Trust & Security

All data is encrypted in transit using TLS (the same encryption standard used by banks and hospitals) and at rest using AES-256 (a government-grade encryption standard). Whether information is moving between your phone and our servers or sitting in our database, it's protected from unauthorised access.

Every clinician can only access their own patients and programs. This isn't just an app-level rule - it's enforced directly in the database itself, so even a software bug couldn't expose another practitioner's data. Patients can only view programs that have been specifically sent to them.

Before a patient can view any program, they verify their identity with a one-time code sent to their email. Codes expire after a short window and the account locks temporarily after failed attempts. Patients never need to create an account or remember a password.

Exercise videos and documents are stored in private storage with no publicly accessible URLs. When a verified user needs access, the system generates a time-limited link that expires automatically. These links cannot be guessed, reused, or shared.

When a clinician uses Kinesia's AI assistant to help build a program, only the clinical notes they type are processed. Patient names, email addresses, phone numbers, videos, and files are never sent to the AI provider. Our AI provider, Anthropic, does not store or use submitted data for training under their commercial API terms.

Kinesia is built on industry-leading cloud providers with independently audited security practices:

• Supabase (database & authentication) - SOC 2 Type II certified
• Cloudflare (content delivery & file storage) - SOC 2 Type II, ISO 27001
• Anthropic (AI provider) - commercial API with zero data retention

You can delete your own data at any time. From the patient portal, choose Manage my data - once you've verified your identity with a one-time code, you decide what to remove: the data held for a single clinic, or your entire Kinesia record across every clinician who treats you. A clinician can also send you a link to start this, but only you can confirm it - no one can delete your data on your behalf.

When a deletion is confirmed, everything it covers - programs, exercises, videos, documents, and progress history - is permanently and irreversibly removed from our systems, including the copy your clinician sees in their app. Data is not archived or hidden. (Your clinician keeps their own separate medical records about your care, as they're required to - those are not part of Kinesia.)

Likewise, when a clinician deletes a program, everything associated with it - exercises, videos, documents, progress notes, and sharing links - is permanently removed in the same way.

One boundary to be honest about: any email we've already sent you - a program or a reminder, for example - is delivered through our email provider, which keeps its own copy under its retention schedule. Deleting your data removes it from Kinesia, but it can't reach back and unsend an email that has already arrived in your inbox.

• We never sell or share patient data with third parties
• We never show ads or use patient data for marketing
• We never use tracking cookies or follow patients across other websites
• We never collect more personal information than is needed to deliver the service