Legal

Privacy Policy

Last updated: April 2025

Physio Pearls ("we", "us", "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, store, and protect your data when you use our website and services. By using Physio Pearls, you agree to the practices described in this policy.

1. Who We Are

Physio Pearls is a clinical reasoning and educational reference tool for physiotherapy students and clinicians. The service is operated by the Physio Pearls team. For any privacy-related enquiries, please contact us at [email protected].

2. What Data We Collect

2.1Account Information

When you sign in using Manus OAuth, we receive and store the following information provided by the authentication service:

Your display name
Your email address
A unique identifier (OpenID) from the OAuth provider
Login method and timestamp of last sign-in

2.2Usage Data

We collect anonymised analytics data to understand how the service is used. This includes page views, session duration, and general navigation patterns. This data is aggregated and does not identify individual users.

2.3Data We Do Not Collect

We do not collect:

Patient data of any kind — never enter patient information into this tool
Payment card details (handled entirely by Stripe if payments are enabled)
Precise location data
Health or medical data about you personally

3. How We Use Your Data

We use the data we collect for the following purposes:

To authenticate you and maintain your session across visits
To display your name and profile information within the app
To manage your subscription plan (Free, Pro, or Student) if applicable
To improve the service through anonymised usage analytics
To respond to support enquiries sent to our contact email

We do not use your data for advertising, profiling, or automated decision-making.

4. Legal Basis for Processing

Under the UK GDPR and EU GDPR, we process your personal data on the following legal bases:

Contract performance — to provide the service you have signed up for
Legitimate interests — to maintain security, prevent fraud, and improve the service
Consent — where you have explicitly agreed to receive communications from us

5. Cookies

5.1Session Cookies

Physio Pearls uses a single session cookie to keep you logged in during your visit. This cookie is strictly necessary for the service to function and does not track you across other websites. It is deleted when you sign out or when your session expires.

5.2Analytics

We use a self-hosted, privacy-first analytics tool (Umami) that does not use cookies and does not collect any personally identifiable information. No third-party advertising or tracking cookies are used on this site.

6. Data Storage and Security

6.1Where Your Data Is Stored

Your account data is stored in a secure cloud database. All data in transit is encrypted using TLS. Passwords are never stored — authentication is handled entirely by Manus OAuth.

6.2Security Measures

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include encrypted connections, access controls, and regular security reviews.

6.3Data Retention

We retain your account data for as long as your account is active. If you request deletion of your account, all associated personal data will be permanently removed within 30 days.

7. Third-Party Services

We use the following third-party services, each with their own privacy policies:

Manus OAuth

User authentication — handles sign-in securely without us storing passwords

Stripe (when payments are enabled)

Payment processing — we never see or store your card details

Amazon CloudFront / S3

Delivery of static assets (images, fonts) via CDN

8. Your Rights

Under UK and EU data protection law, you have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your personal data ('right to be forgotten')
Right to restriction — request that we limit how we use your data
Right to data portability — request your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

9. Children's Privacy

Physio Pearls is intended for use by physiotherapy students (typically aged 18+) and qualified clinicians. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify registered users of significant changes by updating the "Last updated" date at the top of this page. Continued use of the service after any changes constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us at:

[email protected]

You also have the right to lodge a complaint with your national data protection authority if you believe your data has been handled unlawfully.

Account deletion: To permanently delete your account and all associated data, please email [email protected] with the subject line "Delete my account". We will process your request within 30 days.