Privacy Policy

2.1 Personal Information

We collect personal information that you provide directly to us, including:

• Name, email address, phone number, and professional credentials
• Clinic or practice information
• Billing and payment information
• Profile information and preferences

2.2 Patient Health Information (PHI)

Healthcare professionals using our platform may input patient health information, including:

• Patient demographics and contact information
• Medical history and assessment data
• Treatment plans and progress notes
• Clinical test results and measurements
• Images, videos, and other clinical documentation

2.3 Technical Information

We automatically collect certain technical information, including:

• IP address, browser type, and device information
• Usage patterns and feature interactions
• Log files and system performance data
• Cookies and similar tracking technologies

3.1 Service Provision

We use your information to:

• Provide and maintain the AssessPro platform
• Process assessments and generate reports
• Enable communication between healthcare providers and patients
• Backup and restore your data

3.2 Account Management

We use your information to:

• Create and manage user accounts
• Authenticate users and prevent unauthorized access
• Process billing and subscription management
• Provide customer support and technical assistance

3.3 Improvement and Analytics

We may use aggregated, de-identified data to:

• Improve our services and develop new features
• Analyze usage patterns and system performance
• Conduct research to advance physiotherapy practices
• Generate industry insights and benchmarks

4.1 Security Measures

We implement comprehensive security measures to protect your information:

• End-to-end encryption for data transmission and storage
• Multi-factor authentication and access controls
• Regular security audits and penetration testing
• SOC 2 Type II compliance and certification
• Employee background checks and security training

4.2 Data Centers

Our data is hosted in secure EU-based data centers (Neon PostgreSQL and AWS S3 EU regions) with encryption at rest and in transit. All infrastructure providers maintain industry-leading security certifications including ISO 27001 and SOC 2 compliance standards.

4.3 Incident Response

In the unlikely event of a security incident, we have established procedures to quickly identify, contain, and remediate any issues. We will notify affected users and relevant authorities as required by applicable laws and regulations.

5.1 Healthcare Professionals (Data Controllers)

Healthcare professionals using AssessPro are data controllers for patient data. They process patient health information based on legal obligations (medical record-keeping requirements) and legitimate interests (providing healthcare services). AssessPro acts as a data processor on their behalf.

5.2 Role-Based Access Controls

We implement role-based access controls ensuring that healthcare professionals can only access patient information relevant to their professional responsibilities and with appropriate authorization.

6.1 Your Rights Under GDPR

As a user in the European Union, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Data Portability: Receive your data in a portable format
• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing of your personal data

To exercise these rights, please contact our Data Protection Officer at dpo@assesspro.com

6.2 EU-Only Data Storage

All data is stored exclusively in EU-based data centers (AWS EU regions and Neon EU database). We do not transfer personal data outside the European Economic Area (EEA). All service providers we use are GDPR-compliant and have executed Data Processing Agreements with us.

6.3 Data Protection Officer

We have appointed a Data Protection Officer to oversee compliance with data protection laws. You can contact our DPO at dpo@assesspro.com for any privacy-related inquiries.

9.1 Access and Control

You have the right to:

• Access and review your personal information
• Correct inaccurate or incomplete information
• Request deletion of your data (subject to legal requirements)
• Export your data in a portable format
• Opt-out of marketing communications

9.2 Cookie Preferences

You can manage your cookie preferences through your browser settings or our cookie preference center. Note that disabling certain cookies may affect the functionality of our platform.