Privacy Policy

1. Introduction

PhysioSense ("we", "our"), operated by PhysioSense d.o.o., Vladimira Rolovića 2a, 85000 Bar, Montenegro (Tax ID / PIB: 04409175), operates the website physiosense.net. PhysioSense is an educational reference tool — it is NOT a medical device, clinical decision support system, or diagnostic tool. This policy describes how we collect, use, and protect your personal data in accordance with the GDPR, the Montenegrin Law on Personal Data Protection, and applicable data protection laws.

PhysioSense is intended for users aged 16 and older. If you are under 16, you may only use PhysioSense with the consent of a parent or legal guardian.

2. Data We Collect

Account data:

• Email address (for authentication)
• Name (for profile display)
• Role (e.g., physiotherapist, student)
• Professional license number (optional)
• Subscription tier selection
• Payment data (card payments are processed by our bank's secure payment gateway — we do not store or have access to your full card number)

Feedback and testimonials (optional):

• A star rating and an optional short note about the platform, which you may leave in the app after using it. If you send it from a plan page, the condition of that plan is stored with it and is never published. Without publication consent this stays internal feedback read only by us (legal basis: legitimate interest in improving the service, Article 6(1)(f)).
• If you tick the publication box, we publish your note and your star rating on our public pages together with the name you type, the professional role on your account and, if you enter it, your workplace; next to it we may show a short headline and a credentials line that we write ourselves (legal basis: your consent, Article 6(1)(a)). Your email address is never published. You may withdraw this consent at any time by writing to us or by deleting your account in Settings; the quote is then no longer published.

Health data (GDPR Article 9 — special category):

• Health assessment data, including the diagnosis, recovery phase, symptom duration, pain level, functional status, patient age and sex, comorbidities, medication, smoking status, activity level, prior care, clinical test findings, a special population (such as pregnancy), equipment, goals and clinical setting
• Patient-reported outcomes, such as pain scores, functional scores, clinical progress and adherence data
• Generated reports (evidence-based educational reference content, PDF documents)
• Answers to the questions for a Literature Review order: the condition the review is about, your age band and sex, how long the symptoms have lasted, where you exercise, your daily environment, your main goal and, if you give one, a short free-text answer about what you want to get back to. They are kept with the order. When you delete your account, the answers and your email address are removed from the order; the order itself, including which condition it was for, is kept as a financial record no longer linked to your account. For an order placed without an account, the answers stay with the order until you ask us to delete them at privacy@physiosense.net.
• Answers to the optional progress questionnaire we email 30 days after a Literature Review purchase: your pain before reading the review and now (0–10), how your daily function has changed, your satisfaction with the report, whether you would recommend PhysioSense, and an optional comment — stored with your order.

Health assessment data are the clinical scenario parameters a user enters to generate evidence-based reports; a scenario may or may not describe an actual patient. The assessment form does not ask for a patient's name, date of birth, address or national ID number, but a clinician can give a plan a label of their choice and write notes on it, which may identify a patient if the clinician includes such details. Some features do store a patient's name and contact details — see the next paragraph.

Clinicians can enter a patient's email address and phone number with a plan (both stored encrypted). For each patient in a clinic's patient list we store the label the clinic gives them, their condition, the email address an invitation was sent to (encrypted), the clinician's notes and the messages the clinician sends them (both encrypted), the date and type of a scheduled review with its video link and note as entered (not encrypted), and whether the patient is seen remotely. When a patient books an appointment through a clinician's booking page, we store the name, email address and phone number they enter (encrypted) and, if they give one, the reason for the visit as entered (not encrypted). For this data PhysioSense acts as a data processor on behalf of the clinician, who is responsible for having a legal basis for it, such as the patient's consent. Contact details entered with a plan are deleted with that plan.

3. How We Use Your Data

• To provide and operate the platform — Contract, Art. 6(1)(b); Explicit consent for health data, Art. 9(2)(a)
• To process subscriptions and payments — Contract, Art. 6(1)(b)
• Recurring card payments (card-on-file): your card is stored by the card payment gateway, which Bankart (Slovenia) operates for our partner bank, on PCI-DSS systems; we keep only a payment reference, the card brand, the last four digits and the expiry date — used to show which card is saved, renew your subscription and remove the card when you ask or when it expires.Contract, Art. 6(1)(b)
• To send service emails — account confirmation and password reset, order and payment confirmations and receipts, payment reminders when a payment fails, notices that your trial is ending, delivery of reports you ordered, a progress questionnaire 30 days after a Literature Review purchase, CPD certificates, outcome-measurement reminders, messages from your clinician, and service notices — Contract, Art. 6(1)(b). For emails to a clinician's patients, PhysioSense acts as a processor for the clinician's practice. Emails a clinician sends to a patient through PhysioSense — plan and report shares, discharge notices, review scheduling, messages and intake invitations — are sent only when the clinician confirms, at the time of sending, that the patient agreed to receive them. Before sending, we record that confirmation (which clinician, which kind of email and when, with a pseudonymised hash of the address, not the address itself); if it cannot be recorded, the email is not sent. The record is kept until the clinician's account is deleted. Outcome-measurement emails need the patient's recorded consent: the opt-in to these emails that the clinician records with the patient's plan, together with the acknowledgement that the patient was informed (sent only to the address that plan was made for), or the patient's own optional email consent, given when they registered or set up their patient account (sent to their account address).
• To send onboarding emails with tips in the first weeks after you sign up and, if you sign up through a link from one of our live streams, one email about the stream the next day — Legitimate interest, Art. 6(1)(f). You can switch the tips off at any time under Settings > Notifications (marketing emails); each tips email links to your settings. The live-stream email is scheduled with our email provider when you sign up and sent 24 hours later; it has no settings link, and switching off marketing emails does not stop it.
• To send our monthly newsletter digest, only if you subscribed to the newsletter — Consent, Art. 6(1)(a). You can unsubscribe at any time under Settings > Notifications or by writing to us.
• To send web push notifications, only if you allow them in your browser: delivery of evidence you requested, outcome-measurement reminders, and announcements of new videos and live streams. We store your browser's push subscription (its endpoint address and encryption keys), your browser's user agent and your notification settings. Each notification is delivered through the push service of your browser's maker (Google, Mozilla, Apple or Microsoft); its content is encrypted end to end, so the push service cannot read it — Consent, Art. 6(1)(a), given through your browser's notification permission; you can withdraw it at any time in your browser settings or under Settings > Notifications.
• For platform security and error tracking — Legitimate interest, Art. 6(1)(f)
• To understand how the platform is used, through cookieless, aggregated website analytics (Umami, Vercel Analytics) that run whatever you choose in the cookie banner, and through the usage records described in the next item — Legitimate interest, Art. 6(1)(f)
• To see how signed-in users use PhysioSense and to help you when you contact us, we keep usage records with your account: on every page you open, your account ID, a session ID, the page address (without its query string), your subscription tier and role; the text of searches you run in the platform (up to 120 characters); events such as creating a plan or a report or recording an outcome, including which condition it concerns; and, for each visit, a session record with your account ID, when the session started and when it was last active, its duration, the number of pages viewed, your device type (desktop, mobile or tablet), your browser's name, the address of the first and last page (without its query string), your subscription tier and role. When you sign in, register, ask for a password reset or ask for a new confirmation link, we also record the attempt and its result with a shortened IP address (only its network part) and a short hash of the email address entered, to detect attacks. These records are deleted after 90 days; a session record is deleted 90 days after its last activity. Each week our team also receives an internal email (sent through Resend) summarising the activity of paying subscribers: name, email address, subscription tier, activity counts and the conditions viewed most — Legitimate interest, Art. 6(1)(f)
• To measure our advertising campaigns with Google Analytics and Google Ads — Consent, Art. 6(1)(a), for Google cookies; what the Google tag sends without your consent is described in the Cookie Policy
• To keep pseudonymized snapshots of the reports you generate — the plan parameters and which evidence the report showed, without names, contact details or free-text notes — for platform quality and improvement (see section 3b). You can opt out under Settings > Data & Privacy — Legitimate interest, Art. 6(1)(f)

3b. Anonymized Statistics and Research

This section covers the uses of plan and outcome data beyond showing them to you. None of them uses names, contact details or free-text notes.

• Platform improvement snapshots: pseudonymized plan parameters are processed under Legitimate Interest (Art. 6(1)(f)) with an account-level opt-out in Settings → Data & Privacy.
• Research participation for a plan: at intake or on the plan page you can agree that outcome data from that plan (scores and adherence values) may be used for research (Art. 9(2)(a)), and we record your choice. This research use is not currently active: we do not build research datasets or publish statistics from this data.

Outcome benchmarks: subscribers whose subscription includes benchmarks can compare their own case outcomes for a condition and outcome measure with a platform-wide figure calculated from the case logs of all clinicians — the number of cases and the average, median, lowest and highest improvement. It shows no names or case details and does not depend on research consent.

You can withdraw per-plan research consent at any time on the plan page (Art. 7(3)); we record the withdrawal.

4. Data Storage & Security

• Database and authentication: Supabase (EU — Ireland). Row-Level Security (RLS) on all tables.
• Application hosting: Vercel — the application runs in Frankfurt (fra1, EU) and pages are delivered through Vercel's global network (CDN). HTTPS/TLS encryption, HSTS with 2-year duration.
• Passwords: hashed via bcrypt (Supabase Auth). We never store passwords in plain text.
• Security headers: Content-Security-Policy, X-Frame-Options (DENY for API, SAMEORIGIN for pages), X-Content-Type-Options: nosniff, CSRF protection on all mutations.
• Backups: outcome, plan, reminder and report data is backed up twice a day, encrypted, to Supabase Storage; each backup is deleted after 90 days.

5. Service Providers

We use the following service providers to run PhysioSense. For each one, the table shows what it is used for and which data it receives, where it processes data, and how a transfer outside the EU/EEA is safeguarded.

Card payments: the card payment gateway is operated by Bankart (Slovenia, EU) for our partner bank in Montenegro. When you pay by card, the gateway receives your email address and billing address from us and, on its payment page, your card details from you. The bank processes the payment on PCI-DSS systems as an independent controller, under card-scheme and anti-money-laundering rules. The payment description it receives names no medical condition. The bank is not our sub-processor, and PhysioSense never receives or stores full card numbers.

We do not sell or rent your personal data. Apart from the measurement data Google receives so that we can measure our advertising (see the Cookie Policy), we do not share it with third parties for marketing purposes. Where the table names a service provider's DPA or data processing terms, these are that provider's standard terms, which apply because our company, PhysioSense d.o.o., has accepted them.

5b. Cookies

For information about cookies we use, see our Cookie Policy.

5c. International Data Transfers

Our database and file storage (Supabase) are in Ireland and our application runs in Frankfurt (Vercel); the health data you enter — assessments, outcome scores and reports — is stored there. Data leaves the EU/EEA in the following cases:

• Hosting (Vercel, Supabase): Vercel's data processing agreement states that its primary processing facilities are in the United States, and pages are delivered through its global network, so request data such as your IP address and the page address can pass through locations outside the EU/EEA. Supabase stores our data in Ireland and processes it primarily there, but its data processing agreement allows processing wherever it or its sub-processors have facilities. Both agreements include Standard Contractual Clauses.
• Email (Resend, United States): every email we send — the recipient's address and name and the email's content, such as account, order and payment details and links, including time-limited download links — is stored by Resend in the United States for 30 days, under Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. The emails we send you do not name a medical condition you entered or a questionnaire that would reveal one, except text written by your clinician (such as a message or the name they give your plan) or by you (such as the subject of a support request). Two emails can still point to a condition: a CPD certificate email names the course module you completed, and the email with a high-definition video from our exercise library contains a link whose file path includes the names of the condition and the exercise. Messages sent through our contact forms, and our notifications about them, also pass through Resend (see section 8d).
• AI assistance (Anthropic, United States, Standard Contractual Clauses): if the physiotherapist reviewing a paid Literature Review asks the AI assistant for a suggestion, it receives the condition name, the names of the items in the draft and three of the buyer's answers — never a name, email address or order number. See section 7b.
• Google Analytics and Google Ads (Google, United States, EU-U.S. Data Privacy Framework and Standard Contractual Clauses): as described in the Cookie Policy. Without your consent no Google cookies are set, but the Google tag may still send cookieless signals, such as that a page was viewed. On PeopleSense pages that name a condition or a body region, Google Ads does not run, and Google Analytics receives the page address and title with the condition name replaced (see the Cookie Policy).
• Card payments (our partner bank, Montenegro — outside the EU/EEA): when you pay by card, the bank receives, through the Bankart card payment gateway, your email address and billing address and the card details you enter, and processes the payment as an independent controller (see section 5).
• Web push notifications (your browser maker's push service — Google, Mozilla, Apple or Microsoft — which may be outside the EU/EEA): only if you allow notifications; each notification passes through that service encrypted end to end, so it learns that a message was sent to your subscription but not what it says (see section 3).
• Providers in section 5 whose location is not yet confirmed may also process data outside the EU/EEA.

6. Your Rights (GDPR)

• Access (Art. 15) — view your data in Settings
• Rectification (Art. 16) — update your data in Settings
• Erasure (Art. 17) — request account deletion in Settings > Profile
• Data Portability (Art. 20) — download all your data in JSON format via Settings > Export Data
• Restriction (Art. 18) — contact privacy@physiosense.net
• Withdraw Consent (Art. 7(3)) — withdraw your consent to health data processing at any time under Settings > Profile (Consent Management). Withdrawal does not affect the lawfulness of processing performed before withdrawal, and it does not by itself delete data already stored (see section 8).
• Objection (Art. 21) — contact privacy@physiosense.net
• Complaint (Art. 77) — you have the right to lodge a complaint with a supervisory authority. For Montenegro: AZLP, www.azlp.me. For EU residents: your local DPA.

7. Automated Decision-Making

PhysioSense does not make automated decisions about you. Report generation filters published evidence based on your input but does not constitute automated decision-making or profiling under GDPR Article 22. All decisions remain with the clinician.

7b. AI Assistance

When a physiotherapist reviews a paid Literature Review, they can ask an AI assistant (Anthropic, United States) to suggest an order for the items in the draft.

For this, the assistant receives the condition name the review is about, the names of the items in the draft, and three answers the buyer gave when ordering: exercise setting, daily environment and main goal. It never receives a name, email address or order number.

Before signing, the physiotherapist's own cover note is checked by the same assistant for wording. The assistant also translates published evidence text, which contains no personal data. No other part of the PhysioSense platform sends personal data of platform users to an AI service.

The physiotherapist decides. The AI only suggests an order and checks wording; no decision about you is made by automated means (GDPR Article 22). Anthropic processes this data in the United States under Standard Contractual Clauses.

8. Data Retention

• Account data: while account is active. Deletion on request via Settings.
• Health data: kept while your account exists. Withdrawing your health-data consent (Settings > Profile) records the withdrawal; it does not by itself delete data already stored. To have your health data deleted, delete your account (Settings > Data & Privacy) or write to us at privacy@physiosense.net.
• Generated reports: when you delete a report, it disappears from your account at once; 30 days later its PDF file is deleted from storage and its title is cleared. The rest of the report record stays with your account: the content of the report's sections, the safety notices generated from the comorbidities and other health details entered for the plan, the condition, recovery phase and user role it was made for, and technical details such as your browser's identification string at the time. That record, like a report you keep, is deleted 10 years after the report was generated, or earlier if you delete your account. Pseudonymized report snapshots without direct identifiers (section 3b) are kept for up to 5 years. When you delete your account, your personal data is deleted from our live database at that point (session records are deleted with it; other usage records, section 3, are unlinked from the account and deleted within 90 days), with narrow exceptions required by law: financial and billing records are retained for 7 years (tax and fiscal obligations) in a form no longer linked to the account, records of the consents you gave or withdrew are kept, no longer linked to the account, as proof of consent, the immutable security audit log is retained for platform security and defence of legal claims, and consumer complaint records are retained for consumer-protection inspections (GDPR Art. 17(3)). Encrypted backups of outcome, plan and report data are kept for 90 days, so deleted data can remain in a backup for up to 90 days.
• Payment records: 7 years (legal obligation).
• Stored card reference: While the card is saved. When you remove the card or cancel your subscription, or after the card expires, its registration at the bank is cancelled; our record of the card (the payment reference, card brand, last four digits and expiry date) is kept, marked as removed, and deleted by a monthly clean-up once 90 days have passed, or earlier if you delete your account. Payment records remain for 7 years (legal obligation).
• Error logs: kept by Sentry according to the retention of our Sentry plan (up to 90 days), then deleted automatically.
• Push notification subscriptions: until you turn notifications off, your browser's push service reports the subscription as expired, or you delete your account.

8b. Exercise Library — HD Video Requests

If you request a high-definition video from our public exercise library, we collect the email address you provide, which video you asked for (the exercise and the condition it belongs to), the content locale, a hashed representation of your IP address (SHA-256), and your user-agent string. No account is required.

Legal basis: your explicit consent (GDPR Article 6(1)(a)) given via the consent checkbox on the request form.

Purpose: to email you the HD link once and to prevent abuse through a simple rate limit (3 requests per hour per hashed IP). The email is not used for marketing.

Retention: records are automatically purged 90 days after the email is delivered, or 30 days if delivery fails. We do not store the raw IP address — only a salted hash used for rate limiting.

Your rights: to access or delete your record before automatic purge, contact privacy@physiosense.net with the email address you used.

8d. Contact Form

If you write to us through the contact form while not signed in, your name (if you give it), email address, the type of request, subject and message are emailed to our company mailbox through Resend (see sections 5 and 5c), so that we can reply; they are not saved in our database. If you are signed in, your message is saved as a support request with your account; our team receives an email notification with your email address, the subject and the ticket number — not the message itself — and you receive a confirmation email with the ticket number.

8e. Sign-ups for exercise with a physiotherapist

If you sign up for a free first live session on the page for exercise with a physiotherapist, your name, phone number and/or email address, your question (if you write one), the page language, and the time and wording of the consent you ticked are emailed to our company mailbox through Resend (see sections 5 and 5c), so that a physiotherapist can contact you and prepare the session. These details are not saved in our database or written to our application logs. Resend keeps a copy of the email, including your question, in the United States for 30 days (see section 5c). We record only that a sign-up was sent, with the page language. The question is optional and may contain information about your health; it is processed only with your explicit consent and only for the free first live session. The legal basis is your consent, which you can withdraw at any time by writing to us at privacy@physiosense.net. We do not pass these details to any other clinic; if further assessment or care is suggested, you contact that clinic yourself. A separate, optional box — never pre-ticked — lets you agree to receive news from PhysioSense about new programmes and services; you can withdraw that consent at any time too. If no agreement follows, we delete the email within 90 days; if you agreed to receive news, we keep only your name, your contact details and that consent until you withdraw it.

9. Policy Changes

If we make material changes to this policy, we will notify you via email at least 14 days before they take effect.

10. Contact

For privacy inquiries, contact us at: privacy@physiosense.net

We have not appointed a Data Protection Officer (DPO) as our processing does not meet the thresholds under GDPR Article 37.

We respond within 30 days in accordance with GDPR requirements.

PhysioSense d.o.o., Vladimira Rolovića 2a, 85000 Bar, Montenegro — Tax ID (PIB): 04409175