Privacy Policy
This explains how the Moovv practice platform handles data, and — just as important — which of us is responsible for what.
Your organisation is responsible for your patients' privacy. You decide what patient data to collect, you tell them about it, and you obtain their consent. We are responsible for keeping that data safe once it reaches us — storage, encryption, backups and access control.
Your patients have their own privacy policy at moovv.fit/privacy, which covers the moovv.fit app they use.
1. The two roles, and why the distinction matters
Under the Digital Personal Data Protection Act, 2023 and comparable data protection law, there are two roles in play:
- Your organisation is the Data Fiduciary (elsewhere called the controller) for your patients' personal and health data. You decide which patients to enter, what to record about them, what to upload, and why. The law places the duty of notice, consent and patient rights on whoever makes those decisions — which is your organisation, not us.
- We — Ryoshigo Technologies Private Limited, which operates Moovv — are a Data Processor. We hold and process that data on your instructions, to provide the Platform to you. We do not decide what goes in, we do not use it for our own purposes, and we do not sell it.
This is not a way of shifting blame; it follows from who is in the room with the patient. We have never met your patients and cannot obtain their consent, explain your clinical reasoning, or judge what is appropriate to record. Your physios can.
2. What we hold
2.1 About your organisation and practice
We collect this directly from you, and we are the Data Fiduciary for it:
| Organisation | Organisation name, clinic locations, addresses, contact details |
|---|---|
| Accounts | Names, designations, phone numbers, emails, profile photos for all staff accounts |
| Professional | Qualifications, registration and licence details for each physiotherapist |
| Practice | Clinic configurations, availability, session pricing, team assignments across locations |
| Billing | Subscription status, invoices, GST details. Card and payment credentials are handled by our payment provider and never reach our servers. |
| Technical | Login events, IP address, device and browser information, and error logs — used to keep the Platform secure and working |
2.2 About your patients
We hold this on your behalf. Your organisation puts it there, and your organisation is the Data Fiduciary for it:
| Identity | Name, phone number, age, and contact details you enter |
|---|---|
| Clinical | Pain profiles, body part and diagnosis, severity and triggers, clinical notes, session notes |
| Plans | Prescribed exercises, dosage, your notes, adherence and pain logs recorded by the patient |
| Media | Videos your physios record or upload for a specific patient, and images derived from them |
| Communications | Messages exchanged with the patient through the Platform, and telehealth session records |
3. What we do with it
We process data to run the Platform for you: authenticating logins, storing and retrieving records, generating exercise plans and PDF exports, delivering plans to the patient's app, running telehealth sessions and messaging, sending appointment and reminder notifications, issuing invoices, and providing support when you ask for it.
We also use aggregated, de-identified information to understand how the Platform is used and to improve it. This never identifies a patient.
We do not sell personal data, and we do not use your patients' data to market to them.
4. AI and automated processing
Some features send data to third-party AI providers — for example, generating a draft exercise plan, transcribing the audio of a video into written instructions, or selecting still frames from a video for a printable plan.
Where content may identify a patient, the Platform asks your physio to declare two things before anything is sent: whether the patient is identifiable in that content, and whether consent is held for it to be processed. If the patient is identifiable and consent is not held, the content is not sent to any AI provider. It is stored and made available to that patient, and nothing is derived from it.
That declaration is recorded with the content, along with the exact wording shown when it was made. It is a formal statement, and we act on it. Obtaining the underlying consent from the patient remains your organisation's responsibility.
Automated output is a draft for review, never a prescription. See section 3 of the Terms of Service.
5. How we protect it
This is our side of the arrangement:
- Encryption in transit. All traffic between your browser, the patient app and our servers uses TLS.
- Encryption at rest. Databases and stored files, including patient videos, are encrypted on disk.
- Private storage. Patient media is held in private storage with public access blocked. It is reached only through short-lived links issued to the specific physiotherapist or patient entitled to it.
- Separation. Content recorded for a patient is bound to that physiotherapist–patient pair, and is not visible to other physiotherapists or other patients outside your organisation.
- Backups. Automated backups are taken regularly and retained so data can be restored after a failure.
- Access control. Internal access is limited to the minimum personnel needed to operate and support the Platform.
- Breach notification. If we become aware of a breach affecting your data, we will tell you without undue delay and share what we know, so you can meet your own obligations to your patients and to the authorities.
No system is perfectly secure. These measures reduce risk; they do not eliminate it, and they do not cover what happens to data after your staff have legitimate access to it — an exported PDF left on a shared computer is outside our control.
6. Who else sees the data
We share data only where it is needed to run the Platform:
- Cloud infrastructure — hosting, storage, databases and backups.
- Communications — SMS for one-time passcodes and reminders; video infrastructure for telehealth sessions.
- Payments — our payment provider, for subscription billing.
- AI providers — only as described in section 4, and only for content cleared for processing.
- Legal — where we are required by law, court order, or a valid request from a public authority.
Data is primarily stored in India. Where a provider processes data outside India, we require appropriate contractual protections.
7. How long we keep it
Your organisation and practice data is kept while your account is active, and for a period afterwards to meet tax and legal obligations. Invoices are retained for the statutory period.
Patient records are kept while you use the Platform, so they remain available to your physios. Videos recorded for a patient are retained while relevant to that patient's care and for a defined period afterwards, then deleted.
Your physios can delete a patient's video at any time, and the file itself is removed from storage — not merely hidden. Patients cannot delete content recorded for them; they ask the physio, who acts on it. That is deliberate: the clinical record is yours to manage, and so is the obligation to honour a reasonable request.
Retention that your professional obligations require is your responsibility. If your regulator requires you to keep records for a set number of years, do not rely on the Platform alone — export and retain your own copies.
8. Rights
Your patients' rights are exercised through your organisation. When a patient asks to access, correct, or erase their data, or withdraws consent, they will come to your clinic, and your staff must respond. The Platform gives you the access and the tools to act on such a request. If you need our help to fulfil one, contact us and we will assist.
Your organisation's own rights in respect of account data — access, correction, erasure, grievance redressal — can be exercised by writing to us at the address below.
9. Cookies
The portal uses only what is necessary to keep users logged in and to remember preferences. This marketing site uses analytics to understand which pages are useful.
10. Changes
We may update this policy. Where changes are material we will notify you through the Platform or by email before they take effect.
11. Contact
Privacy questions, or help with a patient request: hello@moovv.fit.
Ryoshigo Technologies Private Limited
CIN: U72900PN2018PTC177785
Pune, Maharashtra, India
12. Grievance Officer
In accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), we have appointed a Grievance Officer to address your concerns regarding data processing:
Name: RJ
Email: r@moovv.fit
Phone: +91 6361674459
You may contact the Grievance Officer for any queries or complaints related to the processing of your personal data. We will acknowledge your request within 48 hours and resolve it within 30 days.