Privacy notice

This notice explains what personal information Recoveri handles, why, and what your rights are. It applies to the Recoveri platform at recoveri.health and recoveri.fitness. Last updated 15 September 2026.

Who is responsible for your information

the organisation that invited you is the data controller for your care or coaching record: the organisation decides why and how your movement data is used, and its clinicians or coaches are the people who see it.

Recoveri provides the platform. For your care or coaching data, Recoveri acts as the organisation's data processor, under a written agreement, and only on its instructions. For the running of the platform itself (your sign-in account, security logs, support requests) Recoveri is the controller. Contact Recoveri at privacy@recoveri.health.

What information we hold

• Your account: name, email address, a one-way hash of your password (never the password itself), two-factor settings, the language you use, and when you sign in.
• Your programme: the pathway and phase you are on, your goal in your own words, your readiness answers, and the version, date and language of the consent or acknowledgement you gave.
• Your movement measurements: the numbers the camera analysis produces during an exercise (joint angles, speed, steadiness, repetitions) and how the session felt. Video is never uploaded. The camera image is analysed on your own device and leaves it as numbers only.
• How you are doing: wellbeing check-ins, sleep and food logs, and questionnaire answers your care team asks for.
• Messages and community posts you write, and the care team's replies.
• Wearable data, only if you connect a device: daily steps, sleep minutes and resting heart rate. Nothing else is read from the provider, the connection tokens are stored encrypted, and unplugging the device destroys them.
• Security and audit records: who viewed or changed what, and when. These protect you and cannot be edited.
• Technical logs: errors and request traces used to keep the service running, which may include your network address for a short period to protect against abuse.

Why we use it, and the lawful basis

Your organisation uses Recoveri to support your care. It relies on its public task (Article 6(1)(e) UK GDPR) and the provision of health care (Article 9(2)(h)). The acknowledgement you give at onboarding confirms you have read how the platform supports your care; it is not the legal basis for your treatment, and asking to step back is a conversation with your care team, never an automatic switch-off.

Recoveri runs your sign-in, security and support on the basis of its legitimate interest in providing a secure service you can rely on.

Supportive messages and AI

Recoveri can send you short, encouraging messages when your own measured activity suggests one would help. Every message is triggered by a genuine measurement, never by guesswork. Your organisation chooses whether these are drafted with the help of an AI provider and whether a clinician reviews each one before it is sent; anything that could be a clinical concern is routed to your care team and is never sent to you automatically. No decision with a legal or similarly significant effect on you is made by automated means.

Who sees your information

• The clinicians, coaches and administrators your organisation authorises, within their role.
• Your organisation's service manager sees anonymised aggregates only; small groups are suppressed so nobody can be identified.
• Recoveri's platform team, only inside a declared, time-limited and fully audited support session, or when you ask for help and share a debug code.
• Service providers who process data on our behalf under contract: the hosting provider (in the United Kingdom), the email delivery service, the AI provider if your organisation enables one, and a wearable provider if you connect a device. None of them may use your data for their own purposes.

We do not sell your information, and we do not use it for advertising.

Where it is kept and for how long

Your data is held in the United Kingdom, in a database that belongs to your organisation alone. It is kept for as long as your organisation's retention policy requires: for a health record, that is the period set by NHS records management guidance; for an assessed guest without an account, screening data is deleted automatically after 90 days unless you join.

Your rights

You have the right to access your information, to have inaccuracies corrected, to ask for it to be deleted, to restrict or object to its use, and to receive a copy in a machine-readable form. From My account you can download everything Recoveri holds about you and raise a deletion or withdrawal request; your organisation must respond within one month and, where the law requires a clinical record to be kept, will explain its reasons in writing. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Cookies

Recoveri uses only the cookies it needs to work: your sign-in session, your language and world choice, a security token that protects forms, and a support-session marker when one is active. There are no advertising or analytics cookies, and nothing tracks you across other websites.

Security

Connections are encrypted in transit; secrets and device tokens are encrypted at rest; each organisation's data lives in its own database; every access to a record is audited; and staff accounts can be required to use two-factor authentication.

Changes to this notice

When this notice changes materially, the date at the top changes and your organisation will tell you. Earlier versions are available on request.