Privacy Policy for PhysioAI EMR

Therapist-private EMR for physiotherapy clinics in India. One Supabase Auth user = one therapist (auth.users.id → emr_users.user_id).

• Every private row carries therapist_id = auth.uid(). Triggers emr_force_therapist() overwrite any client-sent owner.
• Row-Level Security: you can CRUD only your own rows. Cross-therapist access blocked. Anonymous reads only emr_public_profiles where published = true.
• Patient deletes are soft (is_active=false, archived_at). Clinical/financial rows are ON DELETE RESTRICT.
• Public profile (physioai.in/profiles/{slug}) holds public-safe fields only. No patient, clinical, billing or comms data.
• Voice intake: audio → emr-voice-intake Edge Function (server-only) → Corti transcription → Fireworks / OpenRouter extraction. Secrets never in app bundle.

Modules: Patients · SOAP notes · Assessments (BBS, MMT, FMA) · Appointments · Home visits · Protocols + assignments · Exercise prescriptions · Home programs · Invoices / Payments / Revenue · Communications · Alerts · Availability / Settings · Public profile · Voice intake.

• Auraflex never uses patient PHI for marketing, model training or analytics. Only to provide the EMR to you.
• You must obtain free, specific, informed consent (DPDP §6) before entering patient data, show a §5 notice, honour withdrawal. Separate recording consent for voice. See Patient Consent template.
• Employment data (§7(f)) may apply to staff — patient data still needs consent except §7(d) emergency / §7(e) epidemic.

A. Therapist account & profile

emr_users: name, photo, email, phone, title, bio, experience, qualifications, certifications, specializations, languages, clinic name/address, slug, template, onboarding. Auth via Supabase (Apple/Google where used). emr_settings + emr_availability.

B. Patient master (PHI)

emr_patients: name, age/DOB, sex, phone, email, occupation, condition, stage, risk, admission, referral, complaints, medical/surgical history, allergies, meds, family/social history, goals.

C. Clinical (PHI)

SOAP notes, assessments (BBS 14 items etc.), protocols + assignments, exercise prescriptions, home programs, alerts.

D. Scheduling & visits

Appointments (scheduled/completed/cancelled/no_show, clinic/home/online), home visits (slot, address, fee).

E. Billing

Invoices (unique no. per therapist), payments (cash/UPI/card/bank_transfer), revenue ledger. We never see full card/UPI credentials — via Apple/Google + RevenueCat.

F. Communications

emr_communications: channel, purpose (appointment/exercise/follow-up/payment reminders), body, status, timestamps.

G. Voice intake

Mic audio you record, Corti transcript, extracted JSON (name, age, complaint, onset, painScore if stated, redFlags or “None reported”). Extractor only fills what was said — never invents diagnosis/meds.

H. Automatic / device

Device model, OS/app version (1.0.1/build 2), device ID, IP, locale, crash logs (Sentry), analytics + replay (Amplitude), entitlement (RevenueCat), push token, Edge logs, Upstash counters.

• DPDP §4/§6 (Consent): separate consent per purpose, notice in English / Eighth-Schedule language before collection, withdrawal as easy as giving.
• DPDP §7 (Legitimate uses): emergency (§7(d)), epidemic (§7(e)), State/legal (§7(b)(c)), employment (§7(f)) etc.
• GDPR/UK GDPR: contract, consent, legitimate interests (security/fraud/core analytics), legal obligation. Storage limitation Art.5(1)(e).
• Therapist duty: warrant §5 notice + §6 consent per patient (or §7 ground); parental consent for under-18s (§9).

• Operate private EMR workspace (sync, schedule, SOAP, scores, protocols, billing, reminders, public profile).
• Transcribe/extract voice intake to pre-fill intake — human must review before saving.
• Reminders you trigger; service/security/support; purchase fulfilment.
• Safety, fraud prevention, crash diagnosis, aggregated improvement (PHI never for marketing/training).
• Legal/tax/store reconciliation and breach response.

EMR uses AI in one place: voice intake extraction (audio → Corti → Fireworks/OpenRouter structuring). Model copies exactly, never infers diagnosis, never invents meds/allergies/scores. Outputs are documentation aids, not diagnosis. Verify before saving.

No Prep-Hub study AI runs on patient PHI.

Deleting the app stops future collection from that device but does not delete server data or cancel store subscriptions.

• Supabase (auth, Postgres + RLS, storage, Edge) · RevenueCat · Apple / Google · Expo/EAS · Amplitude (replay) · Sentry · Intercom · LiveKit · ElevenLabs · Corti (EU/US, server-side) + Fireworks / OpenRouter · Upstash Redis

Sharing only with consent, to provide service, protect rights/safety, or as required by law. Art.28 DPAs where required. Analytics sharing = “sharing” under CCPA (no sale for money).

Supabase/Amplitude/Sentry/Intercom/RevenueCat/Corti may be US/EU per DPAs. DPDP §16: transfer allowed except restricted countries (none notified as of Mar 2026; RBI localisation still applies to payment data). GDPR Ch.V: adequacy / SCCs / consent.

• TLS 1.2+ in transit; encryption at rest via Supabase; expo-secure-store for tokens; AES-256 for media/transcripts where applied.
• RLS + therapist_id + triggers; service_role confined to Edge Functions; JWT-verified deletes.
• App lock, 2-min auto-logoff recommended, no jailbreak/root, MDM remote-wipe recommended for BYOD.

Breach: Board + affected principals per DPDP §8(6) + GDPR 72h rule where risk exists. Contact support@physioai.in immediately if you suspect a breach.

• In-app: Profile/Settings → Delete Account → confirm (JWT-verified, deletes workspace then auth user).
• Email: support@physioai.in subject “Data Deletion Request — EMR” + registered email.
• Verify → complete within 30 days (target 7 days). Backups clear on rolling propagation. Billing/tax minima + anonymised aggregates survive. Full steps: EMR Delete Account.
• Export first: therapists must export / hand over records required by law before deleting — deletion is irreversible.

• DPDP §§11–14: access, correction, erasure, nomination, grievance redressal. Grievance: support@physioai.in, 30-day target.
• GDPR: access, rectification, erasure, restriction, portability, objection, consent withdrawal.
• CCPA/CPRA: know/delete/correct, opt-out of sharing, non-discrimination.
• Patients contact their therapist first (their Fiduciary); we assist the therapist. Response within one month (+2 for complex).

Verifiable parental/guardian consent required before processing any under-18 patient data (DPDP §9). Therapist accounts: 18+ licensed professional only.

Material changes posted with new date + in-app/email notice; fresh consent where required; prior versions on request.