Privacy notice

1. Data controller

The controller of the data collected through this platform is [PLATFORM OWNER], with tax ID [NIF] and address at [ADDRESS]. You can contact us at admin@r3physio.app.

When you use this platform as a patient of a clinic, that clinic acts as the controller of your health data and r3Physio.app acts as the data processor, in accordance with Article 28 of the GDPR.

2. Data we process and purpose

• Contact data (name, email, phone): appointment management, communications about your treatment and access to the patient portal.
• Health data (reason for visit, pre-anamnesis notes collected by the virtual assistant, exercise plans and pain logs): provision of the physiotherapy service and monitoring of your progress.
• Data from clinic staff accounts (email, role): access to the management panel.
• Access logs we keep a log of staff access to patient records for security and auditing purposes (art. 32 GDPR).

3. Legal basis

• Performance of the care relationship (art. 6.1.b GDPR) for appointment management and treatment follow-up.
• Explicit consent (art. 6.1.a and 9.2.a GDPR) for the processing of health data collected through the booking website, the virtual assistant or Telegram. You may withdraw your consent at any time.
• Legitimate interest (art. 6.1.f GDPR) for the security of the service and access logging.

4. Data retention

Health data is retained for the period required by the health regulations applicable in the country where the clinic operates (for example, the minimum medical-record retention period under local law). Billing data is retained for the statutory tax periods. Access logs are retained for 24 months.

5. Processors and recipients

• Mistral AI (France, EU): the AI model that processes the virtual assistant's messages and generates its responses, under a valid data processing agreement (DPA). Assistant messages are processed entirely within the European Union.
• Zoho Mail (Zoho Corporation): sending of the service's transactional emails (confirmations, notifications and operational communications).
• Dodo Payments (merchant of record; verifiable at dodopayments.com/legal): management of clinic subscription payments. We never process patients' banking data.
• Telegram (only if you contact us through that channel): the conversation is also subject to Telegram's privacy policy.
• Hosting provider: Contabo GmbH (Germany), with servers located in Strasbourg, France (European Union).

Data is not disclosed to third parties for advertising purposes. Virtual assistant messages are processed entirely within the European Union; any other international transfer is covered by the appropriate safeguards.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by contacting your clinic or admin@r3physio.app, attaching a document proving your identity. If you believe the processing does not comply with the regulations, you can lodge a complaint with the data protection supervisory authority in your country (in the EU/EEA, your national data protection authority; in Spain, the AEPD, www.aepd.es).

If you gave your consent, you may withdraw it at any time (art. 7.3 GDPR) as easily as you gave it — just tell your clinic — without affecting the lawfulness of the processing carried out before the withdrawal or of processing based on another legal basis (such as the legal obligation to keep the medical record).

7. Security

We apply appropriate technical and organisational measures: encryption of communications (HTTPS), access control by user and role, logging of access to patient data and encrypted backups, which are automated and taken daily.

Backups are encrypted (AES-256-GCM) with an independent key and kept for 14 days. If a clinic enables the Telegram backup copy, the encrypted file is sent to the chat configured by that clinic.

8. Automated decision-making

The virtual assistant is an automated system: it organises appointments and records the reason for your visit as you describe it. It does not make decisions that produce legal or similarly significant effects for you (art. 22 GDPR): it does not diagnose, prescribe or decide on your treatment — those decisions are always made by your clinic's professional, who reviews the notes recorded by the assistant. At any time you can request human intervention by contacting your clinic directly.

9. Minors

r3physio.app's services are intended for people over 14 years of age and are not directed at minors. We do not knowingly collect data from anyone under 14 without the consent of a parent or legal guardian. If a minor contacts the virtual assistant, it will ask them to continue the conversation with a parent or guardian present. If we become aware of a minor's data collected without that authorisation, we will delete it. A parent or legal guardian may exercise the rights described in section 5 on the minor's behalf, after proving their representation.

10. Country detection from your IP address

To show you prices in your currency (euros within the European Union, dollars elsewhere), we locally resolve the approximate country of your IP address using a GeoIP database (DB-IP, CC BY 4.0 licence). The lookup happens on our own servers: your IP address is not sent to third parties for this purpose, is not stored and is not linked to your identity. Geolocation data: DB-IP.com.

11. AI-assisted phone reception

If your clinic activates phone reception, a virtual assistant powered by artificial intelligence answers incoming calls: it shares availability and manages appointments in the clinic's schedule. The voice and content of the call are processed to provide that service.

At the start of every call the assistant announces that the conversation is handled and recorded, and asks for verbal confirmation to continue; if you do not consent, the call ends. Only the text transcript of the call is retained (never the audio — an explicit design decision of the service), together with the phone number and the date and time.

• Processor: r3physio.app processes the data on behalf of the clinic (art. 28 GDPR), which is the controller and the party you should contact to exercise your rights.
• Voice providers: the voice orchestration platform (Vapi) and the telephony carrier of the virtual number (Twilio) process the call and its data. The voice infrastructure runs outside the European Union (United States) under standard contractual clauses and equivalent safeguards; transcription, language and text-to-speech services are consumed through Vapi under the same coverage.
• Access: the clinic's team accesses the transcripts through its dashboard and every access is logged (access audit).

Transcripts are kept for the same period as the virtual assistant's conversations (by default, 12 months from logging, a window the clinic can configure), after which they are deleted automatically.

You can exercise your rights of access, rectification and erasure over your data from these calls by contacting your clinic, which handles the request with r3physio.app as processor.