Privacy policy

1. Who we are

Fisioflow is a management platform for physical therapy clinics operated by New Street Group, based in San José, Costa Rica. For any question about this policy you can write to us at info@fisioflow.app.

2. Data we process

Clinic and user data: name, email, phone, clinic name and subscription billing details.

Patient data the clinic records on the platform: identification, contact details, clinical history, SOAP notes, appointments and payment records. This is sensitive health data and is handled with the reinforced measures described in this policy.

Technical data: IP address, device type and usage logs needed for the security and operation of the service.

3. Roles and responsibility

For patient data, the clinic is the data controller and Fisioflow acts as processor: we process that data only to provide the service and following the clinic's instructions. The clinic is responsible for obtaining its patients' informed consent under Law 8968 and its regulations.

4. What we use the data for

Providing and maintaining the service: scheduling, records, reminders, billing and reports.

Sending appointment reminders to patients by email and WhatsApp on behalf of the clinic.

Providing support, communicating service changes and billing the subscription.

Ensuring security, preventing fraud and meeting legal obligations.

5. Legal basis

We process data on the basis of the contractual relationship with the clinic, the informed consent of individuals where applicable, and compliance with legal obligations in Costa Rica, in particular Law 8968 on the Protection of Persons regarding the Processing of their Personal Data.

6. Where and how it is stored

Data is stored in PostgreSQL databases managed by cloud infrastructure providers, encrypted in transit (TLS 1.3) and at rest (AES-256). We run automatic daily backups. Internal access is limited to staff who need it to provide support and is logged.

7. Who we share data with

We do not sell or transfer data to third parties. We share data only with providers we need to operate the service (cloud infrastructure, email delivery, messaging (WhatsApp) and subscription payment processing), under agreements that require them to protect the information. We may disclose data if a competent authority requires it by law.

8. Your rights

Data subjects may access, rectify, update and delete their data, and withdraw consent, under Law 8968. Patient requests are handled through their clinic; platform users can write to info@fisioflow.app. We reply within five business days.

9. Retention and export

We keep data while the clinic's account is active. The clinic can export its patients and records at any time, free of charge. When the account is cancelled, data is kept for 30 days to allow recovery and then securely deleted, unless a legal obligation requires longer retention.

10. Changes to this policy

If we change this policy, we will notify platform users by email and update the date at the top of this document.