Privacy policy
Last updated 14 September 2026
Kaido ("we", "us") provides rehab-planning software to physiotherapy clinics. This page explains what data we process, why, and what rights you have over it — whether you're a clinician using the product or a patient whose rehab a clinic is tracking in it.
Who is responsible for your data
If you're a patient: your physiotherapy clinic is the data controller for your clinical information. Kaido is a data processor, acting only on the clinic's instructions — the clinic decides what's recorded and for how long; we provide the software that stores and processes it securely. Questions about your own care record should go to your clinic first.
If you're a clinician or clinic administrator using Kaido directly: we are the data controller for your account information (login, session activity).
What we collect
| Data | From whom | Why |
|---|---|---|
| Name, date of birth | Patients (entered by their clinician) | Identify who a rehab plan belongs to. We don't collect NHS number. |
| Sex/gender, occupation, address, phone number, emergency contact (name and phone) | Patients (entered by their clinician; every field optional) | The clinic's own patient record. Nothing is required — a clinician records only what the clinic's own practice calls for, and existing records hold nothing until a clinician adds it. Added 12 September 2026. |
| Clinical notes and dictated plans (text) | Patients (written or dictated by their clinician) | The clinician's working record of the episode — what was found, what was prescribed, which appointment it belongs to. Editable by the clinic; every revision is kept in the audit log. |
| Clinical notes, dictated or typed; the exercise plans derived from them | Clinicians, about patients | The core clinical record: what was assessed, what's prescribed, and progress against discharge criteria. |
| Email, password (hashed), MFA status | Clinicians and clinic admins | Account authentication. |
| Login timestamps, IP-independent session records | Clinicians and clinic admins | Security — detecting compromised sessions, audit trail. |
On-device voice processing
When a clinician dictates a clinical note in the iOS app, that audio is transcribed entirely on the clinician's own device using Apple's on-device speech recognition, then structured into a draft plan by Apple's on-device AI (Apple Intelligence) — both steps run locally. The audio is never sent to Kaido, Apple, or any other party and is discarded once transcribed; the resulting text — the drafted plan, and any clinical note the clinician dictates — is stored in Kaido's own database as part of the clinical record, and nothing reaches a patient until the clinician reviews it and chooses to approve it. We think this is a meaningfully stronger privacy position than a cloud-processing alternative, and we've built it that way deliberately, not as a stopgap.
Legal basis for processing
Health data (special category data under UK GDPR Article 9) is processed under Article 9(2)(h) — provision of health care by a health professional. Account data is processed under Article 6(1)(b) (necessary for the contract with the clinic) or 6(1)(f) (legitimate interests in running a secure service).
How your data is protected
- Every clinic's data is isolated at the database level — enforced by the database itself, not just application code, and independently tested against cross-tenant access attempts.
- Passwords are hashed (never stored in plain text); multi-factor authentication is available and recommended for all clinician accounts.
- Every change to clinical data is recorded in an append-only audit log that cannot be edited or deleted, even by us.
- Data is encrypted in transit (TLS) and at rest.
Who we share data with
We use a small number of infrastructure providers (sub-processors) to run the service. The table below includes one that's built but not yet switched on — we'd rather list it early than have it appear only once it's live. We don't sell data, and we don't share clinical data with advertisers or data brokers.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Application hosting and the API | The API runs in Vercel's London region (lhr1); the database, below, is London too |
| Neon Inc. (Postgres) | Database — every record the app stores | EU-West-2 (London) |
| Resend Inc. | Transactional email — password-reset links (clinician and patient accounts), a patient invite when a clinician sends one by email, a flare-reported notification to the clinic, a daily digest of voice proposals waiting for review, and — since the booking module shipped (September 2026) — appointment confirmations, a reminder the day before, waitlist offers, and invoices | United States. The account and clinic emails carry the recipient's email address and a link back into Kaido — a reset link, an invite link, a generic "a patient has reported a flare" notice, or a pending-review count. The booking and invoice emails necessarily carry more: the patient's name, the appointment time, the clinic and clinician names, or an invoice number. None of them ever carry symptoms, notes, or anything else from the clinical record. Transfer covered by the UK Extension to the EU-US Data Privacy Framework and Resend's data processing agreement |
| Anthropic PBC | Two optional features: sentiment-scoring a patient's flare-note free text, and drafting a suggested plan adjustment (from that patient's plan criteria, pain trend and feedback text) for a clinician to review. Neither ever writes to a plan directly. | United States. Not yet active — the code is deployed but no API key is configured in production, so no patient data has actually been sent yet. Before it's turned on: the transfer mechanism and Anthropic's data-retention/training-use terms need confirming against their current commercial terms, the way Resend's are confirmed above, and this row will be updated once they are. |
Apple is deliberately not on this list. Voice notes are transcribed entirely on the clinician's own iPhone using Apple's on-device speech APIs — the audio never leaves the device, so no clinical audio is ever sent to Apple, to us, or to any other third party. That's an architectural fact, not a policy promise: there is no code path in the app that could send it elsewhere. The transcribed text is stored by us, in the London database above, as part of the clinical record.
We'll update this list, and notify our clinic partners directly, before adding or changing any sub-processor — including before Anthropic, above, moves from built to active.
How long we keep data
What's actually true today, plainly: a patient's record is kept for as long as the clinic maintains it, and can be permanently erased on request at any time — this isn't aspirational, it's a tested procedure that also redacts the patient's identifying details out of historical audit-log entries, not just the current record (necessary, since the audit log is append-only by design and can't simply be edited).
What's still in progress: an automatic deletion trigger for records a clinic hasn't touched in a long time doesn't exist yet — erasure today is on request, not on a timer — and we haven't yet finalised what happens to a clinic's data if their account with us ends. Both are being worked out with our pilot clinic partner rather than guessed at unilaterally, since the right retention period is a clinical and regulatory question, not a technical one.
Your rights
Under UK GDPR you have the right to access, correct, or request erasure of your personal data; to object to or restrict certain processing; and to lodge a complaint with the Information Commissioner's Office (ICO). If you're a patient, start with your clinic — they hold the underlying clinical record and are best placed to action most requests directly; we support them in doing so.
Cookies and local storage
The web app stores a session token in your browser's local storage so you stay signed in — this is strictly necessary for the service to work and isn't used for tracking or advertising. We don't currently run any analytics or advertising trackers on this site.
Contact
Questions about this policy, or a data rights request: hello@kaidohealth.co.