Procaryote · Physia ecosystem
Privacy Policy
Plain-language summary. Rehab Timer is a professional tool for timing functional tests. Your email and account information are stored securely to give you access to your data. Patients and test results you choose to save are stored in the cloud, linked to your Physia account, and accessible only by you (and by the patient, if you invite them to Flow). A test you do not save never leaves your device. We use Firebase Analytics to understand how features are used, which helps us improve the app.
Data Controller
Rehab Timer is developed and operated by Procaryote SAS, a company registered in France. Procaryote acts as the data controller for all personal data processed through this application within the meaning of the EU General Data Protection Regulation (GDPR) and applicable French data-protection law.
Contact: privacy@procaryote.com
Data We Collect
The table below lists every category of data the application touches, where it is processed, and the legal basis under GDPR.
| Category | What | Where processed | GDPR basis |
|---|---|---|---|
| Account | Email address, display name, sign-in provider (Google / Apple / email link) | Firebase Auth | Contract performance |
| Patient records | Patient label (name or pseudonym), optional email and photo, and the test results you choose to save (times, distances, speeds, stand counts, optional age, sex, height and weight used for reference values) | Physia API (EU) | Contract performance |
| Usage analytics | Feature-use events: login method, which test was opened, started, completed or saved, PDF exports, tab switches, patient add/select. No patient names or clinical values are sent. | Firebase Analytics (GA4) | Legitimate interest |
| Unsaved test runs | Timer readings and counts of a test you run without saving it | On-device only | N/A — not stored or transmitted |
| Photos | A patient photo you choose to add to their record | Firebase Storage | Contract performance |
| Preferences | Language setting, secure token for session persistence | On-device only | N/A — stored locally |
We do not collect health data, biometric identifiers, payment information, precise location, or any data beyond what is listed above.
How We Use Your Data
- Account data is used solely to authenticate you and associate your patient records with your account.
- Patient records are used to display your history and let you compare measurements over time. They are accessible only to you.
- Analytics events are aggregated and used to understand which features are used, detect crashes, and prioritise improvements. We do not build individual profiles or use this data for advertising.
Third-Party Services
Rehab Timer is built on Google Firebase (Firebase Authentication, Cloud Firestore, Firebase Analytics, Firebase Hosting), a platform operated by Google LLC. Firebase services process data on Google's infrastructure, which is governed by Google's privacy policy and the Google Cloud Data Processing Addendum.
When you sign in with Google or Apple, their respective OAuth services authenticate you. We receive only the profile information those providers grant (email and display name); we do not receive passwords.
We do not sell, rent, or share your personal data with any other third party.
Data Storage & Retention
Firebase data is stored in Google Cloud infrastructure in the European Union (region europe-west1). Analytics data may be processed by Google on servers outside the EU; this transfer is governed by the EU Standard Contractual Clauses as part of Google's Data Processing Terms.
We retain your account and patient data for as long as your account is active. When you delete your account, all associated data is permanently erased within 30 days. Analytics data is retained for 14 months in line with Firebase Analytics defaults, then deleted automatically.
Your Rights (GDPR)
As a data subject under the GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten") — you may delete your account from the app's profile screen at any time.
- Port your data in a structured, machine-readable format.
- Restrict processing or object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdrawal is effective immediately and does not affect prior processing.
- Lodge a complaint with the French data-protection authority, the CNIL, if you believe your rights have been infringed.
Children's Privacy
Rehab Timer is a clinical tool intended for use by healthcare professionals. It is not directed at children under 16 and we do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this policy to reflect changes to our data practices or applicable law. We will notify registered users of material changes by email at least 14 days before they take effect. The "Effective" date at the top of this page always reflects the version currently in force.
Contact
For any privacy-related question, data access request, or deletion request, please contact us at:
Data Controller
Procaryote SAS
Email: privacy@procaryote.com
We aim to respond to all requests within 30 days in accordance with GDPR Article 12.