Skip to content

DPA

Version: 2026-10-28 · Processor terms for RehabPilot clinics worldwide

This DPA is a contractual offer under Art. 28 GDPR (and equivalent processor terms for non-EU clinics). The German version is the AVV with identical content. The United States is not currently served; there is no offering for US clinics.

1. Parties and roles

Controller: the physiotherapy clinic / practice that holds a RehabPilot clinic account (“Clinic”).
Processor: Josef Kirchhofer & Phillip Rosenheinrich GbR, Destouchesstr. 3, 80803 Munich, Germany (“RehabPilot”, “we”).

By accepting this DPA (clickwrap at trial signup or checkout), the Clinic instructs us to process personal data as described below to provide the RehabPilot cloud service.

2. Subject matter, duration, nature and purpose (Annex A)

  • Subject: hosting and operation of RehabPilot cloud features (accounts, plans, media, messaging, invites, push tokens where enabled).
  • Duration: for the term of the subscription/trial and until deletion/return under Section 8.
  • Nature: storage, transmission, display, backup, deletion and related IT operations (including generation of encrypted media previews).
  • Purpose: provision of the contracted RehabPilot service on the Clinic’s instructions.
  • Data subjects: Clinic staff; patients of the Clinic (and guardians where applicable).
  • Data categories: identity and contact data; therapy plans, exercises, session notes, progress; in-app messages; media; authentication data; device/push tokens; technical logs.
  • Special categories: health data may be included (Art. 9 GDPR). The Clinic is responsible for its Art. 9 legal basis.
  • Retention and deletion: Personal data are processed only as long as necessary for the agreed functions and in line with the Clinic’s documented instructions. The product currently applies the following automatic deletion periods: patient and therapy data are deleted 10 years after the patient’s last activity; in-app messages are deleted after 30 days; completion records and workout ratings (training history) are deleted after 180 days; support requests are deleted 12 months after they are closed; device and push tokens are deleted after 180 days of inactivity; jobs for sending week-schedule PDFs are deleted after 30 days. The Clinic cannot currently configure these periods in the product itself; via support it may instruct a different period for patient and therapy data (1 to 50 years), the exclusion of individual patients from automatic deletion, or a deletion. RehabPilot implements lawful and technically feasible instructions within a reasonable time. Otherwise, deletion and retention happen on the Clinic’s instructions (in the product or in text form); the Clinic remains responsible for its own record-keeping duties. RehabPilot is not an archive for meeting the Clinic’s statutory documentation and retention duties. After the contract ends, return or deletion follow § 8.

3. Instructions

We process personal data only on documented instructions from the Clinic — including this DPA, the Clinic’s product configuration, and support requests from authorised Clinic administrators — unless required by EU or Member State law (in which case we inform the Clinic before processing unless legally prohibited).

If RehabPilot considers that an instruction infringes data-protection law, we inform the Clinic without delay. We may suspend the instruction until the Clinic confirms or changes it.

3a. Access to content data; no own use

(1) The Clinic acknowledges that RehabPilot, as system operator, is technically able to access stored data, including health data and — after decryption — media.

(2) RehabPilot personnel access personal content data only
a) on the express, documented instruction of an authorised Clinic administrator in the individual case (e.g. a support request), and only to the extent required, or
b) exceptionally without prior instruction where strictly necessary to avert an acute threat to the security or availability of the service, in which case the Clinic is informed without undue delay afterwards.
Automated processing inherent to the service (e.g. storage, backup, generation of encrypted previews) is covered by the instructions in this DPA and involves no human review.

(3) Support requests on which an access under (2)(a) is based are documented in our support ticket system or email history.

(4) RehabPilot never uses Clinic or patient data for its own purposes. In particular, the data is not evaluated, analysed, or used for advertising, profiling, statistics or AI model training, and is not disclosed, sold or otherwise made available to third parties — except to sub-processors authorised under Section 6 within their engagement or where required by law under Section 3.

(5) Requests from authorities or third parties for data are, where legally permitted, forwarded to the Clinic; we disclose data only where legally compelled.

4. Confidentiality and professional secrecy (§ 203 StGB)

(1) Persons authorised to process personal data are bound to confidentiality and receive appropriate training. Access to production systems and credentials is limited to what is necessary.

(2) RehabPilot acts as a contributing person within the meaning of § 203(3) sentence 2 German Criminal Code (StGB) in the Clinic’s professional activity. To the extent we process data subject to the Clinic’s professional secrecy (in particular medical/therapeutic confidentiality under § 203 StGB or equivalent rules), we commit to strict confidentiality and disclose such data only as far as necessary to provide the service.

(3) Before they start work, we bind all persons involved in performing this contract who may gain knowledge of such data to secrecy in writing and inform them that breaching private secrets is a criminal offence (§ 203(4) StGB). This obligation continues after their engagement ends.

(4) Where we engage sub-processors that may gain knowledge of such data, we bind them in text form to the same confidentiality, to inform their personnel of the criminal liability, and to pass these obligations on to any further sub-processors.

5. Security — technical and organisational measures (Annex B)

We maintain technical and organisational measures appropriate to the risk of the processing. The measures implemented and their scope are documented in this Annex B (as of 28.10.2026); material changes are documented in a new, dated version. We review the effectiveness of the measures regularly and adjust them where needed without lowering the level of protection.

Current production configuration (summary; see also Trust & Security):

  • Access control: access only to the extent necessary; the apps use no passwords (sign-in via email link or login code, optional Google Sign-In or Sign in with Apple, clinic PIN); only the web customer portal uses a password; login codes, PINs and portal passwords are stored only in non-reversible form; protected session cookies in the web customer portal. Not included: two-factor authentication (2FA), automatic inactivity logout, or a separate license audit log.
  • In transit: TLS/HTTPS for public endpoints. Media is encrypted before upload and only transmitted in encrypted form; upload authorisations are time-limited.
  • Media storage and encryption: media storage at Cloudflare, storage region Western Europe. Exercise media (images, videos, avatars) is encrypted in the app before upload using a recognised, state-of-the-art encryption method, with a separate key per file; Cloudflare stores encrypted data only. Encryption of media is always on and cannot be switched off by the Clinic or by users. Keys are managed only on our servers in Germany (Amazon Web Services, Frankfurt). Decryption happens in authorised apps after sign-in and transiently on our German servers to generate encrypted previews. RehabPilot can technically decrypt keys; human access happens only under Section 3a.
  • Media delivery & pseudonymisation: media is delivered over HTTPS, in encrypted form only, after a server-side check of clinic membership and role. Media files are stored under pseudonymous, random identifiers and contain no names or diagnoses; linking to individuals takes place only in the databases at Amazon Web Services in Frankfurt, Germany.
  • Structured data: application databases on RehabPilot-operated servers at Amazon Web Services in Frankfurt; separation of data per clinic.
  • Standard web-server logs (rotation); no separate license audit log.
  • Automated database backups (AWS RDS, retention 7 days) and restore procedures.
  • Regular security updates of operating system, runtime and dependencies.

Note on sign-in and sessions: The Clinic acknowledges that the current product version has no two-factor authentication (2FA) and no automatic logout after inactivity. The Clinic is responsible for securing the devices and sign-in links it uses (e.g. device screen lock, clinic PIN, careful handling of email sign-in links and login codes).

Infrastructure: Application hosting (including delivery of the web app), databases, key management and email delivery with Amazon Web Services (Frankfurt), media storage and network protection with Cloudflare, both providers holding a BSI C5 attestation; hosting in Germany/EU. The website rehabpilot.org is hosted by Hetzner Online GmbH in Germany; this provider does not process and has no access to practice or patient data of the app. The attestation covers only these services of the providers, not RehabPilot itself and not other services such as push or payments. Attestations: AWS BSI C5 attestation, Cloudflare BSI C5 attestation.

Section 393 SGB V: The Clinic itself checks whether Section 393 of the German Social Code Book V (SGB V) applies to it. RehabPilot does not warrant that use of the service meets the requirements of Section 393 SGB V.

6. Sub-processors (Annex C)

The Clinic authorises the sub-processors listed on the Sub-processors page at conclusion of the contract (the list as of conclusion governs; on request RehabPilot provides it as a dated version with company, seat, function, data categories processed and processing location). RehabPilot contractually binds each sub-processor to data-protection obligations equivalent to this DPA (Art. 28(4) GDPR) and remains responsible to the Clinic for their compliance.

We announce changes (addition or replacement) at least 14 days in advance in text form by updating the sub-processor list and by email to the Clinic’s contact address; the notice describes the service concerned and the material changes. The Clinic may object in text form within that period for an important, legitimate reason (in particular justified doubts about compliance with data protection or information security) by emailing [email protected]. The parties then seek a reasonable solution. If we cannot resolve the objection, the Clinic may terminate the contract for cause effective when the change takes effect; prepaid fees for the unused period are refunded pro rata. Without objection the change is deemed authorised.

7. International transfers (Annex D)

Application hosting is in Germany (Amazon Web Services, Frankfurt). Media files are stored encrypted in Western Europe. Where sub-processors established outside the EEA/UK/Switzerland (e.g. Cloudflare, Stripe, Google) process data or handle support/metadata outside the EEA, transfers rely on appropriate safeguards (the EU-US Data Privacy Framework where the provider is certified, or EU Standard Contractual Clauses) plus the measures in Annex B.

8. Assistance, breach notification, deletion and return

  • We assist the Clinic with appropriate technical and organisational measures in responding to data-subject requests (Art. 12–23 GDPR), with DPIAs and prior consultations (Art. 35, 36 GDPR), and with supervisory-authority enquiries. Patient requests that reach us directly are forwarded to the Clinic.
  • We notify the Clinic of personal-data breaches without undue delay after becoming aware and at the latest within 48 hours, at the Clinic’s contact address. The initial notice contains the information under Art. 33(3) GDPR available at that time, in particular on the nature and extent of the incident, the data and persons affected, likely consequences and measures taken or planned; missing information is provided without undue delay. We document the incident and support the Clinic with its notification duties (Art. 33, 34 GDPR).
  • Emergency suspension: where there is a reasonable suspicion of an acute threat to data security (e.g. compromised access credentials of the Clinic), we may restrict access without delay and to the extent necessary (section “Suspension of access” of the Terms of Service). The Clinic is informed without delay; the suspension is lifted immediately once the cause has been remedied. The suspension does not delete or alter data.
  • End of contract: after the contract ends we return or delete personal data on the Clinic’s documented instructions (Art. 28(3)(g) GDPR), unless legal retention obligations apply. The end of the contract does not trigger automatic deletion of Clinic data; the product-related deletion periods described in Section 2 remain unaffected. Return is provided as an export in a common machine-readable format (JSON), which RehabPilot supplies via support at the Clinic’s request (section “Data export and end of contract” of the Terms of Service); media files by arrangement. Where deletion is instructed, data is deleted in the production systems; data contained in backups is overwritten as part of the documented backup rotation (7 days). If data are restored from a backup, deletions already instructed are applied again unless a legal obligation to retain applies. Patients can additionally export their own data (profile, plans, exercises, week schedules, session notes, messages, media metadata, completion records) themselves in the patient app.
  • We retain proof of conclusion and version of this DPA (acceptance record) separately from Clinic data for as long as it is needed as evidence of the contract.
  • Sample patient privacy notices (Art. 13 GDPR): template for clinics.

9. Information, audits and inspections

On request we make available to the Clinic all information necessary to demonstrate compliance with Art. 28 GDPR (including this DPA, the TOM description, the sub-processor list and hosting attestations). The Clinic or an auditor mandated by it who is bound to confidentiality and is not a competitor of RehabPilot may, with reasonable notice (usually 30 days), conduct audits including inspections during normal business hours without disproportionately disrupting operations. Current documentation is accepted first; inspections are possible where it is insufficient, after a personal-data breach, or at the request of a supervisory authority. Supervisory authorities’ rights remain unaffected.

10. UK and Switzerland

Clinics in the United Kingdom must also accept the UK GDPR Addendum. Clinics in Switzerland must also accept the Swiss nDSG Addendum. EU/EEA clinics accept this DPA alone (German version: AVV).

11. Liability

The scope of liability is governed by the Terms of Service / AGB. The parties’ statutory liability towards data subjects under Art. 82 GDPR remains unaffected.

12. Contact

Josef Kirchhofer & Phillip Rosenheinrich GbR · Destouchesstr. 3 · 80803 Munich · Germany · [email protected]