Skip to content

Privacy Policy

Last updated: 28 October 2026

This policy explains how Josef Kirchhofer & Phillip Rosenheinrich GbR (“RehabPilot”, Destouchesstr. 3, 80803 Munich, Germany — “we”, “us”) processes personal data when you use the rehabpilot.org website, customer account, and license services for RehabPilot. Provider details are in our Legal Notice.

Clinic and patient apps

RehabPilot consists of a clinic app for physiotherapists and a free patient app. Clinics create patient records, exercise plans, and weekly schedules; patients sign in to follow their plan. Patient health data is processed by the clinic as controller and by us as processor under a data-processing agreement.

The apps contact our service with an account/subscription identifier to validate the clinic's plan and seat allocation. We use the contents of patient plans, messages, and media solely to provide the service. As operator we could technically access this data. We do so only on the clinic's express, documented request (e.g. support) or in an acute security emergency, and we never use or disclose the data for our own purposes (see DPA § 3a).

Patients use the patient app on behalf of their practice. The practice provides the privacy notice (Art. 13/14 GDPR) and sets the legal basis; we process as processor. App terms: Patient App Terms.

Clinic ↔ patient communication

  • In-app messages: Clinic and patient can exchange text messages in the app (including reactions). Messages are stored on our servers for 30 days and then deleted automatically. Optional push notifications may be sent via Firebase Cloud Messaging if you have allowed push notifications; unread messages also appear as an in-app indicator.
  • Invite emails: The clinic may invite patients by email (sign-in via email link / patient-app access).
  • Week-plan PDF: The clinic may email the current week plan as a PDF to the patient's stored email address. It is sent by email via Amazon SES with transport encryption where the receiving mail server supports it; email is not encrypted throughout. The clinic decides whether to use this feature.
  • Sign-in emails: Login codes and email links for sign-in.

These messages and emails support therapy and service operation — not advertising. Optional newsletter (marketing) remains a separate opt-in with double opt-in.

Health data (Art. 9 GDPR)

Exercise plans, session notes, progress data, in-app messages, and related patient information may constitute special category data under Art. 9 GDPR. The treating clinic is the controller and determines the Art. 9 legal basis (typically healthcare under Art. 9(2)(h) GDPR in the EEA, together with applicable national law). We act as a processor for that data under Art. 28 GDPR and our data-processing agreement (DPA). Clinics accept the current DPA by clickwrap at trial signup or checkout: /en/dpa/ (DE: /de/avv/). UK and Swiss clinics also accept the relevant addenda. Enterprise PDF on request: [email protected].

Data in the apps (in addition to this website)

  • Patient profile: name, email, optional clinic notes and avatar.
  • Therapy content: plans, exercises, repetitions, session notes, completion/progress data.
  • Media: exercise photos and videos plus avatars in media storage at Cloudflare (storage region Western Europe). Media is encrypted in the app before upload using a recognised, state-of-the-art encryption method; Cloudflare stores encrypted data only. This encryption is always on and cannot be switched off by the clinic or by users. Keys are held only on our servers in Germany (Amazon Web Services, Frankfurt), where media is decrypted transiently to generate encrypted previews. Files are stored under pseudonymous, random identifiers without personal or patient names; the link to the patient record exists only on our servers in Germany.
  • Speech dictation (optional): optional speech dictation in the RehabPilot apps. Session notes and messages: recognition runs on-device inside the RehabPilot app (offline speech model); audio is not sent to RehabPilot servers; optional one-time download of the offline speech model (~140 MB) — model data only, not microphone audio. Catalogue fields (exercise titles, plan descriptions and the like): preferably the operating system’s speech recognition (Apple or Google); audio may then be sent to the device maker’s speech recognition services — not to RehabPilot servers; only generic exercise/plan titles there, not clinical notes.
  • Demonstration images: some bundled exercise and marketing stills are AI-generated illustrations (not photographs of patients) and are labelled in the app and on the website where required.
  • Messages: content and metadata of in-app communication (see above).
  • Authentication: passwordless sign-in via email link or login code; optional Google Sign-In or Sign in with Apple (identity data from the provider); in the clinic additionally a practitioner PIN. Login codes and PINs are stored only in non-reversible form. The apps do not offer two-factor authentication (2FA) or a separate operator audit log.
  • One login across clinics: a patient login applies per email address. If several clinics have registered you with the same email address, you use the same login; if your record at one clinic is deleted, the login is automatically linked to the record of another clinic that registered you with that address. Each clinic sees only the data it created itself. For the login account itself (email address, sign-in data, linking) we are controller; legal basis Art. 6(1)(b) GDPR.
  • Device / offline: local cache on the device for offline use.
  • Error log: app errors are logged only locally on the device and deleted on sign-out. The apps use no usage analytics and send no crash reports to third parties.

Data we process on this website

  • Account & checkout: email address, name, phone number (optional), password (stored only in non-reversible form), and Stripe customer ID after purchase.
  • Clinic trial signup: email address, clinic name, clinic country, DPA/AVV clickwrap (plus UK/CH addenda where required), notice of the Terms of Service and Privacy Policy, and optional newsletter opt-in. This creates practice and customer-account records (license status “trial”).
  • Subscriptions & seats: plan tier, status, expiry, linked email, clinic/practice identifier, number of practitioner seats, and app version.
  • Authentication: a session cookie that scripts cannot read, browser identifier (user agent), and last-used timestamp. Sign-in via email link uses a short-lived link sent by email.
  • Billing: payment and billing details are collected and processed by Stripe (card data, billing address, tax information). We receive limited billing metadata from Stripe (customer ID, subscription status, invoices).
  • Server logs: IP address, request metadata, and timestamps in standard web-server logs (rotated on a regular schedule).
  • Website cookies & marketing: see the Cookie Policy (consent banner, essential and optional marketing cookies).
  • Audience measurement: cookieless measurement with PureMetrix (hosting Germany); legal basis Art. 6(1)(f) GDPR — details in the Cookie Policy.
  • Referral code (partner programme): if you arrive via a referral link, the referral code is carried only in the address bar — no cookie or other browser storage — and submitted with your sign-up or checkout. We store it with your subscription to attribute a commission to the partner (Art. 6(1)(b) and (f) GDPR).
  • Email: transactional messages (welcome, login links, license delivery, billing notices, patient invites, week-plan PDFs) via Amazon SES in the EU region Frankfurt.

Purposes and legal bases (GDPR)

  • Contract performance (Art. 6(1)(b)): account creation, license provisioning, trial access, checkout, subscription management, app operation (including in-app messages and therapy emails), and support related to your purchase.
  • Legitimate interests (Art. 6(1)(f)): fraud prevention, rate limiting, security logging, reliability, our own cookieless audience measurement (page views and selected product events), attribution of referral codes in the partner programme, balanced against your rights.
  • Legal obligation (Art. 6(1)(c)): tax and accounting records where applicable.
  • Consent (Art. 6(1)(a) / § 25 TDDDG): optional Marketing cookies (Google Ads) via the consent banner; optional newsletter at trial signup (double opt-in). Clinic therapy communication is not a newsletter opt-in.

Recipients and processors

  • Stripe, Inc. — payment processing and customer billing portal. Stripe Privacy Policy
  • App hosting — app, API and databases on RehabPilot-operated servers on Amazon Web Services in Frankfurt, Germany (AWS Region eu-central-1); separation of data per clinic. Host DPA in place.
  • Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — hosting of this website rehabpilot.org including the website’s web-server logs, servers in Germany; DPA in place. Hetzner does not process practice or patient data of the apps.
  • Cloudflare, Inc. — media storage in Western Europe for exercise media and avatars (encrypted data only; no plain names or clinical findings); website delivery and protection.
  • Amazon Web Services EMEA SARL (Amazon SES) — transactional email for sign-in links, invites and plan PDFs (EU region Frankfurt).
  • Google Ireland Ltd. / Google LLC — push notifications (Firebase Cloud Messaging), neutral text only; Google Sign-In when used in the apps; Google Ads and Google Tag Manager on this marketing site (only after consent).
  • Apple Inc. — Sign in with Apple when used in the apps.
  • PureMetrix (Lydia Rebers, Munich) — cookieless audience measurement for this website, hosted in Germany.
  • Cal.com, Inc. — demo booking on the website (loaded on click or after Marketing consent).

Full sub-processor list: Sub-processors.

Infrastructure: App hosting, databases, media storage and email delivery of the apps with providers holding a BSI C5 attestation (Amazon Web Services, Cloudflare); the website rehabpilot.org is hosted by Hetzner in Germany. The attestation covers only these services of the providers, not RehabPilot itself and not other services such as push or payments. Attestations: AWS BSI C5 attestation, Cloudflare BSI C5 attestation. Whether Section 393 SGB V applies to its activities is assessed by the clinic itself.

We do not sell your personal data.

International transfers

Stripe, Cloudflare, Google, Apple, and some infrastructure providers may process data outside the EU/EEA. Where required, transfers rely on the EU-US Data Privacy Framework (where the provider is certified) or the EU Standard Contractual Clauses and the provider’s data-processing terms.

Retention

  • Customer account and license records: for the life of your account or license, plus statutory retention periods for invoices.
  • Patient and therapy data: while the clinic maintains the patient record or the DPA applies; automatic deletion 10 years after the patient’s last activity (a different period or exclusion of individual patients on the clinic’s instruction), otherwise deletion on the clinic’s instruction.
  • In-app messages: 30 days, then deleted automatically.
  • Completion records and workout ratings (training history): 180 days.
  • Support requests: 12 months after they are closed.
  • Device and push tokens: after 180 days of inactivity.
  • Jobs for sending week-schedule PDFs: 30 days.
  • Database backups (AWS RDS): 7 days, then overwritten.
  • Temporary checkout data (before payment completes): up to 24 hours.
  • Sign-in links / login codes: short-lived (typically hours).
  • Web-server logs (IP address, request metadata): rotated and deleted automatically on a regular schedule; logs needed to investigate a security incident are kept until it is resolved.
  • Referral code: together with subscription and billing records.

Right to object (Art. 21 GDPR)

Where we process personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR) — for example security logging or cookieless audience measurement — you may object at any time on grounds relating to your situation. We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing is needed for legal claims. To object, email [email protected].

Your rights

Under the GDPR you may have the right to:

  • access, rectify, or erase your personal data;
  • restrict or object to certain processing (including under Art. 21, see above);
  • data portability where applicable (patients can export their own data in the patient app: profile, plans, exercises, week schedules, session notes, messages, media metadata, and completion records; RehabPilot provides a full export of practice data to the practice via support as JSON);
  • withdraw consent at any time (without affecting prior lawful processing);
  • lodge a complaint with a supervisory authority — in Germany, your local state data-protection authority (Landesdatenschutzbehörde; in Bavaria: Bavarian State Office for Data Protection Supervision, BayLDA).

To exercise your rights, email [email protected]. Patients should prefer contacting their clinic (controller) about therapy data; we assist as processor. You can also manage billing details in the customer account or Stripe customer portal where available.

We have not appointed a data protection officer under Art. 37 GDPR. The contact above is also the point of contact for DPIA / records-of-processing questions from clinics (we assist as processor under the DPA).

Security

The apps use no passwords (sign-in via email link or login code, optional Google/Apple Sign-In, and PIN); only the web customer portal uses a password. No 2FA and no automatic logout for inactivity in the apps. Portal passwords, login codes and PINs are stored only in non-reversible form. Connections are always encrypted (HTTPS). Media is encrypted before upload; this encryption is always on and cannot be switched off. Data is separated per clinic. Access to production systems is restricted. No method of transmission over the Internet is 100% secure; we work to protect your data with reasonable technical and organisational measures.

Children

Our service is aimed at physiotherapy clinics and their practitioners. Patient accounts are created at the direction of the treating clinic. We do not knowingly collect data from children under 16 without the involvement of the responsible clinic and, where required, a parent or guardian.

Changes

We may update this policy when our services or legal requirements change. The “Last updated” date at the top indicates the current version.

Contact

RehabPilot
Josef Kirchhofer & Phillip Rosenheinrich GbR
Destouchesstr. 3 · 80803 Munich · Germany
Email: [email protected]