Privacy Policy
Last updated: draft, 27 October 2026
1. Who we are
The Exercise Database is run by [company name — to be added] Ltd, a company registered in Scotland, number [company number — to be added], at [registered office address — to be added]. We are registered with the Information Commissioner's Office, number [ico registration number — to be added].
The Exercise Database is a service that physiotherapists, coaches, trainers and other practitioners use to build exercise programmes for the people they work with, record sessions, and give those people a link to their own programme. In this policy we call everyone with an account a clinician, whatever their profession, and the people they work with patients.
Contact us about anything in this policy at [data protection contact email — to be added].
2. Two roles, depending on whose data it is
| Whose data | Our role | What that means |
|---|---|---|
| Clinicians: account holders | Controller | We decide how and why it is used. This policy is our full explanation |
| Patients: the people clinicians work with | Processor | The clinician decides. We store and process it only on their instructions. Your clinician is responsible for it. See section 3 |
| Website visitors | Controller | Section 6 |
3. If you are a patient
Your clinician holds your record, and we store it for them. Your clinician is the controller of your data, so they are the one to ask about it, and their own privacy notice explains how they use it. You can also see a summary in your portal and in any copy of your data your clinician gives you.
What we do with your record, on your clinician's behalf:
- store it: your name, date of birth and contact details, the programmes and sessions your clinician sets you and the figures they are worked out from (such as your one-rep max or maximum heart rate), their session notes, and any measurements they record
- show it to you through your portal link, which needs no password, so keep it to yourself
- email you that link, which means your first name and email address pass through our email provider in the United States (section 7)
- record every time your clinician opens, changes, sends or deletes your record, so you can be told who has seen it
- keep it as long as the law requires, normally eight years after your last appointment, or until your 25th birthday if later (your 26th, if you were 17 at your last appointment). Then we delete it
We never use your data for anything else. It is not combined with other clinicians' patients, not used for research or benchmarking, not used to train any automated system, and not sold or shared for marketing.
To see, correct or delete your data, or to complain, contact your clinician. If you contact us instead, we will pass your request to them straight away. We cannot answer it ourselves.
4. If you have an account
What we hold
| Data | Where it comes from |
|---|---|
| Your name, email address and clinic name | You, when you sign up |
| Your password | You. We never see it: it is stored scrambled (hashed) by our authentication provider |
| Your account role and status, sign-up date and last sign-in | Created as you use the service |
| The content you create: exercises, programmes, protocols, KPIs, templates | You |
| Messages you send us | You |
| When you subscribe: billing address, card details, and your subscription and payment history | You, through our payment provider, Stripe. We never see your full card number: Stripe holds it, and we see only the card type, last four digits and expiry |
| Short technical logs, including IP addresses | Your browser, when you use the service. Kept for security, for at most a few days by our hosting provider |
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, signing you in, resetting your password | Contract: we need it to provide the service you signed up for |
| Emails about the service: password resets, confirmations, important notices | Contract |
| Keeping the service secure, and preventing abuse | Legitimate interests: protecting you, your patients and the service |
| Answering your messages | Legitimate interests, or contract if it is about your account |
| Taking your subscription payments | Contract |
| Keeping invoices and payment records for tax | Legal obligation: HMRC requires them |
We do not send marketing emails. If that changes, we will only do so with your consent.
What you must give us
You need to give us your name, email address and a password to open an account, and your billing details if you subscribe. Without them we cannot provide the service. Everything else is optional.
How long we keep it
| Data | Kept for |
|---|---|
| Your account | While your account is open, then 12 months |
| Your patients' records | Not ours to decide. When you leave, you export them, and we delete our copy 30 days later, or sooner on your instruction |
| Records of emails we sent you | 30 days, by our email provider |
| Encrypted backups | Up to six months. A deleted record stays in backups, beyond use, until it ages out |
| Invoices and payment records | 6 years after the end of the accounting year they fall in, as HMRC requires, even after your account closes |
5. Your rights
You have the right to:
- see the data we hold about you, and get a copy
- have it corrected if it is wrong. You can change your name and email on your account page yourself
- have it deleted, when we no longer need it
- restrict how we use it, or object to us using it on the basis of legitimate interests
- receive it in a portable form, to take elsewhere
Email [data protection contact email — to be added]. We answer within one month, and it is free. We may ask you to confirm who you are if there is real doubt.
We do not make any decisions about you based solely on automated processing, and we do not profile you.
Patients: these rights apply to your record too, but you exercise them through your clinician. See section 3.
6. If you visit our website
Counting page views. We use Vercel Web Analytics to count which pages are visited. It uses no cookies, does not store your IP address, and does not identify you. It records the page, the country and city the visit came from, your browser, your device type and where you came from. Before anything is sent, we remove anything identifying from the page address, including patient links. Our lawful basis is legitimate interests: understanding what is used so we can improve it. You can object by emailing us.
If you email us, for example to register interest, we keep your email and what you said for as long as we need to reply and follow up, and for no more than 12 months if nothing comes of it. Our email is hosted by Microsoft.
7. Who we share data with
We use a small number of providers to run the service. Each is bound by a contract to use the data only on our instructions and to keep it secure.
| Provider | What it does | Where | What it receives |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database and sign-in | Frankfurt, Germany | Everything stored in the service |
| Vercel (Vercel Inc.) | Runs the website and the service | Frankfurt, Germany | Everything, while it is being processed |
| Vercel (Vercel Inc.) | Page-view counting | United States | No personal data. See section 6 |
| Resend (Plus Five Five, Inc.) | Sends emails | United States | Name, email address, and for patients their portal link |
| Google (Google LLC) | Stores our backups | Google's data centres | Encrypted backups only. Google cannot read them |
| Microsoft | Our email inbox | Microsoft's data centres | Emails you send us |
| Stripe (Stripe Payments Europe, Limited) | Takes subscription payments | Ireland and the United States | Clinicians' billing details only. Never patient data. Stripe also uses them for its own fraud and anti-money-laundering checks, as an independent controller under its own privacy policy |
We publish a list of the providers that handle patients' data at /sub-processors, and tell clinicians before it changes.
We never sell personal data, and we never share it with anyone else except where the law requires us to, for example under a court order, or if the business is sold (below).
If the business is sold
If the service, or the company that runs it, is sold or merged with another business, the data we hold would pass to the new owner so the service can carry on. We will tell clinicians by email at least 30 days beforehand. The new owner must keep to this policy, and patients' records stay under their clinician's control.
Data leaving the UK
Germany is covered by UK adequacy regulations, so data held there is protected as it would be in the UK. For Resend in the United States, the transfer is protected by the UK's approved data transfer clauses (the international data transfer addendum to the EU standard contractual clauses), and Resend is also certified under the UK Extension to the EU-US Data Privacy Framework.
For Stripe, which sends billing details to the United States, the transfer is protected by Stripe's certification under the UK Extension to the EU-US Data Privacy Framework, with the UK's approved data transfer clauses as its fallback.
8. How we keep data safe
- Data is stored in Frankfurt and encrypted in storage and in transit
- Each clinician can see only their own patients. This is enforced on our servers and in the database, not just by the screens
- Every time a patient's record is opened, changed, sent or deleted through the service, it is recorded
- Backups are taken nightly, encrypted before they leave our systems, and tested by reading them back
- Access to our systems is limited to the company, protected by two-step verification [to be confirmed]
If something goes wrong, we will tell the clinicians affected without delay, and the ICO and you where the law requires.
9. Children
Accounts are for practitioners, not children. You must be [minimum age — to be confirmed] or over to open one.
Clinicians may work with children as patients. Their records are handled as in section 3, and kept until the child's 25th birthday at least, as the records rules for health care require.
10. Cookies and similar technologies
This section is our cookie notice.
We only use what the service needs to work. No advertising cookies, no tracking across websites, and no cookies from analytics. That is why there is no cookie banner: the law allows strictly necessary storage without asking.
What we store on your device
| Name | Type | What it is for | How long |
|---|---|---|---|
sb-…-auth-token | Cookie | Keeps you signed in. Strictly necessary | Until you sign out, or up to 400 days |
db_session | Browser storage | Holds the programme you are building, so it is not lost if you refresh the page. Strictly necessary | Cleared when you sign out |
db_favourites | Browser storage | Remembers the exercises you have starred | Until you clear it |
liveServicePatientId | Browser storage | Remembers which patient you last had open in live service | Cleared when you close that patient in live service |
Patients using their portal link have no cookies set by us.
Content from YouTube and Google Drive
Exercise videos are hosted on YouTube, and some reference material on Google Drive.
- Before you press play, the video's thumbnail image, and any Drive preview, is loaded directly from Google's servers. Google sees your IP address and which image was requested. No cookies are set by this
- When you press play, the YouTube video loads, and YouTube may set its own cookies and collect data under Google's privacy policy. A video only loads when you choose to play it
Managing cookies
You can block or delete cookies in your browser's settings. If you block the sign-in cookie, you will not be able to sign in.
11. Complaints
Please tell us first, at [data protection contact email — to be added]. We will acknowledge your complaint within 30 days and aim to resolve it quickly.
If you are not happy with our answer, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
Patients: complain to your clinician first, since they are responsible for your record.
12. Changes to this policy
We will update this page when anything changes, and change the date at the top. If a change matters to you, for example a new provider handling patient data, we will tell clinicians by email at least 30 days before it takes effect.