Sample patient privacy notice (Art. 13)
Last updated: 26 October 2026
For practices only. Adapt to your clinic; not legal advice. RehabPilot does not act as your lawyer.
Privacy information for patients using RehabPilot
Controller: [Practice name, address, contact]
Purpose: Home exercise plans, reminders, progress tracking, and optional messages/PDFs from your clinic.
Data: Name, email, therapy plans, notes, messages, exercise media, completion data.
Legal basis (examples): Art. 6(1)(b) GDPR (care contract); Art. 9(2)(h) GDPR for health data where applicable — confirm with your advisor.
Processor: Josef Kirchhofer & Phillip Rosenheinrich GbR hosts the service under a DPA. Sub-processors: list.
Retention: As required by your professional rules; patient data is deleted automatically 10 years after the last activity; the practice can instruct a different period via RehabPilot support.
Rights: Access, rectification, erasure, restriction, portability, objection (Art. 21 GDPR where applicable) — contact the practice. Complaints: supervisory authority.
Contact: [Practice privacy contact]