Privacy policy

Who we are

PhysioDanali is the online service of DANALIS GENEIADI EE, VAT number EL802378215, Agiou Nektariou 58, 165 62 Glyfada, Athens, Greece. The company is the data controller: it is responsible for your personal data under the EU General Data Protection Regulation (GDPR). The physiotherapist responsible for the programs is Konstantinos Danalis.

For any question about your data, write to info@physiodanali.com.

The short version

• We collect only what the service needs: your e-mail, the health answers you give, and how your exercises went.
• Your data is stored on servers in Greece. Your messages and any text you type in the assessment are stored encrypted.
• We do not sell your data, and we never use your health information for advertising.
• You can download or delete your data yourself at any time from your Account page.
• Public pages can be read without an account and without cookies. Statistics cookies are used only if you accept them.

What we collect and why

Account: your e-mail address, your password in protected (hashed) form or your Google sign-in identifier, your first name if you give it, your language, and the record of your consent. We use this to create and secure your account and to send you service e-mails.

Health information: your answers to the assessment (for example the type and date of your operation, your age and sex, and the safety questions), the pain and effort you report after each exercise, your exercise sessions, any knee-bend measurements you enter, and what you write to the physiotherapist. This is health data. We use it only to build and adjust your exercise program, to show you your progress, and to answer you.

Online appointments: the time you booked, whether it was paid, and the video call itself while it takes place. We do not record calls.

Payments: when you pay for an online appointment, the payment is handled by Stripe. We receive the amount, the status and a payment reference. We never see or store your card number.

Technical and security data: the date and time of sign-ins, internet address and browser type in security logs, and limits that protect against misuse.

If you arrive from a link with a campaign tag (for example from an advertisement) and you have accepted statistics cookies, we note which campaign brought you. We may then report back to the advertising service that the visit led to a sign-up or a booking: only the click reference of the advertisement, the amount and the time, never your name, your e-mail or anything about your health.

Our legal grounds

• Your explicit consent, which you give when you create your account, for processing your health information (GDPR Article 9(2)(a)). You can withdraw it at any time by deleting your account or writing to us; we then stop and delete your health information.
• Providing the service you asked for (Article 6(1)(b)): your account, your program, messages and appointments.
• Legal obligations (Article 6(1)(c)): accounting and tax records of payments.
• Our legitimate interest in keeping the service secure (Article 6(1)(f)): security logs and protection against automated abuse.
• Your consent for statistics cookies (Article 6(1)(a)).

How the program uses your answers

The program adjusts your exercises automatically from the pain and effort you report, following rules written by the physiotherapist. It can tell you to rest, to ease an exercise, or to stop and contact your clinician. This is guidance for your rehabilitation, not a diagnosis, and it has no legal effect on you. You can always ask the physiotherapist a question through the service.

Who can see your data

Your health information and messages can be read by the physiotherapists of PhysioDanali who answer you, and by the administrator of the service, who signs in with two-step verification.

We use these companies to run the service. They process data only for the purpose described:

• Web hosting and e-mail delivery: our hosting provider in Greece. The database with your account and your health information is stored there.
• Stripe (card payments for online appointments).
• Google: optional sign-in with your Google account; the physiotherapist's calendar entry for an appointment; Google Analytics on public pages, only if you accept statistics cookies; our Google Ads account then also receives a signal that a public page was viewed, without advertising cookies.
• Cloudflare Turnstile (a check on the sign-in and sign-up forms that blocks automated abuse).
• Jitsi Meet by 8x8 (the video call of an online appointment).
• YouTube, in privacy-enhanced mode, only when you choose to open an exercise video.
• ntfy (a notification that tells the physiotherapist a new message or booking has arrived; it contains no name, no health detail and no message text).

Transfers outside the European Economic Area

Your account and health information are stored in Greece. Stripe, Google, Cloudflare and 8x8 may process limited data outside the EEA (for example in the United States). They do so under the safeguards EU law provides for such transfers, such as an adequacy decision of the European Commission or its standard contractual clauses.

Cookies and storage on your device

• Necessary: one session cookie that keeps you signed in. Without it the service cannot work.
• Preferences stored in your browser: your language, text size and contrast choice, the program you selected, and your cookie choice. These stay on your device.
• Statistics (only if you accept): Google Analytics cookies on the public pages, to count visits. Our Google Ads account then also receives a signal that a page was viewed; no advertising cookies are set and ad personalisation is off. They are never loaded on the pages you use after signing in. You can change your choice at any time with the "Cookie settings" link at the bottom of every page.

How long we keep your data

• Account and health information: until you delete your account or ask us to delete it.
• Payment records: for as long as tax and accounting law requires. After you delete your account they are kept without your health information.
• Security logs: for a limited time, for security and fault-finding. They do not contain your health answers.

Using PhysioDanali through an AI assistant

PhysioDanali can also be used from inside some AI assistants. In that case the answers you give the assistant are sent to our server only to calculate your session. We do not store them and we do not create an account. Your progress is kept in an encrypted code that stays with you, in your conversation. The AI assistant keeps its own copy of your conversation under its own privacy terms, which we do not control.

The assistant may ask whether you want to send us anonymous feedback. Nothing is sent unless you agree. If you agree, we store only this: a score from 1 to 5, the items you choose from a fixed list of difficulties with the service (for example "instructions unclear" or "technical problem"), the program, the language, which assistant you used, and the date. We do not store your name, your e-mail or your internet address with it, and we do not store your health answers, your pain scores or any text you write. Because nothing in it identifies you, we cannot look up or delete a single feedback entry afterwards. We use it only to improve the service. Nobody reads it as a message to the physiotherapist, so please do not use it for questions or symptoms.

Your rights

You have the right to see your data, to correct it, to delete it, to restrict or object to its use, to receive it in a portable form, and to withdraw your consent. Most of this you can do yourself on your Account page: "Download my data" gives you a copy, and "Delete my account" erases your account and your health information.

For anything else write to info@physiodanali.com. We answer within one month.

If you believe we have handled your data wrongly, you can complain to the Hellenic Data Protection Authority (www.dpa.gr) or to the data protection authority of the country where you live.

Security

The whole site uses an encrypted connection. Your messages and any text you type in the assessment are also encrypted inside the database. Your other answers and your pain and effort scores are stored in the database without this extra layer, and only the people named above can read them. Passwords are stored only in hashed form. Access to patient data is limited to the people named above.

Children

The service is for adults. It is not intended for anyone under 18.

Changes to this policy

If we change how we use your data, we will update this page and change the date at the top. If the change is important, we will also tell you by e-mail or in the service.