Privacy Notice

What we collect. We collect account details, information about your rehabilitation, movement videos you record, the measurements taken from those videos, and technical information about the app.

Why we use it. To run your account, produce and adapt your rehabilitation plan, show your progress, support you and keep the Services secure.

Movement videos. We use raw video to take the measurements the assessment needs, then delete the raw video. We keep the measurements.

Training our models. We use your health and rehabilitation information to train and improve our models only if you give separate, explicit consent, and you can withdraw it at any time in Settings without losing any part of the Services.

Selling. We do not sell your personal information, and we do not use it for advertising.

2.1 Rehyn Ltd, company number 17417716, registered in the United Kingdom, is the controller of the personal information described in this notice. We are registered with the Information Commissioner’s Office under registration number [ICO registration number].

2.2 For any privacy question, or to exercise your rights, contact info@rehyn.com.

Information you give us

Account information: name, email address, login credentials and account settings.

Rehabilitation profile: information you choose to give about your stroke or condition, the date of your stroke, affected side, mobility, rehabilitation goals, current capability, and any notes you add. This is information about your health.

Movement videos: videos you record or upload of yourself performing standardised assessment tasks, such as reach, grasp, hand function, gait, sit to stand, balance and turning tasks. These videos show you and are information about your health.

Assessment and activity information: answers to assessment questions, reported symptoms, pain or difficulty ratings, activity completion and any feedback you give on how an activity went.

Communications: messages, questions, support requests and survey responses you send us.

Information the Services generate

Derived measurements and records: measurements derived from your videos, such as joint angles, range of movement, speed, step length, symmetry, stability and other functional scores; your rehabilitation plan and how it adapts; progress trends over time; and prompts and interactions with Alira.

Technical information: app version, device model, operating system, language, time zone, IP address, crash reports, error logs, performance data and security event records.

Information from other people

If a family member, carer or clinician helps you use the Services, information may reach us through them. If you ever choose to share your progress with a clinician or service, we will tell you clearly what will be shared before it happens.

The table below is set out purpose by purpose. Where the information concerns your health, we identify both the lawful basis under Article 6 UK GDPR and the additional condition under Article 9 UK GDPR that applies to health information.

a) Creating and running your account

What we do: Register you, authenticate you, maintain your settings and provide customer support.

Lawful basis: Article 6(1)(b), performance of a contract with you (these Terms of Use).

b) Delivering your rehabilitation plan

What we do: Process your movement videos and assessment answers to produce measurements, generate and adapt your personalised plan, deliver guided activities and show your progress.

Lawful basis: Article 6(1)(b), performance of a contract with you.

Health information condition: Article 9(2)(a), your explicit consent, given when you first set up your rehabilitation profile. Without it we cannot provide a rehabilitation plan, because the plan is built from health information. [Confirm with your solicitor whether Article 9(2)(h) applies to any part of this processing once clinical partners are involved.]

c) Keeping the Services safe, secure and working

What we do: Diagnose faults, prevent and investigate misuse or fraud, maintain security, and monitor performance and stability.

Lawful basis: Article 6(1)(f), our legitimate interests in operating a secure and reliable service. We have assessed that this does not override your rights, because the information used is technical rather than clinical wherever that is possible.

d) Improving accuracy and training our models

What we do: Use rehabilitation and movement information to develop, train, test, validate and improve the accuracy of our measurement models, Alira and other features, and to build the evidence base for our technology.

Lawful basis: Article 6(1)(a), your consent.

Health information condition: Article 9(2)(a), your explicit, separate consent. [Where processing is carried out as scientific research, confirm with your solicitor whether Article 9(2)(j) and the safeguards in Schedule 1 Part 1 paragraph 4 of the Data Protection Act 2018 are the appropriate route, and update this section accordingly.]

Your control: This purpose is optional. See section 5.

e) Meeting legal and regulatory obligations

What we do: Keep records we are required to keep, respond to lawful requests, and meet obligations relating to safety, product regulation and data protection.

Lawful basis: Article 6(1)(c), legal obligation. For health information, Article 9(2)(g) or 9(2)(i) as applicable, including reasons of public interest in the area of public health and product safety.

f) Protecting people from serious harm

What we do: Act where we reasonably believe there is a risk to someone’s life or safety.

Lawful basis: Article 6(1)(d), vital interests, and Article 9(2)(c) for health information. This is exceptional. Rehyn is not monitored in real time and you must never rely on it for urgent help.

5.1 Rehyn is an early release. Part of why it exists at this stage is to improve the accuracy of the technology, and that improvement depends on real rehabilitation data. We would rather say this plainly than bury it.

5.2 We will use your rehabilitation and movement information for that purpose only if you give explicit consent. We ask for that consent separately, on its own screen, in clear terms, and it is switched off unless you switch it on. Accepting the Terms of Use is not consent for this purpose and we will not treat it as consent.

5.3 If you consent, the information used may include derived movement measurements, assessment outcomes, activity completion, plan adaptations, reported symptoms and feedback. We do not use raw movement video for this purpose after the measurements have been taken and the raw video has been deleted, unless you have given separate consent for video retention through the option described in clause 6.3.

5.4 Before information is used for this purpose we remove direct identifiers such as your name, email address and account identifiers, and replace them with a pseudonym so that the working dataset is not directly identifying. Access is restricted to the people who need it. We do not attempt to re identify anyone in that dataset.

5.5 You can withdraw consent at any time in Settings under "Help improve Rehyn", or by emailing info@rehyn.com. Withdrawal is as easy as giving consent. It takes effect from the moment you make it and stops further use of your information for this purpose. It does not make earlier use unlawful, and it does not affect processing under the other purposes in section 4.

5.6 Where a model has already been trained, withdrawing consent stops your information being used in future training and removes it from our training datasets. It may not be possible to remove the influence of information already incorporated into a model that has been trained and released. We say this plainly because it affects your decision.

5.7 Your access to the Services does not depend on your answer. Every feature, and your full rehabilitation plan, remain available to you either way.

5.8 If we ever want to use your information for a materially different purpose, such as sharing a dataset with a research partner or a commercial third party, we will ask you again first.

6.1 Movement videos are the most sensitive information the Services handle, so we treat them separately. A video is uploaded over an encrypted connection, processed to extract the measurements the assessment requires, and the raw video is then deleted.

6.2 Raw video is deleted within [insert number] days of the measurements being taken, and sooner where processing completes earlier. [Confirm the operational retention period before publication and keep this figure accurate.]

6.3 If we offer you the option to keep a video for longer, for example so you can compare your movement over time, or so it can be used to improve our models, we will ask for that separately and explain exactly what it means. It is optional and you can change your mind.

6.4 Record only yourself. If another person appears in a video, you must have their knowledge and agreement.

We do not sell your personal information and we do not share it for advertising. We share it only in these situations:

Rehyn personnel who need access to operate, support or secure the Services, under confidentiality obligations and access controls.

Service providers who process information on our behalf under a written contract that meets Article 28 UK GDPR, for example cloud hosting, storage, error reporting and communications. A current list is available on request from info@rehyn.com. [Maintain that list and keep the contracts in place before launch.]

Professional advisers such as lawyers, accountants, auditors and insurers, where they need it and under a duty of confidence.

Regulators, law enforcement, courts or other authorities where we are required or permitted by law to disclose, including reporting obligations relating to safety.

A buyer or successor, in connection with a reorganisation, investment, merger or sale of our business or assets, subject to appropriate protections and to this notice continuing to apply.

Anyone else, where you ask us to or agree to it, such as a clinician you choose to share your progress with.

8.1 Your information is stored and processed in the United Kingdom [and the European Economic Area, if applicable. Confirm and keep accurate].

8.2 If we ever transfer personal information outside the United Kingdom, we will only do so where the law allows and with appropriate safeguards in place, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum, together with a transfer risk assessment. You can ask us for details.

8.3 Where the Services are made available in another country, we will comply with the data protection law of that country and update this notice accordingly.

Account information: for as long as your account is open, and for [insert period, for example 12 months] after you close it, unless we must keep it longer.

Raw movement videos: deleted after measurements are taken, within [insert number] days, unless you have chosen retention under clause 6.3.

Derived measurements, assessments and plans: kept while your account is open so your rehabilitation record stays intact, and for [insert period] afterwards.

Technical and security logs: kept for [insert period] for security and diagnostic purposes.

Consent records: kept for as long as the record of consent must be evidenced, and for [insert period] afterwards, so we can show what you agreed to and when.

Training datasets: information already incorporated into a pseudonymised training dataset is retained under that pseudonym, and is removed from future training when you withdraw consent, as described in clause 5.6.

When a retention period ends we delete the information or irreversibly anonymise it so that it is no longer personal information. [Set each period before publication and record the reasoning.]

Under UK data protection law you have the right to:

ask for a copy of the personal information we hold about you;

ask us to correct information that is inaccurate or incomplete;

ask us to delete your information, in the circumstances where that right applies;

ask us to restrict how we use your information;

object to processing based on our legitimate interests;

ask for a portable copy of information you gave us, in a machine readable format; and

withdraw consent at any time, where we rely on consent, without affecting the lawfulness of use before you withdrew it.

10.1 To exercise any right, email info@rehyn.com. We will respond within one month, and will tell you if we need longer because the request is complex. We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.

10.2 If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.

11.1 We use technical and organisational measures designed to protect your information, including encryption in transit and at rest, access controls and role based permissions, separation of identifying information from working datasets, logging and monitoring, and staff confidentiality obligations. [Keep this description accurate as the technical setup develops. Do not claim a control that is not in place.]

11.2 No online service can be completely secure. Please protect your device and your login details and tell us at info@rehyn.com if you think your account has been accessed without permission.

11.3 If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.

12.1 The Services are for people aged 18 or over. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it. If you believe a person under 18 has given us information, contact info@rehyn.com.

13.1 We may update this notice as the Services develop or the law changes. The effective date at the top shows the current version, and we keep previous versions available on request.

13.2 Where a change is significant, we will tell you through the app, by email or by another appropriate method before it takes effect. If a change means we want to use your information for a new purpose that relies on consent, we will ask you again rather than assume.