1. Information We Collect
For Clinicians
- Email address and name (for authentication)
- Professional title and role
- Login activity and IP addresses
- Usage data and analytics (if consented)
For Patients
- Name, diagnosis, and treatment programme details
- Rehabilitation session data and activity logs
- HOME-7 pillar scores and progress metrics
- Goal tracking and outcome measures
- Documents uploaded by clinicians (if made visible)
2. Legal Basis for Processing
We process your data under the following legal bases:
- Consent: For analytics, marketing communications, and optional features
- Contract: To provide clinical services and patient care
- Legitimate Interest: For security, fraud prevention, and service improvement
- Legal Obligation: To comply with healthcare regulations and record-keeping requirements
3. How We Use Your Data
- Deliver neuro-rehabilitation services and patient monitoring
- Enable clinician-patient communication and care coordination
- Track rehabilitation progress and outcomes
- Generate reports and analytics for clinical decision-making
- Improve our services and user experience (with consent)
- Ensure security and prevent unauthorized access
4. Data Sharing
We do not sell your personal data. We may share data with:
- Healthcare Providers: Your assigned clinician and authorized care team members
- Service Providers: Supabase (database), Vercel (hosting), both GDPR-compliant
- Legal Authorities: When required by law or to protect rights and safety
5. Your GDPR Rights
Under GDPR, you have the right to:
To exercise these rights, email us at t.mutasa@holihab.com. We will respond within 30 days.
6. Data Retention
- Patient Records: Retained for 8 years after last treatment (UK medical records retention requirement)
- Clinician Accounts: Retained while account is active, then 2 years after closure
- Session Data: Retained for duration of patient care plus retention period
- Audit Logs: Retained for 6 years for security and compliance
- Anonymized Data: May be retained indefinitely for research and statistical purposes
7. Data Security
- Encryption in transit (HTTPS/TLS) and at rest
- Private storage with signed URLs (1-hour expiry)
- Role-based access control (clinician/admin roles)
- Authentication required for all sensitive operations
- Regular security audits and updates
- Row-level security on database tables
8. Cookies and Tracking
We use the following cookies:
Necessary Cookies (Always Active)
- Authentication tokens (sb-access-token)
- Session management
- Security and CSRF protection
Optional Cookies (Require Consent)
- Vercel Analytics (if consented) - aggregated usage data
- Performance monitoring
You can manage cookie preferences via the banner on your first visit or by clearing your browser cookies.
9. International Transfers
Your data is primarily stored within the UK/EU (Supabase EU region). Where data is transferred outside the EU (e.g., Vercel US hosting), we ensure adequate safeguards through Standard Contractual Clauses (SCCs) and data processing agreements.
10. Children's Privacy
HoliHab is designed for adults (18+) and healthcare professionals. For patients under 18, parental or guardian consent is required. We do not knowingly collect data from children without appropriate consent.
11. Data Breach Notification
In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority (ICO) within 72 hours as required by GDPR Article 33.
12. Changes to This Policy
We may update this policy periodically. Significant changes will be communicated via email or prominent notice in the app. Continued use after changes constitutes acceptance.
13. Contact & Complaints
If you have concerns about how we handle your data, you have the right to lodge a complaint with: