PhysioAI · rehabilitation exercise mobile app
Last updated: 19 September 2026 · Version 1.4 · Data controller: PhysioAI · Contact: alvrmjs.dev@gmail.com
In short
We do not sell or share your data with third parties for their own purposes.
What you enter is used only to build and adjust your exercises.
We use Google Analytics for Firebase to see how the app is used.
You can use the app without creating an account.
You can delete your account and your whole history from inside the app.
No advertising and no cross-app advertising tracking.
PhysioAI is an iOS and Android app that guides people through rehabilitation exercises after surgery or an injury. The controller of your data is PhysioAI. You can reach us at alvrmjs.dev@gmail.com about anything in this policy.
The app provides educational guidance. It is not a substitute for assessment, diagnosis or treatment by a healthcare professional. It is not a medical device and it does not issue diagnoses or individual medical advice.
Account data. If you choose to create an account: your email address, a password and a name, which is requested when you sign up. The password is handled and stored encrypted by our authentication provider; we never see it and cannot recover it. An internal user identifier is also generated.
Initial assessment data. What you enter before the app builds your program:
the body area where you feel discomfort
what caused the pain: recent surgery, a sports injury, overload or posture, or that you do not know yet
the pain level you report, on a 0 to 10 scale
how you describe your current mobility
how many days per week you can train
Session data. The date you started the program, the sessions you have completed and, for each one, its number, the date you finished it, and the pain you log at the end of every set and at the end of the session. The totals shown in your profile — sessions, minutes and streak — are derived from these.
Usage data (Google Analytics for Firebase). We use this service to understand how the app is used: which screens are opened, when you start or finish a session, sign-ups and logins, and whether the rating prompt is shown or dismissed. Alongside those events the service collects technical and usage information such as an app instance identifier, the device model, the operating system version, the language and an approximate location derived from your IP address, at country or region level. On Android, the SDK may access the device's advertising identifier.
If you are signed in, we associate your user identifier with those events, so your activity in the app is linked to your account. Analytics is disabled in development builds. It cannot currently be switched off from the app's settings; uninstalling the app stops the collection, and you can write to us to object to this processing.
Preferences. The language you select in the app, stored on your own device.
Minimal technical data. Connection logs generated automatically by the infrastructure hosting the app, needed to run the service and protect it from abuse.
What we do not collect. We do not ask for or store your identity document, date of birth, postal address, phone number, precise location, contacts, photos or medical records. The app shows no advertising, and we do not combine your data with third-party data to profile you or to follow you across apps or websites.
The data you enter is used solely to deliver the service, namely:
building your program from the body area, the cause of the injury and the pain you report
setting the weekly frequency from the days you tell us you can train
suggesting each session's exercises and moving load and progression based on the pain you log
showing you your history, your consistency and your progress
keeping you signed in and restoring your program when you come back
Usage data serves a separate, narrower purpose: knowing which screens and features are used, spotting where people drop out of the flow, and deciding what to improve. We look at it in aggregate, not to make decisions about an individual or to change anyone's exercise program.
We do not use your data for advertising, we do not sell it, we do not build profiles with legal effects on you, and we do not pass it to insurers, employers, financial institutions or data brokers.
You can complete the assessment and run sessions without registering. In guest mode your program and history stay on your device only and are not saved to our servers: if you close or uninstall the app, that information is gone. Usage analytics does run in guest mode, but with no user identifier attached. An account exists to keep your progress across sessions and devices.
We do not sell or hand your data to third parties for their own purposes, whether commercial, advertising or profiling. The only third parties involved are providers processing data on our behalf, on our instructions:
Google Firebase (Authentication and Cloud Firestore), by Google LLC: account authentication and storage of your assessment, program and session history on Google Cloud infrastructure.
Google Analytics for Firebase, by Google LLC: processing of the usage data described in section 2.
Google Fonts: the app downloads typefaces from the service, which may receive your IP address in the process.
Apple App Store and Google Play, when you download or update the app, under their own policies.
Beyond these cases, we would only disclose data if required to by a competent authority through a valid legal request.
You can delete your account at any time and without giving a reason, from inside the app: Profile › Delete account. For security we ask for your password before continuing, to confirm it is really you.
Deletion runs immediately. We erase your sign-in credentials, your initial assessment data — body area, cause of the injury, mobility and frequency — your program and your entire session history. Our provider's backups may retain the data for up to 30 further days before being overwritten. Deletion is permanent: we cannot restore the history afterwards.
Usage data collected by Analytics is no longer associated with your account once it is deleted, but it remains in the service until the configured retention period expires. If you want us to request its deletion sooner, write to us.
If you would rather not do it in the app, write to alvrmjs.dev@gmail.com from the address you registered with and we will do it for you.
We keep your account data, your assessment and your history while the account is active, because that is what your program and progress rest on. If you delete the account, it is erased as described above. Usage data is retained by the analytics provider for the retention period configured on the project.
You can exercise the following rights at any time:
access the data we hold about you and get a copy of it
correct it if it is inaccurate
delete it, along with your account
withdraw your consent, without affecting processing carried out beforehand
object to processing, including usage analytics, or ask us to restrict it
lodge a complaint with the data protection authority in your country
Write to alvrmjs.dev@gmail.com and we will reply within 30 days.
We process your account data to perform the service you ask us for. The body area, the cause of the injury and the pain level are health-related data, processed on the basis of your explicit consent, given when you complete the initial assessment and withdrawable at any time by deleting your account.
Usage data is processed on the basis of our legitimate interest in understanding how the app performs and improving it. You can object to this processing by writing to us.
Traffic between the app and our servers is encrypted in transit (TLS), and the provider encrypts data at rest. Access to each user's documents is restricted to their own authenticated account, and sensitive operations such as deleting the account require re-entering the password. No system is infallible: if a breach affecting your data occurred, we would tell you and notify the competent authority within the deadlines set by applicable law.
The app is not directed at children under 18 and we do not knowingly collect data from anyone below that age. We do not ask for a date or year of birth, so we cannot verify the age of anyone who registers; if we identify a minor's account, we will delete it. If you are a parent or guardian and believe your child has given us data, write to alvrmjs.dev@gmail.com.
Our providers may process data on servers located outside your country. Where that happens, the transfer relies on standard contractual clauses and the other safeguards offered by the provider.
If we change this policy, we will publish the new version at this same address and update the date in the header. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect.
PhysioAI · alvrmjs.dev@gmail.com