Privacy & cookies

Who controls your data

Petros Petrou, an individual operator based in the United Kingdom, is the data controller for personal information processed through PhysioGlobe. Contact: petrosp1999@hotmail.com.

This notice explains what PhysioGlobe processes. Apple, Google, RevenueCat, Firebase, Resend, and websites you choose to visit may also act as independent controllers or processors under their own privacy notices.

What we collect

Account and profile data: your Firebase user identifier, email address, optional display name, account creation information, and your acceptance of the current Terms of Use. Authentication is handled by Google Firebase Authentication. We do not receive your password in readable form.

Learning and progress data: quiz answers, spaced-repetition and review schedules, practice sessions, streaks, experience points, CPD activity and time records, saved exercise handouts and the labels you give them. My Clinic also stores your earned and spent keys, collected equipment and copy counts, featured item and opening identifiers/results so rewards sync and retries do not spend keys twice. A pending opening identifier is stored locally until its result is recovered.

Preferences and device data: daily-reminder settings, resource-email preference, authentication session data, and local app data needed to remember progress and cached research results. If you enable daily reminders, the app receives your operating system’s notification-permission status. Reminders are scheduled on your device; PhysioGlobe does not collect a push-notification token.

Subscription data: your Firebase user identifier is used as your RevenueCat customer identifier while signed in. RevenueCat, Apple, or Google process product identifiers, entitlement status, subscription dates, trial or offer information, transaction and store purchase metadata. PhysioGlobe does not receive or store your full payment-card details.

Email data: your email address, optional display name, and free or Pro plan status may be used to send welcome or membership emails. If you enable resource emails, the selected resource details are also used to send those messages.

Technical data: our service providers may process routine device, network, request, diagnostic, and security information when their services are used. We do not currently use an advertising, behavioural analytics, or third-party crash-reporting SDK in the app.

Mobile usage analytics: when you complete a sign-up, quiz, CPD export, or Pro purchase, the app may send an authenticated event request to our server. The server transiently validates your authentication, then records only a count for that event and UTC calendar date. The retained daily aggregates contain no account or device identifiers, learning content, or purchase transaction information. We do not use a third-party analytics SDK.

PhysioGlobe is not designed to collect patient records. Do not enter patient-identifiable, health, or other confidential patient information into handout labels or elsewhere in the app.

How and why we use it

Contract: to create and secure your account, provide requested features, sync progress, schedule spaced repetition, build CPD records, save handouts, manage Pro access, restore purchases, and provide service communications.

Consent: to send optional resource emails and to schedule daily reminders after you choose to enable them. You can withdraw consent in your preferences or device settings without affecting earlier processing.

Legitimate interests: to operate, secure, troubleshoot, and improve the service; prevent misuse; keep evidence of accepted terms; and understand feature use through non-identifying aggregate counts. For mobile usage analytics, authenticated event requests are validated transiently by the server and reduced to event counts by UTC date only; account identifiers, content, and purchase transaction information are not retained in these analytics aggregates. We balance these interests against your rights and do not use this basis where your rights override our interests.

Legal obligations: to comply with tax, accounting, consumer, data-protection, law-enforcement, and other legal requirements that apply to us.

We use anonymous aggregate exercise statistics, such as counts of how often an exercise is included for a condition. These counts do not identify an account. We do not sell personal data, serve targeted advertising, or use personal data for automated decisions that produce legal or similarly significant effects.

Service providers and international transfers

Google Firebase (authentication and cloud database): processes account, profile, learning, progress, preference, CPD, and handout data so accounts can work and sync across devices.

RevenueCat (subscription management): processes your customer identifier, store transaction metadata, subscription status, and entitlements so Pro access can be purchased, verified, and restored.

Apple App Store or Google Play (store billing): processes purchase, payment, trial, cancellation, and refund information under the store provider’s own terms and privacy notice.

Resend (email delivery): processes your email address, optional display name, plan status, and message content to deliver welcome, membership, and opted-in resource emails.

US National Library of Medicine / PubMed (research results): receives app-generated condition search terms. PhysioGlobe does not intentionally add your account identity to those requests. Opening an article takes you to an external website governed by its own privacy notice.

These providers may process data outside the United Kingdom. Where UK data-protection law requires it, transfers are protected using an adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard used by the relevant provider. You may contact us for more information about applicable safeguards.

Cookies and similar technologies

The native mobile app does not use browser cookies. It uses local device storage for authentication persistence, app preferences, quiz and resource state, and cached research data.

When PhysioGlobe is used through a web browser, Firebase and the app may use essential browser storage or similar technologies to keep you signed in and provide requested features. We do not currently use advertising or cross-site tracking cookies.

Retention and account deletion

We keep account and learning data while your account is active and for only as long afterwards as reasonably necessary for the purposes described above, to resolve disputes, maintain security, and meet legal obligations. Non-identifying aggregate exercise counts and daily mobile event counts may be retained because they contain no account identifiers and are not linked back to your account.

You can delete your account from the Profile section. The app deletes your PhysioGlobe profile, CPD logs, handouts, spaced-repetition records, and Firebase Authentication account. Data may remain temporarily in provider backups until overwritten under their normal retention cycle.

Deleting your PhysioGlobe account does not automatically cancel an Apple or Google subscription and may not delete transaction or subscription records held independently by Apple, Google, or RevenueCat. Cancel the subscription in your store settings and contact us if you also want us to request deletion of personal data we control through a provider, subject to legal retention requirements.

Optional resource-email data is used while the preference is enabled. You can disable those emails in the app. Locally stored data may remain on a device until you sign out, clear app data, or uninstall the app.

Security

We use reasonable technical and organisational measures intended to protect personal data, including authenticated access and database security rules that restrict users to their own account data. No internet or storage system is completely secure, so we cannot guarantee absolute security.

You are responsible for using a strong, unique password and protecting access to your email account and devices.

Your UK data-protection rights

Depending on the circumstances, you may have rights to be informed; access your personal data; correct inaccurate data; request deletion; restrict processing; object to processing based on legitimate interests; receive certain data in a portable format; and withdraw consent at any time.

These rights are not absolute and legal exemptions may apply. To make a request, email petrosp1999@hotmail.com. We may need to verify your identity and will normally respond within one month.

You may complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the ICO.

Children

PhysioGlobe is not intended for children under 15, and we do not knowingly allow them to create accounts. If you believe a child under 15 has provided personal data, contact us so we can investigate and delete it where appropriate.

Changes and contact

We may update this notice when the app, our providers, or legal requirements change. We will update the date above and provide appropriate notice of material changes.

For privacy questions or requests, contact the data controller: Petros Petrou, United Kingdom, at petrosp1999@hotmail.com.