Introduction
PhysAlign is a rehabilitation platform that helps physiotherapists guide patients through exercises at home. This policy explains what personal and health information we collect, how we use and store it, and your rights. Because PhysAlign handles health information, we are bound by the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), regardless of our size.
Who this policy covers
There are two kinds of users:
- •Patients use a one-time access code given to them by their physiotherapist. Patients do not create an account and we do not ask patients for an email address or password.
- •Physiotherapists sign in to a clinician dashboard using an email address and password to create programs and review their patients' recordings.
Information We Collect
From patients (health information)
With your consent, we collect video and audio of you performing your prescribed exercises, a movement (skeleton) overlay derived from that video, and movement measurements such as repetitions, range of motion and an effort/exertion rating. We also collect your first name if your physiotherapist enters it, and the access code that links you to your program. This is health information, which the Privacy Act treats as sensitive information.
From physiotherapists
We collect the email address and password used to sign in, and the programs and notes you create for your patients.
Usage data
On our website we use privacy-friendly analytics (Vercel Analytics) that collects aggregate, non-identifying usage data such as page views. We do not use advertising trackers.
How and why we use your information
We collect this information for the primary purpose of delivering your physiotherapy care:
- •To provide real-time exercise feedback and movement tracking on your device.
- •To upload and store your recordings so your treating physiotherapist can review your technique and progress.
- •To operate, secure and improve the service.
We do not use your health information for advertising or marketing, we do not sell it, and we do not use it to build advertising profiles.
Consent
We ask for your explicit consent in the app before your camera and microphone are used to record you. You can decline, and you can stop recording at any time. If you are under 18, a parent or guardian should give this consent on your behalf.
How your recordings are stored
Movement tracking runs on your device. When you finish an exercise, your video and derived session measurements are uploaded to private platform storage for clinician review. Raw pose-frame upload is not currently guaranteed on every client. Data is encrypted in transit; access is intended to be restricted to authorised clinic practitioners.
No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.
Sharing and overseas storage
We share your information only with your treating physiotherapist and with the service providers that host the platform on our behalf (our database and storage provider, and our web and API hosting providers). These providers may store data on servers located outside Australia, including in the United States. When we disclose information overseas we take reasonable steps to ensure it is handled consistently with the APPs, and we remain accountable for it. We do not otherwise disclose your information unless required or authorised by law.
How long we keep it
Program access codes expire after 90 days by default. Recordings and session data are retained for as long as needed to provide your care and to meet health-record obligations, after which we take reasonable steps to delete or de-identify them. You may ask us to delete your data sooner (see below).
Your rights: access, correction and deletion
You may ask us to access, correct or delete the personal and health information we hold about you. Because patients do not have an account, please make these requests through your physiotherapist or by emailing us at the address below, and we will verify your identity before acting. We will respond within a reasonable period.
Data breaches
If a data breach that is likely to cause serious harm occurs, we will assess it and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
Children and young people
PhysAlign is intended to be used under the direction of a physiotherapist. Where a patient is under 18, we rely on a parent, guardian or the treating clinician to provide consent on their behalf.
Not a medical device
PhysAlign supports the guidance of a qualified physiotherapist. It does not diagnose conditions or replace professional medical advice. Always follow your physiotherapist's instructions.
Complaints
If you think we have mishandled your information, please contact us using the details below and we will investigate and respond. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au.
Changes to This Privacy Policy
We may update this policy from time to time. Material changes will be posted here with a new "Last updated" date. Where a change affects how we handle your health information, we will seek your consent again in the app.
Contact us
For privacy enquiries, requests, or complaints, contact our privacy officer at:
hettmehta05@gmail.com