Privacy Policy

1. Who We Are

PhysioKer is a physiotherapy marketplace platform connecting patients with registered physiotherapists in Kerala. "We", "us", or "our" refers to PhysioKer. "You" refers to any patient, physiotherapist, or clinic using this platform.

2. What Data We Collect

Patients: Full name, phone number, district, locality, health complaint description, preferred visit time, session ratings you submit voluntarily, and — only if you tap "Locate Me" when submitting a home-visit request — your precise location at that moment, used to show you accurate distances to nearby physiotherapists.

Physiotherapists: Full name, phone number, district, locality, professional registration ID (KAPC/IAP/NCAHP), KUHS roll number (for fresh graduates), specialisation, years of experience, clinic name, registered work-location coordinates (captured the same way, for the same distance-display purpose — see Section 6), and subscription status.

Clinics: Clinic name, registration number, contact person, phone, district, locality, physiotherapist count, services offered, and subscription status.

Technical data: Device fingerprint hash (for fraud prevention only — not linked to identity), session logs, and audit events.

What we do NOT collect: continuous or background location tracking, payment card details (handled by Razorpay directly), or any biometric data. Every location we do capture is tied to a specific action you or your physiotherapist takes — see Section 6 for exactly when and why.

Browser storage: This app uses your browser's localStorage and sessionStorage to remember your session state, improve performance, and (for physiotherapists and clinics) store earnings and revenue data locally for cross-device sync. A one-way hashed device fingerprint is stored for fraud prevention. You can clear this data at any time by clearing your browser data or signing out.

3. Why We Collect It (Purpose)

We collect only what is necessary to:

• Match patients with physiotherapists nearby, and show accurate distances when you choose to share your precise location
• Verify physiotherapist professional credentials before allowing patient-facing profiles
• Process subscription payments for physiotherapist and clinic plans
• Detect and prevent fraudulent account creation
• Comply with applicable law

4. How We Protect Your Data

All data is transmitted over TLS 1.3. Our database provider (Supabase) applies AES-256 encryption at the infrastructure level — your data is encrypted at rest on Supabase-managed servers. Database access is further protected by Row-Level Security (RLS) policies — physiotherapists can only access data for their own assigned patients, not any other patient's data. Patient PINs are stored as one-way SHA-256 hashes and are never recoverable.

Clinical notes (SOAP format) are stored in a restricted table and are accessible only to the physiotherapist who created them. Patients cannot access clinical notes.

5. Who We Share Data With

We share the minimum necessary data with:

• Supabase (database hosting — data is stored on Supabase-secured infrastructure; Supabase is SOC 2 Type II certified)
• Razorpay (payment processing — they receive only what is required to process your subscription, never your health data)
• SMS / OTP provider (when OTP verification is enabled — they receive only your phone number for the duration of the verification. The specific provider will be named here when this feature is active.)
• Assigned physiotherapist — when you submit a request, your name, district, locality, and health complaint are shared with the physio who accepts your case
• A physiotherapist's own emergency contact — only if that physiotherapist presses the in-app SOS button, their location and the time are sent to the contact they've designated, so help can reach them quickly

We never sell your data. We never share your data with advertisers.

6. Location Data

PhysioKer never tracks your location in the background. Every location capture is tied to a specific action you or your physiotherapist takes:

Finding you a physio, and showing distance: Which physiotherapists get notified about your request is based on your pincode, taluk, and district — not exact coordinates. Separately, if you tap "Locate Me" when submitting a home-visit request, your browser may share your precise location with us. We only keep this reading if it falls inside Kerala and is accurate enough to trust; otherwise we fall back to the centre-point of the pincode you typed, and discard the untrustworthy reading entirely. Either way, this location is used solely to show you real distances to physiotherapists who show interest in your case (e.g. "2.3 km away"), is never shared outside PhysioKer, and is always optional — the app works fine from a typed pincode alone. Physiotherapists' registered work location is captured and used the same way.

After a physiotherapist accepts your case: you may separately choose to share your live location directly with them via Google Maps (a temporary link that expires — this never touches PhysioKer servers).

Physiotherapist SOS button: if a physiotherapist presses the in-app emergency SOS button, we attempt to capture their GPS coordinates at that moment and log them — along with the time and their emergency contact's number — to our internal safety audit log, and send that location to their emergency contact on WhatsApp. This exists solely to create a verifiable record of where and when a genuine emergency was triggered, and to get help to the physiotherapist as fast as possible. It only fires when a physiotherapist actively presses SOS.

7. Your Rights Under DPDP Act 2023

As a data principal under India's DPDP Act, you have the right to:

• Access — request a copy of all personal data we hold about you
• Correction — request correction of inaccurate personal data
• Erasure (Right to Delete) — request deletion of your account and all associated personal data. To exercise this right, contact us at the address below. We will complete deletion within 30 days.
• Grievance redressal — lodge a complaint if you believe your data has been mishandled

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law (e.g. transaction records for GST compliance, which are retained for 7 years per Indian tax law).

9. Children

PhysioKer is not intended for use by persons under the age of 18. If a parent or guardian is booking on behalf of a minor for paediatric physiotherapy, the adult's account is used and the adult is the data principal.

10. Changes to This Policy

We may update this policy as the platform evolves. Material changes will be communicated via email to registered users at least 7 days before taking effect.

11. Contact / Grievance Officer

For data requests, deletion requests, or complaints: