Privacy Policy

Applies to the Physible.ai Mobile app (Android package com.physible.app) and the Physible.ai web service at physible.ai, admin.physible.ai and app.physible.ai.
Effective date: 13 October 2026

Physible ("Physible", "we", "us") provides clinic management software for physiotherapy practices. This policy explains what data the app and service collect, how we use it, who we share it with, how long we keep it and how you can have it deleted.

Summary. We collect the account details you give us and the clinic records you enter. We use them to run the service for your clinic. We do not sell data, we do not show ads and the app contains no advertising or analytics trackers. You can ask us to delete your account and data at any time at physible.ai/delete-account.

1. Who this policy covers

Clinic users: physiotherapists, clinic owners and clinic staff who create or are given a Physible account.
Patients: people whose records a clinic enters into Physible. For patient records the clinic decides what is collected and why, and Physible processes those records on the clinic's behalf. If you are a patient, please contact your clinic first. You can also contact us and we will pass your request to the clinic.

2. Data we collect

Category	What	Source
Account details	Your name, mobile number, email address (optional), role in the clinic, account status.	You, or your clinic's admin when they add you to the team.
Clinic details	Practice name, practice type, subscription plan and billing period.	You.
Patient records (health information)	Patient name, phone, email, date of birth, gender, address, referring doctor, diagnosis, ICD code, medical history, insurance provider and policy number, ABHA ID, appointments, home and hospital visits, treatment session notes and exercise prescriptions.	Entered by the clinic.
Billing records	Invoices and invoice line items a clinic raises for its patients, and their payment status.	Entered by the clinic.
Marketplace orders	Products ordered, quantities, prices and order status.	You.
Activity log	A record of who signed in and who created or changed records in a clinic, with the time.	Generated automatically.
Verification codes	One-time sign-in codes (stored only in hashed form) and the mobile number they were issued for.	Generated automatically.
Technical data	IP address, browser or device type, the pages or API endpoints requested and the time of the request, kept in server logs.	Generated automatically.
Assistant questions	The questions you type into the "Ask" assistant, when that feature is enabled for your plan.	You.

Data the app does not collect

The app does not request access to your location, camera, microphone, contacts or photos. It contains no advertising SDKs and no third-party analytics SDKs. We do not collect an advertising ID.

Data stored on your device

The app keeps your sign-in session and some working data, such as exercise plans you build, in the app's private storage on your device. This data is removed when you clear the app's data or uninstall the app.

3. How we use data

To create your account and sign you in with a one-time code sent to your mobile number.
To provide the clinic management features: patient records, scheduling, visits, treatment sessions, exercise plans, billing and marketplace orders.
To let a clinic admin manage team members and see an activity log for the clinic.
To answer support requests and send service messages about your account.
To keep the service secure, prevent abuse and fix faults.
To meet legal obligations.

We do not use patient records for advertising, and we do not use them to build profiles for any purpose unrelated to providing the service to the clinic.

4. Legal basis

We process clinic users' data on the basis of your consent, given when you create an account, and to perform our agreement with you. We process patient records on the instructions of the clinic that entered them. The clinic is responsible for having a lawful basis, including any consent required from its patients, under the Digital Personal Data Protection Act, 2023 and other applicable law.

5. Who we share data with

We do not sell personal data. We share it only as follows.

Within your clinic. Records are visible to the members of your clinic's team according to their role (admin, therapist, receptionist, billing).
Service providers. Our hosting provider stores the data. An SMS delivery provider receives your mobile number and the verification code when a code is sent by SMS. These providers may process data only to deliver their service to us.
AI assistant. When the "Ask" assistant is enabled, the questions you type and the earlier messages of that conversation are sent to our AI provider, OpenAI, to generate a reply. Patient records are not sent automatically. Do not type patient-identifying details into the assistant.
WhatsApp. When you choose to send a message from the WhatsApp screen, the app opens WhatsApp with the phone number and message you prepared. That message is then handled by WhatsApp under its own privacy policy.
Legal reasons. We may disclose data when the law requires it, or to protect the rights, safety or property of our users, patients or Physible.
Business transfer. If Physible is merged or acquired, data may transfer to the successor, which will remain bound by this policy.

6. Security

Data sent between the app or your browser and our servers is encrypted in transit using HTTPS. Access to clinic records requires signing in and is limited by team role. Verification codes are stored in hashed form. No system is completely secure, so we cannot guarantee absolute security. Tell us straight away at support@physible.ai if you believe your account has been accessed without permission.

7. How long we keep data

Account and clinic records: for as long as the account is active.
After a deletion request: we delete the account and its data within 30 days of confirming the request. Copies in routine backups are overwritten within a further 90 days.
Verification codes: expire after 5 minutes and are cleared periodically.
Server logs: kept for a limited period for security and troubleshooting, then deleted.
Records we must keep by law: for example, records of payments made to Physible and the record of a deletion request itself, kept only for as long as the law requires.

8. Deleting your account and data

You can request deletion in either of these ways. You do not need the app installed to use the web page.

In the app: Settings, then Profile, then "Delete account".
On the web: https://physible.ai/delete-account

The account deletion page lists exactly what is deleted and what is kept.

9. Your rights

Subject to applicable law, you can ask us to:

tell you what personal data we hold about you and how it is processed;
correct or update inaccurate or incomplete data;
erase your data;
withdraw your consent, which will end your use of the service;
register a grievance with us, and nominate another person to exercise your rights if you die or become incapacitated.

Send requests to support@physible.ai. We may need to verify your identity, normally by confirming the mobile number on the account. If you are not satisfied with our response you may complain to the Data Protection Board of India.

10. Children

The app is a professional tool for clinic staff and is not directed at anyone under 18. We do not knowingly allow anyone under 18 to create an account. A clinic may enter records for patients who are minors. The clinic is responsible for obtaining consent from a parent or guardian where the law requires it.

11. Where data is processed

Data is stored on servers operated by our hosting provider and may be processed in India or in other countries where our service providers operate, as permitted by applicable law.

12. Changes to this policy

We will post any change on this page and update the effective date. If a change is significant we will also tell you in the app or by message before it takes effect.

13. Contact and grievances

Physible
Privacy and grievance contact: support@physible.ai
Website: https://physible.ai

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.