Privacy Policy

Everything you record stays on your phone. There is no account, no sign-in, and no server holding your recovery. We cannot see your measurements, we cannot email them to you, and we could not hand them to anyone else if we were asked, because we do not have them.

The only data that leaves your device is a crash report when the app breaks, and that is described in full below.

Pivot stores the following on your device, and only on your device:

• Your recovery details — surgery date, which graft was used, which knee, anything else that was repaired, whether you are seeing a physiotherapist, and which equipment you have.
• Your measurements — how far the knee bends, how far it is off straight, swelling grade, pain scores, and any clinical test results you enter.
• Your sessions — which exercises you were given each day, what you completed, and when.
• Your milestones and phase changes, including the date you recorded your physiotherapist's clearance.
• Symptoms you report through the “something doesn't feel right” screen, and which advice you were shown.
• Your reminder preferences.

This is stored in the app's own private storage, which iOS keeps separate from other apps. It is included in your device backup (iCloud or a computer), so a restored phone keeps your recovery — that backup is governed by Apple's terms, not ours, and we have no access to it.

Nothing in the list above is transmitted anywhere. It is not synced, not analysed, not shared, and not sold. There is nothing to sell: we never receive it.

The measurements you record are health data, and under UK GDPR they are special-category personal data. The strongest protection we can offer is not to hold them, so that is what we have done. Because processing happens entirely on your own device and we never receive the data, we are not acting as a controller of it.

We are the controller for the crash reports described next.

Crash and error reports. When the app crashes or hits an unexpected error, it sends a report to Sentry so that we can fix it. A report contains:

• what went wrong, and where in the code it happened, as a stack trace;
• a short internal label naming the operation — for example local-read:profile;
• your device model, operating system version, and the app version;
• occasionally, timing data about how long a screen took to load. This is sampled: roughly one session in five.

A report does not contain your name, email, an account identifier (there isn't one), or any of your measurements. The app is configured with Sentry's personal-data collection switched off, which also means your IP address is not attached to the report. The error-reporting function is deliberately built to take only a short label rather than any data, so a measurement cannot be passed into it by accident.

We should be straight with you about the limit of that promise: no crash reporting can be guaranteed free of incidental technical detail. What we can say is that we do not send your health data, and that the app is written so it cannot.

• Lawful basis: our legitimate interest in keeping the app working.
• Processor: Sentry (Functional Software, Inc.), acting on our instructions under a data processing agreement.
• Retention: 90 days, then deleted.
• Where: Sentry may process reports outside the UK. Where it does, the transfer is made under the UK's adequacy regulations for the EEA or, where those do not apply, the International Data Transfer Addendum to the European Commission's standard contractual clauses, which forms part of Sentry's data processing agreement.

Reminders are scheduled by your phone, locally. Pivot does not use push notifications, so there is no device token and nothing is sent to us or to Apple to deliver them. Reminder text deliberately never names an exercise or a dose, because a lock screen is visible to whoever is holding the phone.

There are none. No analytics SDK, no advertising identifier, no tracking, no third-party cookies, no profiling, and no automated decision-making about you.

We do not collect precise location, contacts, photos, or your health records from anywhere else. Pivot does not read Apple Health.

“Your data” in the app produces a one-page summary written for a physiotherapist, plus spreadsheets of everything you have recorded. That is the complete set — there is no other copy for us to send you. Because you already hold all of it, this is also how a right-of-access request is satisfied, and it takes about ten seconds.

“Erase everything” on the You tab removes all of it from your device permanently. There is no server copy, no backup we hold, and nobody to email: that button is the complete erasure. Deleting the app does the same.

We cannot delete your data for you, because we cannot reach it.

Under UK GDPR you have rights of access, rectification, erasure, restriction, objection and portability. For your recovery data these are all exercised directly in the app — you hold the only copy, so you can read it, correct it, export it and destroy it without asking us.

For crash reports, write to support@broadai.co.uk. Note that these carry no identifier, so we may be unable to locate reports as yours; if we cannot, we will tell you that rather than guess.

You can complain to the Information Commissioner's Office at ico.org.uk.

Pivot is not intended for children under 13. It is not designed for paediatric ACL rehabilitation, which follows a different protocol — if you are under 18, follow the programme your own clinician gives you.

Pivot is bought once, through the App Store. Apple handles the payment; we never see your card details. What we receive from Apple is aggregate sales data, which does not identify you.

If this policy changes materially we will update the date above and, where the change affects what leaves your device, say so in the app. The version of the terms you accepted is recorded on your profile screen.