the app is used without an account, we may be unable to identify their data from an email alone (Art. 11(2) GDPR), so the in-app setting should be used in that case. When an account is deleted, its workouts are no longer counted. Figures that have already been compiled contain no identifier and can no longer be attributed to the data subject (Art. 11 GDPR).

Retention. The weekly counters are deleted after 12 months. The underlying workout entries are kept in accordance with section 16 (Data Retention Periods).

RevenueCat (In-App Subscription Management)

We use RevenueCat to process and manage in-app subscriptions. The provider is RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. Purpose: management of in-app subscriptions, validation of purchases against the App Store or Google Play, and synchronisation of entitlement status across the user's devices. Data processed: pseudonymised user ID (App User ID; it corresponds to the user ID of the user's Physiopass account but does not itself contain any plain-text personal details), device and store identifiers assigned by the platform, purchase and subscription status (product, start, expiry, renewal, cancellation, refund) and the country of the store account. Email address, name and health data are not transmitted to RevenueCat. Payment data (e.g. card details) is processed exclusively by Apple or Google; neither we nor RevenueCat receive it. RevenueCat sends subscription events back to us via an interface so that we can keep the subscription status in the user's account up to date. The SDK is initialised when the app starts so that an existing subscription can be recognised across devices. Legal basis: Art. 6(1)(b) GDPR (performance of a contract — the processing is necessary to provide and bill paid features and to restore purchases). Third-country transfer: The transfer of data to the USA takes place on the basis of Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR; there is no certification under the EU-US Data Privacy Framework (DPF). Retention: subscription and purchase data in our database until the user's account is deleted; at RevenueCat for the duration of the contractual relationship in accordance with the data processing agreement. Further information: https://www.revenuecat.com/privacy.

Sign-in with Google or Apple

The app offers sign-in via a Google or Apple account. Use of this option is voluntary; signing in with an email address and password remains fully available. If the user chooses this option, the operating system opens a sign-in dialog belonging to the respective provider; the credentials of the provider account are entered there only and never reach us. The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. These providers process the sign-in as independent controllers and not as our processors; in doing so they learn that the user signed in to Physiopass, as well as the time and the device of the sign-in. Data received: after a successful sign-in we receive from the provider a persistent identifier of the provider account, the email address and, where transmitted by the provider, the given and family name. This data is associated with the Physiopass account and stored like the remaining account data pursuant to section 8. No further data from the provider account — in particular contacts, calendars or stored content — is requested or transmitted. If the user selects Apple's "Hide My Email" option, Apple transmits a provider-generated relay address (@privaterelay.appleid.com) instead of the personal email address; that address is the email address of the account and is treated as such. Legal basis: Art. 6(1)(b) GDPR (performance of a contract — the processing is necessary to set up and use the account). Third-country transfer: the contracting parties are the Irish entities named above; insofar as the providers transfer data to the USA, they rely on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and on their certification under the EU-US Data Privacy Framework. Retention: the link to the provider account exists until the Physiopass account is deleted. Further information: https://policies.google.com/privacy and https://www.apple.com/legal/privacy.

Fonts

Our website uses the Inter font for headings and individual highlighted text elements; it is hosted locally on our web server (self-hosting). Body text is rendered in the system font already present on the user's device; no font file is downloaded for this. Our app likewise uses the device's system font; the Lato font bundled locally within the app is used solely for generating PDF files (exercise export). In no case is a connection to external font servers (such as Google Fonts) established. Accordingly, no data is transmitted to third parties for font rendering.

Data Retention Periods

We store personal data only for as long as necessary for the respective purposes: User account data (email, name, role): until account deletion. Exercise and workout data: until account deletion. Activity data: until account deletion. Pain scores: until the user withdraws consent under Settings → Privacy, which deletes them, or until account deletion. Pain scores stored before consent that the user has not answered are deleted on the fixed date 90 days after the feature is switched on. Consent records (the purpose, whether it was allowed, the notice version and the time): until account deletion. Sentry error data: 90 days (automatically deleted). PostHog analytics data: 12 months (EU servers). Usage statistics for shared training programs: 12 months. Subscription and purchase data (RevenueCat): until account deletion; at RevenueCat for the duration of the contractual relationship. AI questions (xAI): the question text is not stored by Physiopass; xAI deletes it as soon as the answer has been delivered (Zero Data Retention). Technical log entries for Jana (model and token counts, without the question or the answer): 13 months, and on account deletion. Server log files: 7 days. Contact form data: until the purpose is fulfilled or the user requests deletion. Account deletion: Users can permanently remove their account and all associated data at any time directly in the app via the ‘Delete Account’ function. Deletion takes effect immediately and irreversibly: the account and all associated data (profile, exercises, programs, activity and progress data, and uploaded images and videos) are permanently deleted from our systems and cannot be restored. Alternatively, deletion can be requested at any time informally by email. Any mandatory statutory retention obligations remain unaffected.

Sub-Processors and Data Protection Officer

The following sub-processors are used to provide our services: Supabase Inc. (database, authentication, storage) — EU (Frankfurt), AWS eu-central-1. SpaceXAI LLC / xAI (AI assistant) — USA and other countries, Standard Contractual Clauses (SCCs). Functional Software, Inc. / Sentry (error reporting) — USA, SCCs + EU-US DPF. PostHog, Inc. (product analytics) — EU (Frankfurt), no third-country transfer. RevenueCat, Inc. (in-app subscription management) — USA, Standard Contractual Clauses (SCCs). Apple Inc. / Google LLC (app distribution via App Store / Google Play) — USA, platforms' own privacy policies. Google Ireland Limited and Apple Distribution International Ltd. (sign-in via a Google or Apple account, see section 14) — Ireland; in this respect these providers act as independent controllers and not as processors. Plus Five Five, Inc. / Resend (delivery of contact form emails) — USA, Standard Contractual Clauses (SCCs). Vercel Inc. (Vercel Web Analytics) — USA, Standard Contractual Clauses (SCCs) + EU-US DPF. Data Protection Officer: The appointment of a Data Protection Officer is not mandatory for our operation pursuant to Art. 37 GDPR. For data protection enquiries, the responsible entity named in section 1 should be contacted.

Waiting lists for practices (therapist console)

The therapist console (app.physiopass.eu) offers enabled practices a waiting list for patients waiting for a freed-up appointment. The practice that runs the list (the list owner) is the controller of the patient data stored in it. Physiopass processes this data on its behalf as a processor (Art. 28 GDPR) under a data processing agreement. The legal basis on the practice's side is the treatment relationship (Art. 6(1)(b), Art. 9(2)(h) GDPR).

Data stored. Per entry: name, prescription, number of sessions, urgency, wanted time window and time conditions, therapist preferences, phone numbers, notes, and appointments already arranged or assigned through the list. It is also stored which member created and last changed an entry. The data is held by Supabase (EU, Frankfurt, see section 8). Only the members of the respective list have access.

Sharing the list. The list owner can invite colleagues by email. The invitee's email address is stored until the invitation is accepted, withdrawn or expires (14 days) and is sent through the email service Resend. It is then deleted. Members of a list see the name and email address of the other members.

Dictation. When dictating, the recording is transmitted only after the recording button is pressed and only for that action, to our server and from there to xAI (USA, see section 9) for transcription and analysis. xAI processes the data without storing it (Zero Data Retention). Physiopass stores neither the recording nor the transcript. To limit usage, only a count record with time, duration, file size and result (without content) is stored per dictation. The suggested changes are applied to the entry only after the user confirms them.

Practice calendar. Practices whose console language is German can keep an appointment calendar alongside the list. It stores a shared patient directory (name, phone numbers, note), appointments (patient, therapist, start and end, remedy, status and, where applicable, the reason for cancellation), appointment series, therapist absences and details from medical remedy prescriptions (date of issue, urgency, remedies, treatment units, frequency, diagnosis group, ICD-10 code, home visit, therapy report, payer). The diagnosis group and ICD-10 code are health data (Art. 9 GDPR). Controllership, legal basis, storage location and access are as described above. Past appointments are kept indefinitely unless the list owner sets a shorter period (in months) in the calendar settings; appointments that ended longer ago than that period are then deleted automatically every day.

Retention. Archived entries are deleted automatically 360 days after archiving; individual entries can be deleted at any time. If the owner's account is deleted, the entire list including all entries, appointments and invitations is deleted and the other members lose access. If a member's account is deleted, that member's access ends; the entries they created remain in the list.

Last updated: October 2026