If you or your practice are based in the United States, then the US version of our Terms of Service and the US version of our End User Terms apply to you.

If you or your practice are not in the United States, then the outside USA version of our Terms of Service and outside USA version of our End User Terms apply to you.

1. Important Information and Who We Are

This Privacy Policy aims to give you information on how Physitrack and our group companies collect, process, and secure your personal data. It covers our websites, software and related services (the Services), including the electronic medical record and practice-management service (EMR) where made available to the relevant Healthcare Customer.

Physitrack PLC and/or our group companies act as controller or processor depending on the processing activity, as explained below (collectively referred to as "Physitrack", "we", "us" or "our" in this Privacy Policy).

Controller and processor roles.

Physitrack acts in different privacy roles depending on the data, service, jurisdiction, and relationship involved. For personal data that we collect and use for our own account administration, billing, security, corporate, legal, direct customer-relationship, product-safety, compliance, and service-administration purposes, Physitrack acts as a controller, business, organisation, responsible entity, or equivalent role under applicable law. When a healthcare organisation, Health Practitioner, clinic, health system, hospital, or other customer uses our EMR, patient-management, clinical-documentation, exercise-prescription, remote-care, telehealth, interoperability, or integration features to process patient information, that customer generally determines why and how the patient information is used and acts as the controller, covered entity, health information custodian, trustee, health agency, responsible person, organisation, or other responsible health entity, as applicable. Physitrack processes that information on the customer’s documented instructions as a processor, service provider, business associate, business associate subcontractor, sub-processor, information manager, or equivalent role, as applicable. Our Data Processing Agreement, Business Associate Agreement, customer contract, and applicable product terms may contain additional terms governing that processing and will control to the extent they apply to customer-controlled patient information.

Our controller activities do not give us an independent right to use EMR patient records for advertising, AI model development or unrelated commercial purposes. Processing patient-record content to support, secure or administer the customer-directed Services remains subject to the applicable DPA, BAA, customer instructions and law.

If you are a patient and your information is contained in a clinical record created, received, maintained, transmitted, exported, or otherwise managed by your healthcare provider through the Services, your healthcare provider is normally the primary point of contact for questions about that record and for requests to access, correct, amend, restrict, delete, export, transfer, or receive a copy of it. We will assist the relevant customer with those requests as required by applicable law and our contract with the customer. Rights relating to clinical records may be subject to healthcare-specific access, correction, amendment, legal-record, audit-history, record-integrity, retention, legal-hold, patient-safety, professional, payer, regulator, and continuity-of-care requirements.

This Privacy Policy explains Physitrack’s handling of information. It does not replace your healthcare provider’s own privacy or collection notice or, where HIPAA applies, its Notice of Privacy Practices. The provider is responsible for explaining its care-related collection, use, disclosure and retention of patient information and for providing required notices and obtaining any required consents. Physitrack remains responsible for the obligations that apply to its own processing.

Data Protection Officer: dpo@physitrack.com. Address: 4th Floor, 140 Aldersgate Street, London, EC1A 4HY.

2. The Data We Collect About You as Controller

We collect, use, store and transfer different kinds of personal data about Health Practitioners, corporate representatives, patients, students and companies using the Services, including: Identity Data (e.g. name); Contact Data (address, email, telephone); Customer Relationship Data (business name, job title, communications records); Transaction Data (payment details and purchases); Technical Data (IP address, login data, browser information); Profile Data (API token, password, preferences); Usage Data (service usage information); Marketing and Communications Data (newsletter preferences); Financial Data (bank/credit card details); and Service Data (analytics and performance data).

For patients and students, the personal data Physitrack processes as a controller depends on the service and relationship involved and may include Usage Data, Contact Data, Identity Data, Health Data and Technical Data. Patient clinical information that we process on behalf of a Healthcare Customer is addressed separately in Section 3.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose, as this does not directly or indirectly reveal your identity.

Aggregated information that can still identify an individual remains personal data. Any anonymisation, de-identification or subsequent use of information derived from EMR Data remains subject to Section 9 and the applicable customer agreement.

Where Physitrack acts as a controller, we may process Special Categories of Personal Data, sensitive information or health information only where this is necessary for the relevant purpose and permitted by applicable law. This may include limited Health Data needed to provide a direct service, address support or security matters, establish or defend legal claims, or meet legal or regulatory obligations. Patient clinical information processed on behalf of a Healthcare Customer is addressed in Section 3. Under EU and UK data-protection law, we process Special Category Personal Data as a controller only where we have both an Article 6 lawful basis and an applicable Article 9 condition, such as explicit consent, the establishment, exercise or defence of legal claims, or another condition permitted by applicable law and any additional conditions required under the UK Data Protection Act 2018, where applicable.

3. The Data We Collect About You as Processor

We act as a processor (or service provider, business associate or subprocessor, as applicable) to Health Practitioners and other Healthcare Customers. In this role we process personal data on their behalf and on their documented instructions, and not for our own purposes.

Depending on which parts of the Services the relevant Healthcare Customer has enabled, the data we process in this role includes:

• Exercise prescription and remote care data — Identity Data (including a national health identifier such as an NHS number where the customer uses that field), the exercise programs and questionnaires assigned to you, your adherence to them, outcome and self-reported measures, and related Usage Data and Technical Data.
• EMR Data — personal data, health information, PHI, clinical information, personal health information, special category personal data, sensitive information, consumer health data where applicable, and related metadata entered, uploaded, generated, imported, accessed, stored, transmitted, exported, or otherwise processed through the EMR or a connected clinical workflow. Depending on the Healthcare Customer’s configuration and the features enabled, this may include: identity and demographic information such as name, date of birth, administrative sex, gender identity, Aboriginal and/or Torres Strait Islander status, ethnicity, race, preferred name, pronouns, interpreter or language needs, and other sensitive demographic information selected by the Healthcare Customer; contact and care-network information such as address, phone, email, emergency contact, GP or referring practitioner, care team, and authorised contacts; clinical intake and record information such as allergies, medicines, other medical conditions, safety or red-flag responses, presenting complaint, symptom history and severity, body-area information, functional impact and goals, free-text clinical notes, diagnoses or diagnosis codes, body-chart entries, treatment information, outcomes, and care-plan information; appointment, scheduling, consent, payment-status, and patient-communication information where enabled; RTM, exercise, adherence, and outcome data from enabled Physitrack services; consultation audio, transcripts, and draft clinical documentation where an enabled recording, speech-to-text, or AI-scribe feature is used; patient-specific AI requests, responses and retained clinical context, where those features are enabled; interoperability, referral, export, transfer, or integration records; and audit records of access to and changes to the record.

The standard EMR intake does not, by itself, include payer claims or insurance revenue-cycle-management data, identity-document images, or biometric identity templates unless those features are separately enabled. Beta Environments are subject to the stricter restrictions described below and must not be used for live billing, reimbursement, claims, or other production workflows. If additional payer, insurance, identity-verification, or other functionality is introduced or enabled, the relevant notices and this Privacy Policy will be updated where required.

Where a parent, guardian, carer or other authorised person provides information on behalf of a patient, EMR Data may also include that person’s identity and contact details, relationship to the patient and the basis on which they are authorised to act.

Some of this information is Special Category Personal Data, sensitive information, health information or PHI under applicable law. We process it only as necessary to provide the Services to the relevant Healthcare Customer.

The Healthcare Customer determines what information is collected, which enabled fields are used, who may access it and how long it is kept. For configurable patient intake forms, the Healthcare Customer determines which available fields are included and whether an included field is optional or required; Physitrack does not designate the Aboriginal and/or Torres Strait Islander status field as inherently mandatory. Retention of data we process in this role follows the customer’s instructions and the applicable customer agreement, DPA or BAA. Where no customer-specific retention period applies, our Data Retention Policy applies, subject to the applicable DPA, BAA and law; it does not override mandatory patient-record protections or an agreed return or deletion obligation. See Section 9 (Data Retention).

Real patient information may be processed in the EMR only where Physitrack has made the relevant service available for production clinical use and the required customer agreements and safeguards are in place, including an applicable BAA before HIPAA-regulated PHI is processed. The separate restrictions for non-production environments below continue to apply.

Beta, pilot, preview, sandbox, demonstration, and evaluation environments. Unless Physitrack expressly identifies an environment in writing as approved for production clinical use and the required privacy, security, contractual, implementation, and compliance steps have been completed, beta, pilot, preview, pre-release, sandbox, demonstration, and evaluation environments must not be used to enter, upload, import, record, dictate, display, store, transmit, or otherwise process real patient data, PHI, personal health information, Special Category Personal Data, sensitive information, consumer health data, EMR Data, production data, live clinical data, or other personal data relating to an actual patient or other third party. Such environments are intended for synthetic, dummy, anonymised, or other non-live test data only and must not be used for diagnosis, treatment, clinical decision-making, patient communications, emergency communications, legal medical records, billing, reimbursement, claims, regulatory reporting, or other clinical or production purposes unless Physitrack expressly states otherwise in writing. This restriction does not prevent Physitrack from processing limited personal data about beta users themselves, such as identity and contact information, account and authentication data, Technical Data, Usage Data, support communications, and feedback, where reasonably necessary to provision, administer, secure, support, evaluate, and improve the beta and the Services in accordance with this Privacy Policy. Beta users must not include real patient or other third-party personal data in prompts, free-text fields, uploads, recordings, transcripts, feedback, or support requests.

4. How Is Your Personal Data Collected?

We use different methods to collect data from and about you including through: direct interactions, where you may give us your Identity, Contact and Financial Data by filling in forms, by corresponding with us by post, phone, email, chatbot or otherwise; automated technologies, where we (and our third-party partners) automatically collect Technical Data as you interact with our website, using cookies and similar technologies; and third parties, from whom we may receive data such as payment providers, LinkedIn, and Health Practitioners.

For EMR and clinical workflows, information may also be collected directly from a patient, authorised representative or clinician through booking and intake forms, questionnaires, clinical documentation, patient portals, communications and, where enabled, consultation recording or transcription; from a Healthcare Customer’s existing systems or enabled Physitrack services through customer-authorised integrations, APIs or data imports; from referral sources; from devices or connected services enabled by the customer; and from records generated when authorised users access, edit, export, transmit or otherwise use the EMR. We describe integration methods at a high level here because the specific systems and technical methods available may vary by customer and configuration.

5. How We Use Your Personal Data

The first table below describes the ways we use personal data when Physitrack acts as controller and the legal bases we rely on. The separate EMR table that follows describes customer-directed processing where Physitrack acts as processor, service provider, business associate or subprocessor; it does not create an independent purpose for Physitrack to use patient clinical records.

For EMR Data, the Healthcare Customer is responsible for establishing the applicable legal basis and any additional condition required for health or other sensitive information. Under EU and UK data-protection law, this requires both an Article 6 lawful basis and an applicable Article 9 condition, such as healthcare under duties of confidentiality where its requirements are met. Acceptance or acknowledgement of this Privacy Policy or the software terms does not, by itself, establish consent to consultation recording, AI-assisted processing or marketing.

How we process EMR Data for Healthcare Customers

‍

AI-assisted EMR features. Where an AI-scribe, speech-to-text, intake-readback, summarisation, drafting, or other AI-assisted EMR feature is enabled, patient information is processed only to provide the requested feature on behalf of the Healthcare Customer and in accordance with applicable contractual, privacy, and security safeguards. We do not use EMR Data, PHI, patient clinical information, patient recordings, transcripts, or de-identified patient-record data to train or fine-tune AI models, and approved AI subprocessors are not permitted to use EMR Data, PHI, patient clinical information, patient recordings, transcripts, or de-identified patient-record data for their own model training. Consultation audio is processed only when the relevant recording, transcription, or AI-assisted feature is started by an authorised user and subject to the Healthcare Customer’s applicable notice, consent, or other legal requirements. Consultation audio is deleted after transcription as described in Section 9. AI-generated drafts and other AI-assisted outputs are intended for review, correction, and approval by an authorised clinician before they are relied upon for patient care or incorporated into the clinical record. AI-assisted outputs may be incomplete, inaccurate, delayed, or unsuitable for a patient’s circumstances and are not emergency alerts, medical advice, diagnosis, treatment instructions, or a substitute for professional judgment.

An enabled AI assistant may retrieve a patient’s existing notes, retained transcripts and other authorised clinical context to answer a clinician’s request or prepare documentation for that patient. This use of records as context is subject to the same patient-record protections and is not permission to train a model or reuse one customer’s records for another customer. EMR AI features support transcription, drafting, retrieval and search; they do not autonomously make diagnosis or treatment decisions about a patient, and Physitrack does not use EMR AI features to make decisions about patients based solely on automated processing that produce legal or similarly significant effects.

The Healthcare Customer must provide the notices and obtain the consent or other legal authority required for recording, transcription and AI-supported documentation before the relevant processing starts, including the agreement of all participants where applicable recording law requires it. If you have concerns about recording or an AI-assisted feature, contact your healthcare provider. Patients who do not agree to recording should tell their provider before recording begins. Where consent is required, recording must not proceed without that consent. The provider remains responsible for documenting care in accordance with applicable law. Where processing relies on consent, you may withdraw that consent through your provider for future processing. Withdrawal does not itself require deletion of an existing clinical record that must lawfully be retained.

6. Disclosures of Your Personal Data

We may share your personal data for business and commercial purposes, such as operating the Services, with the parties set out below for the purposes set out in the table above:

• Health Practitioners who use the Services to collect and process your personal data.
• Service providers acting as processors who provide IT, hosting, system administration, security, communications, speech-to-text and AI processing services identified in our Data Processing Agreement and subprocessor list at https://www.physitrack.com/legal/data-processing-agreement.
• Affiliates as a controller and/or processor for business and commercial purposes (meaning Physitrack's own corporate group of companies — see "Affiliates" in the Glossary. This is distinct from Affiliate Partners, described below, who are external to the Physitrack group).
• Affiliate Partners — external commercial, referral, reseller or commission-based partners with whom we operate a discount code, referral or affiliate program (see "Affiliate Partners" in the Glossary), for the purpose of administering that arrangement and calculating and paying commission owed to them. We only share the minimum data necessary for this purpose — typically your name, email address, and the status of your trial or subscription — and, where reasonably practicable, we will notify you at the point you use a discount or referral code that this sharing may occur.
• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other governmental authorities who require reporting of processing activities in certain circumstances.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.

EMR Data disclosures

EMR Data is disclosed only as necessary to provide, secure, support, administer, maintain, and improve the customer-directed Services (improvement only to the extent permitted by the applicable DPA, BAA, customer agreement and law, and never by training AI models on EMR Data); comply with the Healthcare Customer’s documented instructions; satisfy applicable legal obligations; or perform other activities permitted by the applicable DPA, BAA, customer agreement, and law. This may include disclosure to authorised users of the relevant Healthcare Customer; the patient or an authorised representative where directed by the customer, enabled by the Service, or required by law; approved subprocessors that provide hosting, security, support, communications, speech-to-text, AI processing, interoperability, or other infrastructure needed for the EMR; systems and integrations selected, configured, or authorised by the customer; other healthcare providers, recipients, repositories, or systems where the customer directs or lawfully authorises the disclosure; and regulators, courts, professional bodies, payers, or public authorities where disclosure is required or permitted by law.

For EMR features, Amazon Web Services provides hosting and storage, speech-to-text through Amazon Transcribe, AI inference through Amazon Bedrock, including Anthropic Claude models, and service email delivery. Monitoring, messaging and other approved providers are used only for their authorised functions. The applicable providers, data categories, purposes and processing locations are described in our DPA and subprocessor list; inclusion in that list does not mean every provider receives patient information or is used for every feature or market. We engage subprocessors for EMR Data only under written terms imposing data-protection obligations no less protective than our own, including a business associate agreement where HIPAA applies. We give Healthcare Customers advance notice of new or replacement subprocessors, and an opportunity to object, as provided in the DPA. Physitrack remains responsible for its subprocessors' performance as required by law and contract.

Where a Healthcare Customer enables payments, Stripe processes payment details through its payment services. The EMR may hold payment tokens or reference identifiers, card brand and last four digits, transaction information and payment status; it does not store full card numbers or card security codes. We limit information sent to Stripe to what is needed for the payment service and do not send clinical notes, consultation audio or transcripts in payment metadata. Stripe may also process payment information for its own legal, fraud-prevention or regulatory purposes as described in its privacy notice at https://stripe.com/privacy. The Healthcare Customer remains responsible for required payment notices and authorisations, including any authorisation needed to save a payment method or make later charges.

We do not disclose EMR Data, patient clinical information, PHI, personal health information, or consumer health data to Affiliate Partners, referral partners, resellers, advertising partners, or marketing partners for their own commercial, advertising, or marketing purposes. Any affiliate, referral, reseller, or commission-related disclosures described elsewhere in this Policy apply to customer, account, subscription, or commercial relationship information, not patient clinical records. Where the minimum-necessary principle, data-minimisation principle, or an equivalent local-law requirement applies, we limit access, use, and disclosure to the information reasonably necessary for the relevant purpose.

We do not sell EMR Data or use it for targeted advertising or cross-context behavioural advertising. We do not use advertising or session-replay tools to capture patient-record content in EMR clinical screens. The website and commercial-account marketing activities described elsewhere in this Policy do not authorise such use of patient records.

Where a Healthcare Customer, authorised user, patient, or authorised representative exports, downloads, prints, transmits, transfers, discloses, or otherwise makes EMR Data available outside Physitrack-controlled systems, the recipient and the Healthcare Customer are responsible for the security, use, disclosure, retention, onward transfer, and further handling of that copy, except to the extent Physitrack remains legally or contractually responsible for its own processing.

7. International Transfers

Where necessary, we may transfer personal data to another country to provide, secure, support, administer, and improve the Services; perform customer relationship management and business operations; use approved subprocessors; respond to support requests; comply with law; or carry out customer-authorised integrations, exports, transfers, and interoperability workflows. Many of our external third parties are based outside the country in which you reside, so their processing of personal data may involve a transfer of data outside your country.

For EMR Data, the primary hosting location is determined by the Healthcare Customer’s contracted service region and product configuration. Additional processing, support access, security operations, or subprocessor processing may occur in locations used by approved subprocessors, as identified in our current subprocessor information and applicable customer contracts. We do not promise customer-selectable data residency except where it is expressly included in the applicable service configuration or contract.

For the EMR service regions made available to customers, primary application hosting uses AWS regions in the United States, Australia, the United Kingdom, Canada and Ireland, according to the relevant service configuration. Regional hosting does not mean that all processing stays in that country. Depending on the enabled feature and agreed configuration, UK AI processing may take place in the European Union, Canadian AI processing may take place in the United States, and monitoring, messaging, support or backup processing may occur outside the primary hosting country. Our DPA and subprocessor information describe the applicable locations and safeguards. A regional hosting statement does not override a stricter location restriction in the applicable customer agreement or law. Where Canadian information is processed in the United States, it may be subject to the laws of that jurisdiction and accessible to its courts, law-enforcement and national-security authorities.

Where personal data is transferred outside the United Kingdom, European Economic Area, Switzerland, Canada, Australia, New Zealand, or another jurisdiction with transfer restrictions, we use transfer mechanisms and safeguards required by applicable law. These may include adequacy decisions, standard contractual clauses, UK transfer mechanisms, transfer risk assessments, supplementary measures, processor or service-provider contractual commitments, or comparable safeguards. Where Australian personal information is disclosed to an overseas recipient, we take the steps required by applicable Australian privacy law, including requirements governing overseas disclosures. Where New Zealand health information is transferred overseas, we apply the safeguards required by the New Zealand Privacy Act and Health Information Privacy Code where applicable.

Without reducing Physitrack’s own obligations for its transfers and subprocessors, Healthcare Customers are responsible for ensuring that their instructions to transfer, export, disclose, or otherwise make patient information available outside the relevant jurisdiction are lawful, supported by any required notice, consent, authorisation, contractual term, professional requirement, or other legal basis, and consistent with applicable health-record, confidentiality, interoperability, and continuity-of-care obligations.

How we safeguard personal data when we transfer it internationally

Whenever we transfer your personal data out of your country, we take reasonable steps to ensure a similar degree of protection is afforded to it by using at least one of the following safeguards:

• Transfers to countries recognised under applicable law as providing an adequate level of protection; or
• Where we use certain service providers, we may use standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or other contracts approved under applicable law, supported by transfer risk assessments and, where needed, supplementary measures.

For further details of the specific mechanisms we rely on where we transfer your data internationally, please see https://www.physitrack.com/legal/data-processing-agreement.

8. Data Security; Security Incidents and Personal Data Breaches

We have put in place reasonable technical, organisational, and administrative security measures designed to meet the requirements of applicable law and to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Because EMR Data may include highly sensitive clinical information, we apply measures appropriate to the risk. Depending on the service and customer configuration, these measures may include role-based access controls, authentication controls, least-privilege access, encryption in transit and at rest, audit logging, tenant separation, secure backups, monitoring, vulnerability management, incident-response procedures, confidentiality obligations, and controls aligned with our information-security management system.

Access to EMR Data by Physitrack personnel is limited to authorised personnel with a legitimate need to access the information for support, security, legal, compliance, or operational purposes and is subject to confidentiality and access-control requirements. Healthcare Customers are responsible for configuring and managing authorised-user access; using unique credentials; applying appropriate role-based and least-privilege permissions; promptly deactivating users who no longer require access; training their workforce; maintaining reasonable endpoint and network security; preventing credential sharing; and protecting copies of patient information exported, downloaded, printed, transmitted, or otherwise transferred from the Services to systems, devices, files, recipients, or environments under the Healthcare Customer’s control.

If a security incident, personal data breach, breach of unsecured PHI, confidentiality incident, or unauthorised access, use, disclosure, alteration, loss, or destruction affects customer-controlled EMR Data, we notify and assist the relevant Healthcare Customer in accordance with applicable law and the customer agreement, DPA, or BAA. The Healthcare Customer is generally responsible for notifying affected individuals, regulators, media, professional bodies, payers, funders, or other persons where legally required of the Healthcare Customer, except to the extent Physitrack has a direct legal obligation to provide notice. We notify individuals and regulators directly where Physitrack has a direct legal obligation to do so and may coordinate with the Healthcare Customer to the extent lawful and reasonably practicable.

No internet-connected service can be guaranteed to be completely secure or continuously available. You remain responsible for using the Services in accordance with applicable instructions, maintaining the security of devices and credentials under your control, and promptly notifying Physitrack or the relevant Healthcare Customer if you believe an account, credential, device, link, or environment has been compromised.

9. Data Retention

For personal data that we process as controller, we retain it for as long as reasonably necessary to fulfil the purposes for which we collected it, including for contractual, legal, regulatory, tax, accounting, reporting, security, audit, business-continuity, dispute-resolution, and claims-related purposes. We may retain personal data for a longer period where required or permitted by applicable law, where necessary to address a complaint or security issue, or where we reasonably believe there is a prospect of litigation or regulatory inquiry relating to our relationship with you. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data; the potential risk of harm from unauthorised use or disclosure; the purposes for which we process the data; whether those purposes can be achieved by other means; and applicable legal, regulatory, tax, accounting, professional, contractual, and other requirements.

EMR Data retention. EMR Data is retained in accordance with the Healthcare Customer’s instructions, the applicable customer agreement and retention schedule, the applicable DPA or BAA, product configuration, and any legal, professional, payer, regulator, or health-record obligations that apply to the relevant clinical record. Healthcare Customers may be required to retain medical records for periods that prevent immediate deletion even when an individual requests erasure. The Healthcare Customer is responsible for determining and meeting the medical-record retention obligations that apply to its patients and practice, including rules concerning children, professional obligations and legal holds. Those obligations do not, by themselves, require Physitrack to provide permanent archival storage after the relevant Services end.

Before the relevant Services end or the agreed export or access period expires, the Healthcare Customer is responsible for arranging export or return of its patient records, checking that the records obtained are complete and usable, and securely preserving them for the rest of the legally required retention period. This includes retained transcripts and other information forming part of the patient record. The end of a subscription, trial or other Services does not transfer the clinic’s continuing recordkeeping duties to Physitrack. If your healthcare provider closes or stops using the Services, contact that provider (or its successor or records custodian) to access your records; we will assist as described in Section 11 while we continue to hold them.

Physitrack will provide a reasonable opportunity and secure means to obtain the records before scheduled deletion, through available export functionality or appropriate assistance. We notify the Healthcare Customer of scheduled deletion and provide a reasonable opportunity to arrange return or export in accordance with the applicable agreement and law. At the end of the relevant Services, we return and delete, or securely delete, EMR Data in accordance with the Healthcare Customer’s choice under the applicable DPA or BAA, the agreed timetable and applicable law. If the Healthcare Customer does not make a timely election, we will delete EMR Data in accordance with the applicable DPA or BAA and Data Retention Policy, and will not retain it indefinitely. The Data Retention Policy at https://www.physitrack.com/legal/data-retention provides the applicable default timetable, subject to those requirements. Physitrack remains responsible for lawful access assistance, confidentiality and security for information it continues to hold; the clinic’s export responsibilities do not waive those duties.

Retained consultation transcripts that remain available for later care are treated as patient-record content for confidentiality, security, retention, access and export, even after a clinician signs the resulting note. We do not treat such transcripts as disposable temporary files merely because a signed note exists. They are retained under the Healthcare Customer’s lawful instructions and the applicable record-retention and return or deletion arrangements.

Uploaded consultation audio is deleted from active application storage promptly after transcription completes or finally fails, unless a different lawful retention arrangement is expressly agreed. Live transcription processes an audio stream without keeping a separate audio recording, unless a separate recording feature and its retention terms are expressly enabled. Temporary transcription files, outputs and jobs are deleted when no longer needed after secure ingestion or final failure. Deleting temporary audio or supplier output files does not delete the retained transcript in the EMR database.

Where law requires continued retention, or return or deletion of PHI is infeasible under the applicable BAA and HIPAA, we restrict further use to the permitted retention purpose and continue the required protections. Residual backup copies are protected, kept out of ordinary operational use and deleted or overwritten through the applicable documented secure deletion cycle, within any binding legal or contractual deadline. Deletion instructions are reapplied if a backup is restored. These restrictions also apply to the subprocessors holding the information.

Where Australian privacy law applies, we take reasonable steps to destroy or de-identify personal information once it is no longer needed for a purpose for which it may lawfully be used or disclosed, unless it forms part of a Commonwealth record or an applicable Australian law or court or tribunal order requires retention. Where EU or UK data-protection law applies, deletion, return, restriction, and retention of personal data processed on behalf of a Healthcare Customer will be handled in accordance with the applicable DPA, applicable law, and the Healthcare Customer’s documented instructions.

Any de-identification or anonymisation of EMR Data, and subsequent use of that information, must be authorised by the Healthcare Customer under the applicable agreement and permitted by law; this Section does not create an independent right to repurpose patient records. Where we use de-identified or anonymised information for permitted analytics, research, statistical, security, compliance, benchmarking, or product-improvement purposes, we apply the de-identification or anonymisation standard required by applicable law and do not treat merely pseudonymised information as anonymous. Where HIPAA applies, PHI used as de-identified information must satisfy an applicable HIPAA de-identification method. We do not attempt to re-identify data that has been treated as anonymous or de-identified for these purposes, except where lawfully required or reasonably necessary to test the effectiveness of de-identification safeguards. Nothing in this Section permits us to use identifiable EMR Data, patient clinical information, PHI, patient recordings, transcripts, or de-identified patient-record data to train or fine-tune AI models.

10. EU Representative

Our representative within the EU with respect to our obligations under European data protection law is Physiotools Oy, incorporated and registered in Finland with company number 0491074-9, whose address is Kehräsaari B, 5th Floor, 33200 Tampere, Finland. Email: data.protection@physiotools.com.

11. Your Legal Rights

Depending on where you live, you may have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: if you want us to establish the data's accuracy; where our use of the data is unlawful but you do not want us to erase it; where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, where applicable law provides this right.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us at dpo@physitrack.com.

Requests about EMR Data

If your request concerns EMR Data held on behalf of your healthcare provider or another Healthcare Customer, please contact that provider or customer in the first instance. The provider or customer controls the clinical record and is generally responsible for responding to requests concerning access, correction, amendment, deletion, restriction, objection, portability, export, transfer, accounting, representative access, and similar patient or data-subject rights. We will assist the provider or customer as required by applicable law and our agreement with them. You may also contact our Data Protection Officer if you are unsure who controls the relevant information.

If we receive a request concerning records held for a Healthcare Customer, we promptly refer it to that customer and assist with the response, unless applicable law requires us to respond directly. Assistance includes relevant retained transcripts and associated record information, through available exports or secure assistance as required by law and our agreement. The absence of a self-service function does not remove a mandatory access or assistance obligation.

Where HIPAA applies, your rights to access, amend and receive an accounting of disclosures of your PHI are exercised through your healthcare provider as the covered entity, and we make PHI available to it as required by the BAA.

Rights relating to clinical records may be subject to healthcare-specific retention, access, correction, amendment, record-integrity, audit-history, legal-hold, safety, professional, payer, regulator, and continuity-of-care requirements. For example, a healthcare provider may be legally required to retain a clinical record even where an individual would otherwise have a right to request deletion. Corrections or amendments to a clinical record may need to preserve an audit history rather than silently overwrite the original clinical entry. Where a parent, guardian, carer, substitute decision-maker, personal representative, or other authorised person seeks to act on behalf of a patient, the relevant Healthcare Customer is generally responsible for verifying that person’s authority and configuring access consistently with applicable law and professional obligations.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). Where applicable law permits, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may refuse a request on these grounds only where applicable law permits. Any fees, refusal grounds or access limits for clinical records must comply with the relevant healthcare and privacy law.

What we may need from you

We may need to request specific information from you and to follow certain procedures to help us verify the request, confirm your identity, and ensure your right to access your personal data (or to exercise any of your other rights). The verification steps we take may differ depending on your country of residence and the request. We will match the information that you provide in your request to information we already have on file to verify your identity. If we are able to verify your request, we will process it in accordance with applicable law. If we cannot verify your request, we may ask you for additional information to help us verify your request. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We respond within the period required by applicable law. Under EU and UK data-protection law, this is normally one month, subject to permitted extensions. For access requests under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), it is normally 30 calendar days, subject to permitted extensions. Under Australian Privacy Principle 12, private organisations must respond to access requests within a reasonable period, generally no more than 30 calendar days. Different deadlines may apply under other relevant health-information or privacy laws. We provide any extension or refusal notices required by law.

If you have a privacy concern or complaint, contact our Data Protection Officer at dpo@physitrack.com. We will review the complaint, seek any information needed to investigate and respond with the outcome and any proposed resolution within the applicable legal timeframe. You may also complain to the relevant privacy regulator, including the UK Information Commissioner, your EU supervisory authority, the Office of the Australian Information Commissioner, or the relevant Canadian federal or provincial privacy commissioner. Where HIPAA applies, you may complain to the U.S. Department of Health and Human Services Office for Civil Rights.

12. Considerations in the United States

HIPAA and Protected Health Information

Where HIPAA applies, identifiable health information that constitutes Protected Health Information (“PHI”) under HIPAA is handled in accordance with HIPAA, the HITECH Act where applicable, and the Business Associate Agreement (“BAA”) with the relevant covered entity or business associate. Not all health-related information in the United States is PHI; other federal or state privacy laws may apply to health information that falls outside HIPAA or where an applicable HIPAA exemption does not apply.

Where HIPAA applies, we use, disclose, protect, retain, return, and destroy PHI only as permitted by HIPAA and the applicable BAA, including to provide the Services and functionality requested by the relevant Healthcare Customer; carry out documented instructions; perform permitted business-associate functions; use approved subcontractors or sub-business associates; comply with applicable legal requirements; and support privacy, security, audit, and compliance obligations. We do not use PHI or other EMR Data to train or fine-tune AI models. We disclose PHI only as permitted by HIPAA, the applicable BAA, applicable law, or the documented direction of the relevant Healthcare Customer. A patient, authorised representative, or authorised user is responsible for disclosures that they initiate through functionality made available to them.

Interoperability, patient access, and information access

Where U.S. law concerning interoperability, patient access, electronic health information export, information access, or information blocking applies to a Healthcare Customer, the Healthcare Customer is responsible for determining the legal basis, scope, recipient, timing, and professional requirements applicable to any access, exchange, export, amendment, accounting, transfer, or continuity-of-care request. Physitrack will provide contracted Service functionality and BAA-required assistance reasonably necessary to support the Healthcare Customer’s lawful obligations for PHI maintained through the Services. Any restriction or delay must be permitted by applicable law and the BAA. Limits in standard product functionality do not remove our duty to provide required access or assistance.

US state privacy law disclosures

If you are a resident of a U.S. state with a comprehensive consumer privacy law and that law applies to our processing, you may have some or all of the following rights, in addition to those set out in the “Your Legal Rights” section above: the right to know and access the categories and specific pieces of personal data we have collected about you; the right to correct inaccurate personal data; the right to delete personal data we hold about you; the right to opt out of sale of personal data, sharing for cross-context behavioural advertising where applicable, and certain profiling that produces legal or similarly significant effects; the right to data portability; the right to limit certain uses or disclosures of sensitive personal data where applicable; and, in some states, the right to appeal a refusal to act on a request. We do not discriminate against you for exercising any of these rights. Where we process personal data solely on behalf of a Healthcare Customer, that Healthcare Customer is generally responsible for responding to requests concerning the relevant clinical record, and we assist as required by law and contract.

Consumer health data

Certain U.S. state consumer health data laws regulate health-related information that may fall outside HIPAA. Depending on the circumstances, Physitrack may process this information on behalf of a Healthcare Customer or may have direct obligations for processing it for its own purposes. Where Physitrack acts only as a processor or service provider for a Healthcare Customer, that customer determines the purpose of the processing and is generally the primary point of contact for consumer requests; we assist the customer as required by law and contract. Where Physitrack has direct obligations, we provide any required consumer health data notice and obtain consent where required. We do not sell consumer health data, and we do not use geofencing around healthcare facilities for purposes prohibited by applicable law. Where applicable law gives you rights in relation to consumer health data, those rights may include confirming whether data is collected, shared, or sold; accessing data; withdrawing consent where applicable; and requesting deletion, subject to statutory exceptions.

Heightened-confidentiality and sensitive health information. Healthcare Customers are responsible for determining whether particular categories of health information are subject to heightened confidentiality, consent, authorization, segmentation, disclosure, or retention requirements under federal or state law, including mental health, substance-use-disorder, reproductive, genetic, HIV/AIDS, minor, disability, sensitive demographic, biometric, and similar information. Healthcare Customers are responsible for configuring and using the Services consistently with those requirements, providing required notices, obtaining required consents or authorizations, and honoring applicable patient, consumer, or representative rights. Physitrack will comply with obligations imposed on it by applicable law, the applicable BAA, and any applicable data-processing or service-provider terms.

We do not discriminate against you for exercising any of these rights.

To exercise a right described in this section, please contact us at dpo@physitrack.com. We may need to verify your identity before responding, as described in the "Your Legal Rights" section above. You may also designate an authorised agent to make a request on your behalf, subject to our ability to verify the agent's authority to act on your behalf.

Washington "My Health My Data Act" notice

Washington State’s My Health My Data Act (“MHMD”) regulates certain “consumer health data,” including some health-related information that may fall outside HIPAA. Depending on the circumstances, Physitrack may process this information on behalf of a Healthcare Customer or may have direct obligations under MHMD for processing it for its own purposes.

Where Physitrack acts only as a processor or service provider for a Healthcare Customer, that customer determines the purpose of the processing and is generally the primary point of contact for consumer requests; we assist the customer as required by law and contract. Where Physitrack has direct obligations under MHMD, we provide any required consumer health data notice and obtain consent where required. We do not sell consumer health data, and we do not use geofencing around healthcare facilities for purposes prohibited by MHMD.

Where MHMD gives you rights in relation to consumer health data, those rights may include confirming whether data is collected, shared or sold; accessing data; withdrawing consent where applicable; and requesting deletion, subject to statutory exceptions. If the data is held for your healthcare provider or another Healthcare Customer, contact that provider/customer first. You may also contact us at dpo@physitrack.com if you are unsure who controls the relevant information.

13. Considerations in Australia

If the Australian Privacy Act 1988 (Cth) applies to the handling of your personal data, this Section applies. In this Privacy Policy, references to “Special Categories of Personal Data” should be read, where the Australian Privacy Act applies, as including “sensitive information” under that Act. Health information and information about racial or ethnic origin receive additional protection. Sensitive information is collected, used, and disclosed only as permitted by applicable law, including where valid consent is required or a permitted health situation or other legal exception applies.

Where a Healthcare Customer enables Australian EMR or intake functionality, the Healthcare Customer is responsible for determining the purpose of collection; providing required collection notices; obtaining and retaining any consent or other legal authority required for health information and sensitive information; deciding whether a field is optional or required for its workflow; verifying the authority of parents, guardians, carers, substitute decision-makers, or other authorised representatives; and complying with applicable health-record, access, correction, transfer, retention, and professional obligations. Physitrack processes the information on that Healthcare Customer’s behalf in accordance with the applicable customer agreement, DPA or equivalent terms, Privacy Policy, and applicable law.

Aboriginal and/or Torres Strait Islander status. Where a Healthcare Customer enables this EMR intake field, Physitrack processes the information on that customer’s behalf as part of the patient’s demographic and health-service record. The Healthcare Customer decides whether to include the field and whether an included field is optional or required for its workflow; Physitrack does not make this field inherently mandatory. The information may be provided by the patient or an authorised representative, entered by an authorised clinician, or received through a customer-authorised integration. It is available to authorised users according to the Healthcare Customer’s permissions and, where necessary, to limited authorised Physitrack personnel as described in Section 8. The Healthcare Customer is responsible for determining and communicating the specific health-service purpose for collecting the field and for obtaining consent or other legal authority where required. We do not use identifiable Aboriginal and/or Torres Strait Islander status for advertising or marketing, and we do not use it to train AI models. Any use of genuinely de-identified or anonymous information is governed by Section 9.

Where Australian privacy law applies, we take reasonable steps to destroy or de-identify personal information once it is no longer needed for a purpose for which it may lawfully be used or disclosed, unless it forms part of a Commonwealth record or an applicable Australian law or court or tribunal order requires retention. Where Australian personal information is disclosed to an overseas recipient, we take the steps required by applicable Australian privacy law, including the requirements governing overseas disclosures.

13A. Considerations in Canada

Where Canadian federal, provincial, or territorial privacy or health-information law applies, the relevant Healthcare Customer is generally responsible for determining whether it is a health information custodian, trustee, organisation, public body, service provider, affiliate, information manager, or other regulated entity and for complying with applicable notice, consent, safeguarding, access, correction, retention, breach-notification, residency, and service-provider requirements. Physitrack processes personal information and personal health information in accordance with the applicable customer agreement, DPA or equivalent terms, Privacy Policy, and law, including by using contractual, technical, and organisational safeguards appropriate to the sensitivity of the information.

Processing outside Canada remains subject to applicable federal and provincial privacy and health-information laws and any customer-specific location restrictions. A description of overseas processing in this Policy does not override those restrictions or authorise processing outside the locations permitted by the applicable customer agreement and law.

If your request concerns personal health information held by Physitrack on behalf of a Canadian Healthcare Customer, please contact that Healthcare Customer first. We will assist the Healthcare Customer as required by applicable law and our agreement with it. Where Physitrack has direct obligations under applicable Canadian privacy law, we will respond to requests and provide notices in accordance with that law.

13B. European Health Data and Interoperability Developments

To the extent European Union, United Kingdom, or Member State law concerning electronic health data, interoperability, patient access, health-record portability, or cross-border health-data exchange becomes applicable to the Services or to a Healthcare Customer, Physitrack and the Healthcare Customer will comply with the obligations applicable to them. Healthcare Customers remain responsible for determining their professional, controller, healthcare-provider, legal-record, retention, and health-record obligations, including the lawful basis and professional requirements for making electronic health data available to patients, other healthcare providers, authorised representatives, or other recipients. Physitrack will provide the contracted functionality and DPA-required assistance as required by applicable law and the DPA, including where assistance beyond standard self-service functionality is needed.

14. Considerations in New Zealand

If the New Zealand Privacy Act 2020 ("NZ Privacy Act") applies to the handling of your personal data, this section will apply.

We will also comply with the New Zealand Health Information Privacy Code 2020 ("HIP Code") when collecting your health information.

We will collect personal data directly from you unless (i) you have authorised the collection of personal data from a third party, (ii) it would not prejudice you for collection to occur through a third party, (iii) collection from you would prejudice the purpose of collection, or (iv) it is not reasonably practicable to collect from you and the information will not be used in a form whereby you are identifiable.

Where the New Zealand Health Information Privacy Code 2020 applies, health information is collected only for a lawful purpose connected with the relevant health agency’s functions and only where collection is necessary for that purpose. Required collection notices must be provided when information is collected from the individual and, for health information collected indirectly on or after 1 May 2026, Rule 3A requires reasonable notification to the individual or their representative unless an exception applies.

We process New Zealand health information in accordance with the customer’s instructions and support applicable requirements concerning security, access, correction, retention, use, disclosure and overseas transfers.

For the purposes of section 7 (International Transfers) of this Privacy Policy, we may transfer your personal data to overseas recipients (i.e. outside New Zealand) located in the countries as set out under the list of Physitrack's Third Party Vendors (sub-processors) which can be found at https://www.physitrack.com/legal/data-processing-agreement.

15. Glossary

Affiliates - means Physitrack PLC together with its direct and indirect subsidiary and parent companies from time to time (i.e. Physitrack's own corporate group). This is distinct from "Affiliate Partners", defined below.

Affiliate Partners - means external, third-party individuals or businesses with whom we have a commercial, referral, reseller or commission-based arrangement — for example, an individual or company who refers customers to us using a discount or referral code in exchange for commission. Affiliate Partners are not part of the Physitrack group and act as an independent controller of any personal data we share with them for the purposes of that arrangement.

AI-assisted EMR feature - an optional EMR function that uses speech-to-text, artificial-intelligence, machine-learning, or other automated technologies to support a workflow such as transcription, documentation drafting, summarisation, intake read-back, search, organisation of information, auto-population, or other customer-enabled assistance. These features process EMR Data only for the customer-directed purpose described in this Policy and are subject to the applicable customer agreement, DPA or BAA, subprocessor controls, and security requirements. AI-assisted outputs are provisional and require review, correction, and approval by an authorised clinician before they are relied upon for patient care or incorporated into a clinical record.

Authorised User - a person permitted by a Healthcare Customer to access the relevant account, EMR or patient information according to the permissions assigned by that customer.

Beta Environment - any beta, pilot, preview, pre-release, sandbox, demonstration, evaluation, testing, or similar non-production feature, environment, or version of the Services made available by Physitrack for testing, configuration, demonstration, validation, feedback, or evaluation and not expressly approved in writing by Physitrack for production clinical use.

Comply with a legal obligation - means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

Consumer Health Data - health-related personal data or personal information regulated by a U.S. state consumer health data law where that law applies, including information that may fall outside HIPAA or another healthcare-specific privacy regime.

De-identified / Anonymous Data - information processed so that it is no longer personal data or identifiable health information under the applicable legal standard. Pseudonymized data remains personal data where re-identification remains reasonably plausible.

EMR or Electronic Medical Record - the clinical-record and related patient-management functionality made available through the Services, including any connected workflow or integration identified as part of the EMR offering.

EMR Data - personal data, health information, PHI, personal health information, Special Category Personal Data, sensitive information, consumer health data where applicable, clinical information, and related metadata that a Healthcare Customer, authorised user, patient, authorised representative, or connected system enters, uploads, generates, imports, accesses, stores, transmits, exports, or otherwise processes through the EMR or a connected clinical workflow, including consultation audio, transcripts, AI-assisted draft documentation, patient-specific AI requests and responses, retained clinical context, intake information, audit records, interoperability records, and record-transfer information where those features are enabled.

Healthcare Customer - a Health Practitioner, clinic, health system, hospital, organisation, public body, health information custodian, trustee, health agency, responsible person, covered entity, business associate, or other customer that uses the Services to process patient or clinical information. Depending on applicable law and the relationship, a Healthcare Customer may act as a controller, covered entity, health information custodian, trustee, health agency, responsible person, organisation, service provider, information manager, or processor.

Health Data - personal data or information relating to an individual’s physical or mental health, healthcare, treatment, condition, diagnosis, disability, clinical measurements or provision of health services, including information treated as health data, health information or PHI under applicable law.

Legitimate Interest - means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract - means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Personal Health Information - individually identifiable health information, personal health information, or similar protected health information regulated under Canadian federal, provincial, or territorial privacy or health-information law, or under another applicable jurisdiction’s health-information law.

Production Data - real operational data used or intended for live business, clinical, legal-record, billing, reporting, or other production workflows, including live clinical data and information relating to an actual patient or other identifiable person.

Third Party - means any natural person or legal entity which is not part of the Physitrack group, but which Physitrack has a contractual engagement with for the purposes of receiving services.

Please note that if you are reading a translated version of this policy, the text of the English version of this policy prevails.