RehabPath Privacy Policy

• No RehabPath account is required.
• RehabPath does not collect your name, email address, or personal identifiers for account purposes.
• RehabPath does not use analytics, advertising SDKs, tracking SDKs, or third-party usage telemetry.
• Your app data is stored locally on your device by default.
• Optional encrypted backup files are created only when you choose to export them.
• Optional clinician pack PDFs are created on your device and shared only through the destination you choose.
• Optional AI features may send client-redacted, user-reviewed content to RehabPath's AI gateway and OpenAI to import a plan from a PDF or generate a clinician summary.
• If you uninstall the app, local in-app data is removed by the operating system, but exported backup files and PDFs remain wherever you saved or shared them until you delete them.

RehabPath may store the following information locally on your device:

• Your selected rehabilitation program or custom plan.
• Program progress, exercise completion, skipped exercises, confidence entries, milestones, and activity logs.
• Symptom and recovery logs, such as pain, stiffness, DOMS, mood, motivation, notes, and related tracking values you choose to enter.
• Custom plan details you enter or import, such as plan title, phases, exercises, milestones, clinician/service name, and plan notes.
• Local reminder preferences, including reminder time and backup reminder settings.
• Privacy/disclaimer acceptance state.
• Backup metadata, such as the last backup time and backup file name.

This data is stored in local app storage and local SQLite storage on your device. RehabPath does not operate a cloud account, cloud sync service, or server database for your rehabilitation records.

RehabPath includes optional AI-assisted features. These features are not required to use the app.

Custom plan PDF import

If you choose to import a rehabilitation plan from a PDF:

• The app reads selectable PDF text on your device.
• Scanned or photographed plans are not supported by this feature.
• The app redacts high-confidence personal details on your device before any network request, including detected email addresses, phone numbers, NHS numbers, labelled dates of birth, and UK postcodes.
• Names are not reliably detected automatically, so the app shows you the exact redacted text before it is sent and asks you to remove anything personal that remains.
• Only the reviewed text is sent to RehabPath's AI gateway so it can be structured into a custom plan.
• The imported plan is shown to you for review and editing before you save it.

AI clinician summary

If you choose to generate an AI summary for a clinician pack:

• The app sends only structured metrics from the sections you selected, such as activity counts, symptom scores, and milestone status.
• Your written notes are not sent to the AI summary feature. If you include notes in the clinician pack, they are included in the exported PDF exactly as app data, not as AI input.
• Custom milestone text is redacted on-device before it is included in the AI summary request.
• The AI-generated summary is shown to you for review and editing before it is included in the clinician pack.
• The clinician pack is exported as a PDF through your device's sharing options. RehabPath does not automatically send it to a clinician or upload it to a portal.

AI gateway, Firebase, and OpenAI

The optional AI features use a Firebase callable function operated for RehabPath as a stateless gateway to OpenAI.

When you use an AI feature:

• Firebase anonymous authentication may create a random per-install identifier. This is used to control abuse and usage limits, not to create a RehabPath account.
• RehabPath's server stores only usage/rate-limit counters for that identifier, such as daily request counts. It does not store your PDF text, rehabilitation logs, AI prompts, imported plan payloads, or generated summaries.
• The gateway may log metadata such as request mode, platform, app version, status, latency, and token counts. It is designed not to log request or response content.
• The reviewed/redacted content needed for the AI task is sent to OpenAI to generate the requested output.
• OpenAI's own terms, privacy, security, and data-handling policies apply to information processed by OpenAI.

Do not use the AI features for emergency, urgent, highly sensitive, or unreviewed personal information.

RehabPath lets you create an optional encrypted backup file with the .rehabpath-backup extension.

When you create a backup:

• The backup is encrypted on your device before export.
• You choose where to save or share the backup file, such as Files, Drive, Downloads, or another destination available on your device.
• RehabPath does not receive the backup file.
• RehabPath does not know or store your backup passphrase.

If you lose your passphrase, the backup cannot be restored. RehabPath cannot recover a lost passphrase or decrypt a backup for you.

If you save a backup file to a third-party storage provider, that provider's own terms and privacy practices apply to the storage location you choose. The backup file itself remains encrypted by RehabPath.

RehabPath lets you create an optional clinician progress pack PDF from data stored in the app.

When you export a clinician pack:

• The PDF is generated on your device.
• You choose whether to include sections such as activity summary, symptom trends, milestones, recent notes, AI summary, and activity log.
• You choose where to save or share the PDF through your device's available sharing options.
• RehabPath does not receive the PDF.

If you save or share the PDF with another app, storage provider, or person, their own terms and privacy practices apply.

RehabPath may ask for permission to send local notifications, such as daily reminders or backup reminders.

These reminders are scheduled on your device. RehabPath does not use a remote push notification server to send reminder content.

You can disable reminders in the app settings or through your device settings.

RehabPath may use Expo EAS Update to check for and download app updates. These update checks may contact Expo's update service and may include technical information needed to deliver a compatible update, such as app version, runtime version, platform, update channel, and standard network information such as IP address.

RehabPath does not include your rehabilitation logs, symptoms, notes, backup contents, PDF contents, clinician pack contents, or other local health-related app data in update requests.

RehabPath does not:

• Create RehabPath user accounts.
• Provide cloud sync.
• Provide server-side backup recovery.
• Store your rehabilitation records in a RehabPath cloud database.
• Use analytics or advertising trackers.
• Sell personal information.
• Use your data for advertising.
• Automatically share rehabilitation logs with clinicians or other third parties.
• Send app data to AI services unless you choose to use an optional AI feature and approve the reviewed content or output required for that feature.

Apple, Google, and your device operating system may collect crash reports, diagnostics, purchase history, download history, or other app-store/device information under their own policies and settings. RehabPath does not control those systems and does not receive your local rehabilitation data from them.

If you use optional AI features, Firebase and OpenAI process the information needed to provide those features as described above and under their own applicable terms and privacy practices.

If you save or share backups or PDFs through third-party storage, messaging, email, or sharing services, those services process the files according to their own terms and privacy practices.

You can delete local RehabPath data by using the reset option in the app settings or by uninstalling the app.

Deleting the app removes local in-app data from that device, subject to normal operating system behavior. It does not delete encrypted backup files, exported clinician pack PDFs, or other files you saved outside the app. To remove exported files, delete them from the locations where you saved or shared them.

AI usage counters held by RehabPath's server are not rehabilitation records and are retained only for operational abuse-control and rate-limit purposes.

RehabPath is a non-clinical wellness and rehabilitation tracking tool. It is not a medical device and does not provide diagnosis, treatment, medical advice, clinical decision support, or emergency support.

AI-assisted import and summary features may help structure or summarise information you provide, but they can be incomplete or wrong. You must review and edit AI-assisted outputs before relying on them or sharing them.

You should consult a licensed healthcare professional before starting, changing, or stopping any rehabilitation activity. Stop using an exercise or activity and seek appropriate medical advice if symptoms worsen or you experience concerning symptoms.

RehabPath is not intended for use by children under 13. If you believe a child has used the app in a way that requires attention, delete the local app data from the device and contact us if needed.

We may update this Privacy Policy as the app changes. If the app's data handling changes materially, the policy should be updated before the changed version is released.

For privacy questions, contact: repinfaust@arcturusdc.com

Privacy Policy · Terms of Use · Delete app data