Privacy policy
Last updated 21 August 2026
Kaido Health ("we", "us") provides rehab-planning software to physiotherapy clinics. This page explains what data we process, why, and what rights you have over it — whether you're a clinician using the product or a patient whose rehab a clinic is tracking in it.
Who is responsible for your data
If you're a patient: your physiotherapy clinic is the data controller for your clinical information. Kaido Health is a data processor, acting only on the clinic's instructions — the clinic decides what's recorded and for how long; we provide the software that stores and processes it securely. Questions about your own care record should go to your clinic first.
If you're a clinician or clinic administrator using Kaido Health directly: we are the data controller for your account information (login, session activity).
What we collect
| Data | From whom | Why |
|---|---|---|
| Name, date of birth | Patients (entered by their clinician) | Identify who a rehab plan belongs to. Deliberately minimal — we don't collect NHS number, address, or contact details. |
| Clinical notes, dictated or typed; the exercise plans derived from them | Clinicians, about patients | The core clinical record: what was assessed, what's prescribed, and progress against discharge criteria. |
| Email, password (hashed), MFA status | Clinicians and clinic admins | Account authentication. |
| Login timestamps, IP-independent session records | Clinicians and clinic admins | Security — detecting compromised sessions, audit trail. |
On-device voice processing
When a clinician dictates a clinical note in the iOS app, that audio is transcribed and structured into a plan entirely on the clinician's own device, using Apple's on-device AI (Apple Intelligence). The audio and the transcript are never sent to Kaido Health, Apple, or any other party during this step — nothing leaves the phone until the clinician reviews the drafted plan and explicitly chooses to send it for review. We think this is a meaningfully stronger privacy position than a cloud-processing alternative, and we've built it that way deliberately, not as a stopgap.
Legal basis for processing
Health data (special category data under UK GDPR Article 9) is processed under Article 9(2)(h) — provision of health care by a health professional. Account data is processed under Article 6(1)(b) (necessary for the contract with the clinic) or 6(1)(f) (legitimate interests in running a secure service).
How your data is protected
- Every clinic's data is isolated at the database level — enforced by the database itself, not just application code, and independently tested against cross-tenant access attempts.
- Passwords are hashed (never stored in plain text); multi-factor authentication is available and recommended for all clinician accounts.
- Every change to clinical data is recorded in an append-only audit log that cannot be edited or deleted, even by us.
- Data is encrypted in transit (TLS) and at rest.
Who we share data with
We use a small number of infrastructure providers (sub-processors) to run the service — currently our hosting and database providers. We don't sell data, and we don't share clinical data with advertisers or data brokers. A current list of sub-processors is available on request at the email below.
How long we keep data
We're still finalising a formal retention schedule with our pilot clinic partner. Right now: a patient's data is kept for as long as the clinic maintains their record, and can be permanently erased on request — including redacting historical audit-log entries that reference them, not just deleting the current record.
Your rights
Under UK GDPR you have the right to access, correct, or request erasure of your personal data; to object to or restrict certain processing; and to lodge a complaint with the Information Commissioner's Office (ICO). If you're a patient, start with your clinic — they hold the underlying clinical record and are best placed to action most requests directly; we support them in doing so.
Cookies and local storage
The web app stores a session token in your browser's local storage so you stay signed in — this is strictly necessary for the service to work and isn't used for tracking or advertising. We don't currently run any analytics or advertising trackers on this site.
Contact
Questions about this policy, or a data rights request: hello@kaidohealth.co.