Privacy Policy

Everything you record stays on your phone. There is no account, no sign-in, and no server holding your recovery. We cannot see your measurements, we cannot email them to you, and we could not hand them to anyone else if we were asked, because we do not have them.

Two things leave your device, and neither contains anything you record: a crash report when the app breaks, and a check for updates to the app itself. Both are described in full below.

Pivot stores the following on your device, and only on your device:

• Your recovery details: whether you have had or are waiting for surgery or are having rehabilitation without it, the surgery or injury date, which graft was used, which knee, anything else that was repaired, your surgeon's instructions if you add them, whether you are seeing a physiotherapist, and which equipment you have. They are your record, for you and your physiotherapist; the app does not use them to change your programme.
• Your measurements: how far the knee bends, how far it is off straight, swelling grade, pain scores, and any clinical test results you enter.
• Your sessions: which exercises you were given each day, what you completed, and when.
• Your milestones and stage changes, including the date you recorded that your physiotherapist moved you on.
• Symptoms reported in an earlier version of the app, if you used one. The current version's warning-signs page records nothing.
• Your reminder preferences.

This is stored in the app's own private storage, which iOS keeps separate from other apps. It is included in your device backup (iCloud or a computer), so a restored phone keeps your recovery. That backup is governed by Apple's terms, not ours, and we have no access to it.

Nothing in the list above is transmitted anywhere. It is not synced, not analysed, not shared, and not sold. There is nothing to sell: we never receive it.

The measurements you record are health data, and under UK GDPR they are special-category personal data. The strongest protection we can offer is not to hold them, so that is what we have done. Because processing happens entirely on your own device and we never receive the data, we are not acting as a controller of it.

We are the controller for the crash reports and update checks described next.

Crash and error reports. When the app crashes or hits an unexpected error, it sends a report to Sentry so that we can fix it. A report contains:

• what went wrong, and where in the code it happened, as a stack trace;
• a short internal label naming the operation, for example local-read:profile;
• your device model, operating system version, and the app version;
• occasionally, timing data about how long a screen took to load. This is sampled: roughly one session in five.

A report does not contain your name, email, an account identifier (there isn't one), or any of your measurements. The app is configured with Sentry's personal-data collection switched off, which also means your IP address is not attached to the report. The error-reporting function is deliberately built to take only a short label rather than any data, so a measurement cannot be passed into it by accident.

We should be straight with you about the limit of that promise: no crash reporting can be guaranteed free of incidental technical detail. What we can say is that we do not send your health data, and that the app is written so it cannot.

• Lawful basis: our legitimate interest in keeping the app working.
• Processor: Sentry (Functional Software, Inc.), acting on our instructions under a data processing agreement.
• Retention: 90 days, then deleted.
• Where: in the European Economic Area. Our Sentry organisation is in Sentry's EU region, so reports are received and stored in Germany. That transfer from the UK is covered by the UK's adequacy regulations for the EEA.

Update checks. When Pivot opens, it asks Expo, the service we use to deliver updates to the app, whether a newer version of its content or code is available, and downloads it if there is one. That is how corrections reach your phone without a new App Store release. The request carries:

• the app's version, your phone's platform (iOS or Android), and which update it already has;
• a random identifier the update service creates for this installation, which is not linked to your name, email or anything you record;
• as with any connection over the internet, your phone's IP address.

It carries nothing you record, and no name, email or account. We do not receive the requests ourselves; Expo keeps routine server logs of them, including the IP address, for a limited time under its own policy.

• Lawful basis: our legitimate interest in keeping the app working and its content correct.
• Processor: Expo (650 Industries, Inc.), acting on our instructions.
• Where: Expo is based in the United States and is certified under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises as protecting personal data transferred to it.

Reminders are scheduled by your phone, locally. Pivot does not use push notifications, so there is no device token and nothing is sent to us or to Apple to deliver them. Reminder text deliberately never names an exercise or a dose, because a lock screen is visible to whoever is holding the phone.

There are none. No analytics SDK, no advertising identifier, no tracking, no third-party cookies, no profiling, and no automated decision-making about you.

We do not collect precise location, contacts, photos, or your health records from anywhere else. Pivot does not read Apple Health.

“Your data” in the app produces a one-page summary written for a physiotherapist, plus spreadsheets of everything you have recorded. That is the complete set. There is no other copy for us to send you. Because you already hold all of it, this is also how a right-of-access request is satisfied, and it takes about ten seconds.

When you share the summary or the files, they go by whichever route you choose (email, Messages, AirDrop, or a file saved to your phone), straight from your phone to the person you send them to. They do not pass through us, and we never see them. Once your physiotherapist or clinic has them, they hold them under their own data protection obligations, not ours. If you would rather not send health information by email, save it to your phone from the same share sheet and show it at your appointment instead.

“Erase everything” on the You tab removes all of it from your device permanently. There is no server copy, no backup we hold, and nobody to email: that button is the complete erasure. Deleting the app does the same.

We cannot delete your data for you, because we cannot reach it.

Under UK GDPR you have rights of access, rectification, erasure, restriction, objection and portability. For your recovery data these are all exercised directly in the app. You hold the only copy, so you can read it, correct it, export it and destroy it without asking us.

For crash reports, write to support@broadai.co.uk. Note that these carry no identifier, so we may be unable to locate reports as yours; if we cannot, we will tell you that rather than guess.

You can complain to the Information Commissioner's Office at ico.org.uk.

If you email us, for support or with “Send feedback” in the app, we receive your email address and what you write. We use them only to reply to you and to improve Pivot, and keep them only for as long as that takes; ask and we will delete them sooner. The feedback email the app prepares contains three questions and the app's version, and nothing else from the app: anything about your recovery is in it only if you write it there.

• Lawful basis: our legitimate interest in answering you and improving the app.

Pivot is for people aged 16 and over, and is not intended for anyone younger. If you are under 18, use it with your surgeon's or physiotherapist's agreement, and if you are still growing, follow the programme they give you. Nothing you record leaves your phone, whatever your age.

Pivot is bought once, through the App Store. Apple handles the payment; we never see your card details. What we receive from Apple is aggregate sales data, which does not identify you.

If this policy changes materially we will update the date above and, where the change affects what leaves your device, say so in the app. The version of the terms you accepted is recorded on your profile screen.