Privacy Policy

The Physiopedia AI Assistant (PAI) helps rehabilitation professionals by providing AI-powered educational support. We collect only the information necessary to create your account, provide the service, and improve it. We do not use your data to train AI models, and we never store or share identifiable patient information. Your data is securely stored in the EU and protected under GDPR.

Physiopedia International SL ("we", "us", "our" or "PPI") is committed to protecting and respecting your privacy. This Privacy Policy and the Terms and Conditions set out the basis on which any personal information we collect, or that you provide to us, will be processed by us. Please read the following carefully.

By using the Physiopedia AI Assistant ("PAI") and/or sharing personal information with PPI, you are accepting and consenting to the practices described in this Privacy Policy.

For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR") the data controller is Physiopedia International SL (company number 933846H), which has its registered address at CTRA. Del Prats Sobrians 003 14, Edifici Prats Sobrians Bloc A Escala A, Arinsal, AD400 La Massana, Andorra.

What This Privacy Policy Covers

This Privacy Policy pertains to your use of PAI and covers how PPI treats personal information that it collects and receives from its users.

This Privacy Policy is incorporated into and is subject to the Terms and Conditions. Your use of PAI and any information you provide is subject to the terms of this Privacy Policy and the Terms and Conditions.

The Information PPI Collects and How It Is Used

General Information Collection

2.1 The information PPI collects is set out in this section. Failure to provide such information may mean that you are unable to access PAI or register as a user.

2.2 You must subscribe to use PAI. We collect the following information:

2.2.1 Registration Information: When you register for PAI, you provide personal information including your name, email address, and payment information.

2.2.2 Cookies: PAI uses cookies to distinguish you from other users. This helps PPI to provide you with a good experience and allows us to improve PAI. For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy at https://pai.physio-pedia.com/cookie-policy.

2.2.3 Email Communications: If you send an email to PPI we may retain those communications and your email address in order to reply to your enquiries, fulfill your requests and to improve our services.

PAI Usage Information

2.3 When you use PAI, we collect the following information:

2.3.1 Conversation Data: We store your conversations with PAI (both your Input and PAI's Output) to maintain conversation history, improve service quality, and provide you with access to your previous interactions. This data is stored securely on our servers.

2.3.2 Usage Analytics: We collect information about how you use PAI, including frequency of use, features accessed, and interaction patterns. This helps us improve PAI and understand user needs.

2.3.3 Your IP Address: We may identify you in the PPI system by your IP address, the numerical address of the location from which you are connecting to PAI. This helps prevent abuse and fraud.

2.3.4 Technical Information: We collect information about the device and browser you use to access PAI, including device type, operating system, and browser type.

Important: Patient Information

2.4 You must NOT include any personally identifiable patient information in your conversations with PAI. We do not collect, and you must not provide, patient names, dates of birth, addresses, medical record numbers, or any other information that could identify a specific individual. Always anonymise case details before using PAI.

PAI includes automated filters to detect and prevent the submission of personally identifiable patient information. However, these filters are not foolproof, and you remain responsible for ensuring that no identifiable patient information is included in your Input. This protection does not diminish your obligation to anonymise all patient information.

How We Use Your Information

We use the information we collect for specific purposes that enable us to provide and improve PAI:

To Provide PAI Services to You

3.1 We use your account information (name, email, payment details) to:

Create and maintain your account
Process your subscription payments
Send you service-related communications (account confirmations, payment receipts, service updates)
Provide customer support when you contact us

This processing is necessary to fulfill our contract with you as a PAI subscriber.

To Maintain Your Conversation History

3.2 We store your conversations with PAI (your Input and PAI's Output) to:

Provide you with access to your previous conversations
Enable conversation continuity so PAI can reference earlier parts of your discussion
Allow you to review, search, and manage your conversation history

This processing is necessary to provide the core PAI service you've subscribed to.

To Improve PAI

3.3 We use aggregated and anonymized usage data to:

Improve PAI's accuracy and clinical relevance
Develop new features and capabilities
Identify and fix technical issues
Understand how physiotherapists and students use PAI for learning and professional development

This anonymized data cannot be traced back to you individually. This processing is based on our legitimate interest in improving our service, balanced against your privacy rights.

To Protect Security and Prevent Abuse

3.4 We use technical information (IP addresses, device information) and usage patterns to:

Prevent fraud and unauthorized access
Detect and prevent misuse of PAI
Maintain the security and integrity of our systems

This processing is based on our legitimate interest in protecting our service and users.

Legal Compliance

3.5 We may use your information where required by law, such as:

Responding to legal requests from authorities
Complying with tax and accounting requirements
Enforcing our Terms and Conditions

3.6 Where we rely on legitimate interests to process your data, we carefully balance our interests against your privacy rights. You have the right to object to processing based on legitimate interests - see Section 12 for details on your rights.

Legal Bases for Processing

3.7 We rely on the following lawful bases under the GDPR:

Contract: To provide PAI and manage your subscription.
Legitimate Interests: To improve PAI, prevent abuse, and ensure security.
Legal Obligation: To comply with tax, accounting, and legal requirements.
Consent: For optional communications and any future AI model training participation.

Third-Party Service Providers

We use carefully selected third-party service providers to help us operate PAI. These providers process data on our behalf under strict contractual terms and security standards.

AI Processing Services

4.1 We use third-party services in the provision of PAI services:

These providers operate under zero data retention policies, meaning they do not store your conversations or use them for any other purpose
Your conversation data is processed solely to provide you with the service and is not retained by the provider

Payment Processing

4.2 We use trusted payment processors (RevenueCat and Stripe) to handle subscription payments securely:

Payment card information is collected and processed directly by these payment processors
We do not store your complete payment card details on our servers
These processors maintain PCI-DSS compliance for secure payment handling

Infrastructure and Hosting

4.3 We use Google Cloud infrastructure located in the Netherlands to host and operate PAI:

Your account information and conversation history are stored on Google Cloud servers
Google Cloud provides the computing infrastructure but does not access or use your data
All data remains within the European Union on servers in the Netherlands

When We May Share Your Personal Information

4.4 We may share your personal information only in the following limited circumstances:

Legal Requirements: We may disclose information when required by law, court order, or government regulation, or to protect the rights, property, or safety of PPI, our users, or others.
Business Transfers: In the event that PPI is acquired by or merged with another company, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.
With Your Consent: We may share information with third parties when you have given us explicit permission to do so.

4.5 We do not sell your personal information to third parties. We do not share your conversation data with anyone except as necessary to provide you with PAI's AI responses through our zero-retention third party processors.

Your Choices

5.1 When you register for PAI, we ask you to provide us with certain personal information. If we want to use your personal information for purposes other than those described in this Privacy Policy, we will provide you with an effective way to opt-in to such use.

5.2 We will not collect or use personal information for reasons other than those described in this Privacy Policy, unless we obtain your prior consent. You can decline to submit personal information to us, in which case you will not be able to use PAI.

5.3 You may receive periodic emails from us regarding PAI updates, new features, and service announcements. You can opt-out of marketing emails by clicking the unsubscribe link at the bottom of any marketing email. Please note that you cannot opt-out of essential service communications related to your account and subscription.

Where We Store Your Personal Information

6.1 Your data is processed and stored on Google Cloud infrastructure located in the Netherlands. We have selected this location to ensure your data remains within the European Union and benefits from European data protection standards, including GDPR compliance.

6.2 All information you provide to us is stored on secure servers. Any payment transactions are encrypted using industry-standard SSL technology. Where we have given you (or where you have chosen) a password which enables you to access PAI, you are responsible for keeping this password confidential. We require you not to share your password with anyone.

Information Security

7.1 We implement industry-standard technical and organisational security measures to protect your data, including encryption, access controls and regular security assessments. We are committed to maintaining the confidentiality, integrity and availability of your information.

7.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How Long We Store Your Personal Information

We will store your personal information:

8.1 Account Information: For as long as your account remains active, unless you ask us to remove it.

8.2 Conversation Data: We store your conversations with PAI for as long as your account is active to provide you with conversation history and to improve service quality. You may delete individual conversations at any time through your account settings.

8.3 Payment Information: We retain payment transaction records as required by law and accounting standards.

8.4 After Account Deletion: Following account deletion, we will delete or anonymise your personal information within 30 days, except where we are required to retain certain information for legal or regulatory compliance.

Use of Data for Service Improvement

9.1 We may use anonymised and aggregated conversation data to improve PAI's performance, accuracy, and functionality. This anonymized data cannot be traced back to individual users.

9.2 We do not use your individual conversation data to train our underlying AI models without your explicit consent.

Updating Personal Information

You may update your personal information or prevent or restrict processing of your personal information by visiting your account settings or contacting us at [email protected].

Your Rights

Under data protection law, you have a number of rights concerning the data we hold about you. If you wish to exercise any of these rights, please contact us using the contact details set out below.

The right to be informed. You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we're providing you with the information in this policy.
The right of access. You have the right to request certain information about, access to and copies of your personal information (if we're processing it). You are entitled to request one detailed summary of that personal information at no cost, but for any further requests we reserve the right to charge a reasonable fee based on administration costs.
The right to rectification. You are entitled to have your information corrected if it is inaccurate or incomplete.
The right to erasure. This is also known as 'the right to be forgotten' and enables you to request the deletion or removal of certain information that we hold about you. However, please note that this will not apply if we are required to retain the information for compliance with a legal obligation.
The right to restrict processing. You have rights to request that we stop using your personal information or limit the way in which we use it. When processing is restricted, we can still store your information, but will not use it further.
The right to data portability. You have the right to request that we return your personal information in an accessible and transferable format, or that we send it directly to another company, where technically feasible.
The right to withdraw consent. If you have given your consent to anything we do with your information (i.e. where we rely on consent as a legal basis for processing your information), you have the right to withdraw that consent at any time.
The right to object to processing. You have the right to object to certain types of processing where we use it for our legitimate interests or for marketing purposes.

11.1 You can exercise your rights free of charge, but we reserve the right to charge a reasonable fee for requests which are repetitive, manifestly unfounded or excessive, in accordance with applicable law.

11.2 We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

11.3 We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Deleting Your Personal Information

The account cancellation facility allows you to request that all personal information relating to you be deleted from PAI and our database. We will honour your request provided the personal information is not required for compliance with a legal obligation or for the establishment, exercise or defense of a legal claim.

Complaints and Problems

13.1 If you have a complaint or problem or would like any personal information relating to you corrected or deleted, please email us at [email protected]. We will forward your complaint, problem or request to the appropriate department for a response or resolution.

13.2 Personal information will be corrected or deleted, as applicable, as soon as possible following receipt of the request. We try to answer every email within 2 business days, but may not always be able to do so.

13.3 If you are not satisfied with our response, you may lodge a complaint with the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades, www.apda.ad) or with your local supervisory authority.

Limitations on Removing or Changing Information

Upon your request, we will delete your personal information from our active databases and where feasible from our back-up media. You should be aware that it may not be technologically possible to remove each and every record of the information you have provided to us from our servers. Deleting your account will prevent you from accessing your conversation history.

Notification of Data Breaches

In the event of a data breach we will endeavor to alert all affected users within 72 hours after we become aware of the full details of the data breach.

Our Commitment to Children's Privacy

Protecting the privacy of young children is especially important. PAI is not intended for persons under 18. If you are under 18 years of age, then please do not use or access PAI at any time or in any manner. We do not knowingly collect personal information from persons under 18 years of age.

International Users

PAI is hosted in the Netherlands on Google Cloud infrastructure and is intended for users globally. If you are accessing PAI from outside the European Union, please be advised that through your continued use of PAI, which is governed by European data protection standards, you are transferring your personal information to the European Union and you consent to that transfer and to the application of GDPR protections.

Changes to This Policy

This Privacy Policy may change from time to time. We will post those changes on this page and, if the changes are significant, we will provide prominent notice. Please revisit this page frequently to stay aware of any material changes.

Your continued use of PAI constitutes your agreement to this Privacy Policy and any future revisions. Please discontinue use of PAI immediately if you do not agree to the terms of this Privacy Policy or any revised policy.

Contact

For more information about our privacy practices, or if you have any questions about this Privacy Policy, please email [email protected].

Privacy Policy Definitions

Personal information: Information that enables us to identify you directly or indirectly.
Non-personal information: Information which does not identify individuals, whether on its own or in conjunction with other information collected by us. This includes information that is collected from many people, anonymized and aggregated into groups so that individual users cannot be identified.
Collected information: Both the personal and non-personal information that we collect from users.
Input: Questions, prompts, case details or instructions you provide to PAI.
Output: Responses generated by PAI based on your Input.
Conversation Data: Your Input and PAI's Output together.
Opt-in: Actively indicating your preference to participate in a program, email, feature, tool, or enhancement. Typically requires you to provide certain information or check a box to indicate your choice to participate.
Opt-out: Taking action to indicate your preference NOT to participate in a program, email, feature, tool or enhancement. Typically requires you to uncheck a box or click an unsubscribe link.