Privacy Policy

1. About this policy

Aimedis Rehab ("Rehab") is a rehabilitation platform for patients and their therapy teams: therapy plans and exercises at home, assessments, video sessions, messages and the AI assistant AVA. This policy explains which personal data we process when you use Rehab, why, who receives it, how long we keep it and which rights you have. It applies to the web application at rehab.aimedis.com and to your account, whether you use Rehab as a patient or as a professional.

• We do not sell your data and do not use it for advertising. • We use no advertising, analytics or tracking cookies. • Your therapy team sees your record only while you allow it, and every access is logged. • You can export and delete your data yourself.

Effective date: 9 November 2026.

2. Who is responsible for your data

The controller responsible for the processing described in this policy is:

Aimedis LLC 16192 Coastal Highway Lewes, Delaware 19958 USA

E-mail: contact@aimedis.com

If a therapist, physician or clinic uses Rehab to treat you, they are also responsible, under the rules of their profession, for the treatment records they keep about you. You can address questions about those records to them as well. Further details about our company are in the Imprint.

3. Data protection contact

E-mail: contact@aimedis.com

4. What data we process

We process the following data. You enter most of it yourself; your therapy team adds what belongs to your treatment.

• Account data: your e-mail address, your password (stored only in a form from which it cannot be recovered), your two-factor authentication if you turn it on, your language, and whether you use Rehab as a patient or as a professional. Professionals also give their profession, which we verify before they can treat patients. If you sign up with Google, Google sends us your name, your e-mail address and the ID of your Google account. • Profile data: your name, date of birth, contact details and address, profile picture, and any further details you add to your profile. • Your rehabilitation record: your diagnoses and history, therapy goals and treatment plans, scheduled and completed sessions, the exercises you do and how they went (for example effort and pain), assessments and their scores (for example the Barthel Index, the Berg Balance Scale, the MoCA and verbal-fluency tasks), progress reports, nutrition plans and entries, readings from devices you connect, documents shared with you, referrals and discharge reports. It can include particularly sensitive health details. • Messages: what you and your therapy team write to each other in Rehab. • Video calls and group sessions: who was invited, who joined and when. Aimedis does not record video calls. • AVA: your questions to AVA, typed or dictated, and AVA's answers (section 6). Entries and actions you choose to save are stored in your record. • Voice: your voice while you dictate or take a spoken assessment, and the text of the answers you have read aloud (section 6). • Consent and access records: the access you give and withdraw, your sharing PIN (stored only in a form from which it cannot be recovered), invitations, and a log of who opened or changed your record and when. • E-mails: the e-mails we send you, for example sign-in, invitation and appointment e-mails. • Technical and security data: your IP address, information about your browser and device, sign-in times, security logs, and the storage on your device described in section 14.

5. Why we process your data, and on which legal basis

We process your data only for the purposes below. Where the EU General Data Protection Regulation (GDPR) applies, each purpose names its legal basis.

• Your account (creating it, signing in, also with Google if you choose it, the security features you turn on, account e-mails): our contract with you (Art. 6(1)(b) GDPR). • Your rehabilitation record, AVA and the other features described here: your explicit consent to the processing of your personal and health data as described in this policy, which you give when you create your account (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Where a therapist, physician or clinic uses Rehab to treat you, their processing also rests on the provision of health care by professionals bound by professional secrecy (Art. 9(2)(h) and (3) GDPR). • Sharing your record with your therapy team (section 7): your explicit consent, which you give each time you share your Aimedis ID and PIN with a professional or accept an invitation (Art. 6(1)(a) and Art. 9(2)(a) GDPR). • Security (security logs, protection against misuse and attacks, the log of access to your record): our legitimate interest in protecting Rehab and your data and in being able to show who accessed your record and when (Art. 6(1)(f) GDPR). • Answering your requests and meeting other legal duties: our legal obligations (Art. 6(1)(c) GDPR).

Your right to object: where we rely on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time, on grounds relating to your particular situation, by writing to us (section 18). We then stop this processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

What you need to provide: to create an account you need an e-mail address and a password, or a Google account, and your consent to the processing of your health data; without that consent, Rehab cannot keep your record. What you add beyond that is up to you. You do not have to use AVA, dictation or the video avatar; the other features work without them.

6. AVA and the other AI features

AVA is the AI assistant in Rehab. It is an AI system, not a person and not a healthcare professional. AVA does not diagnose, and its answers do not replace the advice of your therapy team.

These features send data to service providers:

• AVA conversations go to Anthropic (the language model Claude): your message, the recent conversation, the parts of the record AVA may use for the person you are asking about, and the results of the searches AVA ran. The latest messages are kept in your browser and sent again with your next question; they are not stored as a conversation in Rehab's database. • Reference questions: for general medical questions AVA searches the Aimedis Wiki (section 8). Only a short general topic derived from your question leaves Rehab for this, checked for personal details before it is sent, never your name or your record. • Verbal-fluency assessments: the words you said, without your name, go to Anthropic to classify word forms that the built-in rules cannot resolve. • Dictation, voice commands, spoken assessments and read-aloud use ElevenLabs: your voice is sent for transcription only while a dictation listens, and the text of an answer you have read aloud is sent for speech synthesis. • The optional video avatar uses D-ID: AVA's answer text is sent so that the avatar can speak it, and your browser connects to D-ID's media service to receive the video.

7. Your therapy team and sharing your record

Professionals see your record only when you allow it: you give a professional your Aimedis ID and PIN, or you accept their invitation. A professional who has asked for access sees nothing of your record until you have agreed. A professional may also create a record for you before you have an account, for example to plan your first session; once that record is linked to your account, that professional, too, needs your consent.

You can withdraw access at any time in Rehab; it ends at once for that professional. Every opening of your record is logged, and you can see who has access in your care team.

Your therapy team can import a referral about you from another provider and create a discharge report, both in the HL7 FHIR standard, to pass on to the providers involved in your care. Each recipient is then itself responsible for the data it has received.

8. Service providers and other recipients

We do not sell your data. The following providers process data on our behalf (Art. 28 GDPR), each only for the service named and only on our instructions:

• Supabase (data stored in Ireland, EU): database, sign-in and file storage. • Our hosting provider (servers in Frankfurt, Germany): runs Rehab's servers and Aimedis' own video server; everything you send to Rehab and receive from it passes through them. • Anthropic (USA): AVA and the other text-based AI features (section 6). • ElevenLabs (USA): transcription and read-aloud (section 6). • D-ID: the optional video avatar (section 6). • Resend (USA): delivers the e-mails we send you; it receives your e-mail address and the content of each e-mail. • Zoom (USA): only as a fallback for a single call when Aimedis' own video cannot connect, and only after each participant agrees. Zoom then receives a neutral meeting topic, the scheduling details, and the audio, video, display names and connection data of the participants who join.

Video calls, group sessions and events otherwise run on Aimedis' own video server (LiveKit, in Frankfurt, Germany). They are end-to-end encrypted: sound and picture are encrypted on your device with a key that only the admitted participants receive, so the server forwards them without being able to see or hear them. The server processes only connection data such as IP addresses and times.

The following recipients receive data for the purpose named, and only the data named:

• Aimedis Wiki (wiki.aimedis.com, operated by us): receives the general search terms of AVA's reference questions, checked before transmission, never your record. To answer them it searches its own library and the public medical literature of the U.S. National Library of Medicine (PubMed and MedlinePlus) with those terms only. It also delivers the exercise films you play. • Aimedis Support (support.aimedis.com, operated by us): if you open Help, it receives your name, your e-mail address, your account identifier and what you write, so that your request is linked to your account. • Google (USA), if you sign up or sign in with Google: you sign in at Google, which confirms your identity to us. Google is a separate controller for its sign-in; see Google's privacy policy (policies.google.com/privacy). • Google Maps Platform (Google, USA), if you use the address search in your profile: it receives what you type there and the suggestion you pick, sent from our server without your name or your record, and suggests addresses. Google is a separate controller for this. • Open Food Facts: receives the name of a food you search for in Nutrition, sent from our server without your name or your record. • Wearable providers (Withings, Oura, WHOOP), where Rehab offers them and only if you connect one: the provider you authorize returns the activity, sleep and health readings you allowed. • Aimedis XR: when you start an XR experience, it opens in a new tab at play.aimedisstream.com. That service receives the usual connection data of your browser and the name of the session in the link, not your record.

We also disclose data where the law obliges us to, for example to a court or an authority on a binding order.

9. Data outside the European Union

Your record and your files are stored in the EU, in Ireland, and Rehab's servers are in Frankfurt, Germany. Aimedis LLC, the operator of Rehab, is a company in the United States. Anthropic, ElevenLabs, Resend and Zoom are based in the United States, so the data they process for us is transferred there; so is the data Google receives when you use Google sign-in or the address search, and the general search terms the Aimedis Wiki sends to the U.S. National Library of Medicine. D-ID and the Aimedis XR streaming service may process the data they receive outside the EU.

For each transfer we use one of these safeguards: where the recipient is certified under the EU-U.S. Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR); where the recipient is in a country with another adequacy decision, that decision; otherwise the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can ask us which safeguard applies to which recipient and request a copy (section 18).

The risks: the United States does not protect personal data in the same way as the EU. Under US law, US authorities can require US companies to hand over data, for example for national security purposes, and it can be harder for you to enforce your rights there. Standard contractual clauses bind the recipient, not the US authorities.

10. How long we keep your data

• Account, profile and rehabilitation record: as long as your account exists. When you delete your account, we delete it together with your record and your files. If you used Rehab as a professional and records you created for patients must remain, your account is anonymised instead. • AVA conversations: the latest messages are kept in your browser's storage on that device, not in Rehab's database, until you clear them. Entries and actions you saved stay in your record like any other entry. • Access, consent and security records: as long as they are needed to show who accessed your record and on what basis, and to establish, exercise or defend legal claims. • Backups: copies in backups are deleted when the backups are overwritten in the normal backup cycle.

11. Your rights

You can see, correct, export (as JSON or CSV) and delete your data in Rehab, and withdraw the access you gave to a professional at any time.

Under the GDPR, you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21; see section 5). You can withdraw a consent at any time with effect for the future (Art. 7(3) GDPR); processing before the withdrawal remains lawful.

For anything you cannot do in Rehab, write to us (section 18). We answer without undue delay and at the latest within one month. If a request is complex, we can extend this period by two further months; we then tell you the reasons within the first month. To protect your data, we act only once we know that the request comes from you, usually because it comes from the e-mail address of your account.

12. Your right to complain

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The European Data Protection Board lists all supervisory authorities (edpb.europa.eu). Outside the European Union, you can complain to the data protection authority of your country, where there is one.

13. No automated decisions

We make no decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AVA's answers, the scores Rehab calculates and the notices it shows your therapy team are information; people decide what to do with them.

14. Cookies and storage on your device

Rehab sets only strictly necessary cookies and stores on your device only what the service you use requires. We use no advertising, analytics or other tracking cookies, and therefore show no cookie banner.

• Cookies: the session cookies that keep you signed in, a cookie that remembers your language (one year), a cookie with your device's time zone (rehab-tz, one year) so that the days Rehab counts, such as an assessment's date or your activity streak, follow your local time, and short-lived security cookies while you connect a wearable. • Browser storage: your settings on that device (for example whether AVA reads its answers aloud, your camera and video background, your dictation language and the music of the exercise films), whether you stay signed in, your progress in the guided tour, the patient a professional last selected, and the latest messages of your AVA conversations.

All of this is strictly necessary for a service you have requested, so EU law does not require your consent to it (Art. 5(3) of Directive 2002/58/EC).

15. Security

We protect your data with technical and organisational measures: encryption in transit and at rest, end-to-end encrypted video, two-factor authentication you can turn on, PINs and passwords stored only in a form from which they cannot be recovered, row-level security in the database so that other accounts cannot reach your record, and a log of every access to it. No system is completely secure. If a security breach puts your data at risk, we inform you and the competent authorities as the law requires.

16. Children

Rehab is not directed at children: you must be at least 18 years old to create an account (see our Terms). We do not knowingly collect data from children; if we learn that a child has created an account, we delete it.

17. Information for users in the United States

We do not sell your personal information, do not share it for cross-context behavioral advertising and do not use it for targeted advertising. Rehab does not track your activities over time and across other websites, and lets no advertising or analytics company do so, so it works the same whether or not your browser sends a "Do Not Track" or Global Privacy Control signal. Depending on the state you live in, you have rights to access, correct, delete and obtain a copy of your personal information; use the tools in Rehab or write to us (section 18).

18. Changes and contact

We update this policy when Rehab or the law changes, and tell you about material changes in Rehab before they take effect. If a change requires your consent, we ask for it again.

Questions about this policy or your data: write to the e-mail address in section 2, or by post to the address there.