Privacy Policy

Personal Information:

• Name, email address, and contact details
• Age, gender, and basic demographic information
• Emergency contact information

Health Information:

• Stroke-related medical history and recovery progress
• Physical therapy exercise data and progress tracking
• Mental health assessments and mood tracking
• Medication reminders and adherence information
• Rehabilitation goals and milestones

Usage Data:

• App usage patterns and feature interactions
• Learning module completion and progress
• Exercise session data and performance metrics
• Communication with healthcare providers through the app

Technical Information:

• Device information and operating system
• IP address and location data (if enabled)
• App performance and crash reports

Treatment Support:

• Personalizing rehabilitation programs and exercises
• Tracking recovery progress and providing insights
• Sending medication and therapy reminders
• Connecting you with appropriate healthcare resources

Educational Content:

• Customizing learning modules based on your recovery stage
• Providing relevant stroke education and prevention information
• Offering family support resources and guidance

App Improvement:

• Analyzing usage patterns to enhance user experience
• Developing new features based on user needs
• Ensuring app stability and performance
• Conducting research to improve stroke recovery outcomes (anonymized data only)

Security Measures:

• Encryption of all data in transit (TLS 1.2+)
• Encryption of data at rest in Swiss and EU data centres (AES-256)
• Regular security audits and vulnerability assessments
• Role-based access controls and full audit logging of access to health data

Access Controls:

• Strict access controls limiting who can view your health data
• Healthcare providers only access data with your explicit consent
• You maintain full control over sharing your information
• Option to export or delete your health data at any time

Compliance:

• Swiss Federal Act on Data Protection (FADP)
• GDPR compliance for European users
• Swiss Medical Devices Ordinance (MedDO) where applicable
• Regular internal and external compliance reviews

Healthcare Providers:

• With your explicit consent, we may share relevant data with your healthcare team
• Integration with electronic health records (EHR) when authorized
• Emergency medical information sharing if you've enabled this feature

Family and Caregivers:

• Progress updates and basic information with designated family members
• Emergency contact notifications if you've enabled this feature
• Shared goal tracking and milestone celebrations

Research (Anonymized Only):

• Aggregated, anonymized data for stroke recovery research
• Contributing to medical research to improve stroke treatment
• No personally identifiable information is ever shared for research

Legal Requirements:

• We may disclose information if required by law or court order
• Emergency situations where disclosure could prevent harm
• Compliance with medical reporting requirements

Access and Control:

• View, download, or export all your personal data
• Correct or update your information at any time
• Delete your account and all associated data
• Opt-out of non-essential communications

Consent Management:

• Withdraw consent for data processing at any time
• Control what information is shared with healthcare providers
• Manage family and caregiver access permissions
• Choose your communication preferences

Swiss Data Protection Rights (FADP):

• Right to information about data processing
• Right of access to your personal data (Art. 25 FADP)
• Right to rectification of incorrect data
• Right to deletion
• Right to data portability (Art. 28 FADP)
• Right to object to data processing

GDPR Rights (EU Users):

• All Swiss rights plus additional GDPR protections
• Right to restrict processing
• Right to lodge complaints with EU supervisory authorities

Active Account Data:

• Personal information: retained while your account is active
• Health data: retained while your account is active; deleted within 30 days after account closure, unless a statutory retention obligation applies
• Usage data: retained for 12 months for troubleshooting and app improvement

Deletion Process:

• Account deletion removes all personal identifiers within 30 days
• After the retention period, data is securely and permanently deleted or anonymized
• Backups are automatically purged according to our retention schedule (max. 90 days)
• You can request immediate deletion of all data via your account or on request

Switzerland's Adequate Protection:

• Switzerland has been recognized by the EU as providing adequate data protection
• Swiss data protection laws meet international standards
• Seamless data transfers within Switzerland and to the EU
• Additional protections for transfers to other countries

Data Transfers:

• We primarily use Swiss and EU-based service providers for data storage
• Transfers to third countries take place only on the basis of an adequacy decision or FDPIC-recognized standard contractual clauses (Art. 16 FADP)
• You can request information about where your specific data is stored

Safeguards:

• All data transfers use encryption and secure protocols
• Regular audits of all service providers regardless of location
• Priority given to Swiss and EU-based service providers

Supabase Inc. — Database, authentication, file storage

• Purpose: User accounts, health-data storage, authentication
• Data: All account and health data
• Location: [VERIFY — depends on configured Supabase region; default is AWS]
• Safeguard: [VERIFY — DPA with Supabase + FDPIC-recognized SCCs for US transfer]

Vercel Inc. — Web hosting, analytics, speed insights

• Purpose: Website hosting, performance monitoring
• Data: Page-view telemetry, truncated IP addresses
• Location: Global edge network; processing in EU/US
• Safeguard: [VERIFY — Vercel DPA + SCCs]

Google LLC — Gmail SMTP (outbound email)

• Purpose: Sending contact and support form messages
• Data: Name, email address, message content
• Location: United States
• Safeguard: [VERIFY — SCCs]

Google LLC — Google Fonts

• Purpose: Web fonts
• Data: IP address when loading fonts
• Location: Global
• Safeguard: [VERIFY — self-hosting recommended]

Age Restrictions:

• Users under 16 require parental consent to use the app
• Enhanced privacy protections for all users under 18
• Limited data collection for minors
• Parental controls and oversight options

Family Accounts:

• Parents can create supervised accounts for minor children
• Enhanced security and privacy controls for family accounts
• Limited sharing capabilities for minor users

Notification obligations:

• Notification to the Swiss Federal Data Protection and Information Commissioner (FDPIC) as soon as possible (Art. 24 FADP)
• Notification to EU supervisory authorities within 72 hours under the GDPR, where applicable
• Notification of affected users where the breach poses a high risk to their rights

Process:

• Containment and forensic analysis by our security team
• Documentation of all incidents in our internal data-protection register
• Review and reinforcement of our security measures

• Material changes will be announced at least 30 days in advance by email and in the app
• The date of the last update is always displayed at the top of this page
• Previous versions are available on request
• Continued use of our services after a change constitutes acknowledgement

Controller / Data Protection Advisor:

• Email: privacy@viacommuna.com

General Support:

• Email: info@viacommuna.com
• Website: https://viacommuna.com/en/support

Mailing Address:

• Via Communa GmbH
• 9000 St. Gallen, Switzerland
• Swiss commercial register no.: [CHE-XXX.XXX.XXX — TO FILL IN]

Swiss Data Protection Authority:

• Federal Data Protection and Information Commissioner (FDPIC)
• Website: www.edoeb.admin.ch
• Email: info@edoeb.admin.ch