FramIQ Pro privacy policy

1. Who is responsible for what

Two distinct processing activities coexist in FramIQ Pro, and they do not have the same controller.

Your patients' data

The practitioner using FramIQ Pro is the data controller. They decide to open a record, collect consent, keep or erase it. FramIQ acts as a processor within the meaning of Article 28 GDPR: it processes this data on the practitioner's instructions, to provide the service, and for nothing else. FramIQ does not sell it, does not exploit it commercially, and does not use it to train models.

The practitioner's account

For account and practice data, FramIQ is the data controller.

2. Publisher

FramIQ, a brand of OBF Studio. Designed and developed by Gaspard Blanc, osteopath D.O. and bike fitter.
3 chemin du Néplé, 73420 Viviers-du-Lac, France.
hello@framiq.fr

3. Data processed

Practitioner account and practice

• practitioner identity and contact details, practice address
• ADELI or RPPS registration number, where provided
• IBAN and BIC, solely so they appear on the invoices the practitioner issues
• logo, custom legal mentions, services and rates of the practice
• email address, password stored as a hash, first-login and password-reset tokens

Patient data, entered by the practitioner

• identity: surname, first name, sex, date of birth
• contact details: email address, phone number
• health data: pain areas, prescribed exercises, practitioner's observations
• anthropometric measurements: inseam, torso, arm, sit-bone width, and other protocol measurements
• session data: joint angles computed from video (knee, hip, trunk, elbow), coordinates of the detected body landmarks, readings from Bluetooth sensors, bike settings and frame geometry
• invoicing: amounts, payment method and reference
• consent: date collected, version of the text accepted, integrity hash

4. What never leaves the device

The videos and photographs taken during the session stay on the practitioner's iPhone or iPad. They are not uploaded: the server accepts no files, only values. What is transmitted are the computed angles and the coordinates of the detected landmarks, not the images they came from.

The biomechanical computation itself runs entirely on the device. It depends on no server.

5. Hosting

The framiq.fr website is hosted by Infomaniak Network SA, rue Eugène-Marziano 25, 1227 Geneva, Switzerland.

The FramIQ Pro application programming interface and database are hosted by Railway Corp., a company incorporated in the United States, in its Amsterdam, Netherlands region. Data is therefore stored within the European Union and is not transferred to any third country. The host remaining a US company, it may be subject to US legal orders.

6. Legal basis

• Patient data: the data subject's consent, collected by the practitioner in the app before any entry, and performance of the contract between the practitioner and FramIQ for the processing part.
• Practitioner account: performance of the subscription contract.
• Technical and security logs: FramIQ's legitimate interest in operating and securing the service.

7. Retention

• Patient records: kept for as long as the practitioner keeps them. They may delete a record at any time, which erases it from the server. Setting their own retention period, in line with their professional obligations, is their responsibility.
• Practitioner account: kept for the duration of the subscription, then twelve months, before deletion.
• Invoices: ten years, under French accounting obligations.
• Report sharing links: the link expires on the date set when it was sent; the record is deleted after expiry.

8. Sharing a report with the patient

The practitioner may send their patient a link to their report. The link carries a random token, is issued to a named recipient, has an expiry date, and the date it is first opened is recorded. Anyone holding the link before it expires can view the report, so it should only ever be passed to the patient concerned.

9. Satisfaction survey

Where the practitioner enables it, a satisfaction questionnaire is sent to the patient after the session. It covers how they feel, how their pain has changed, and their view of the assessment. The response is attached to the session. A patient may ask to stop receiving these emails, and their address is then added to an exclusion list.

10. Recipients

Data is not passed to any third party for commercial purposes. The only parties involved, as processors acting for FramIQ, are:

• Railway Corp., hosting of the application programming interface and database
• Infomaniak Network SA, website hosting and email delivery
• Apple, app distribution and management of subscriptions purchased on the App Store

11. Security

• encrypted transport between the app and the server (HTTPS)
• practitioner authentication by token, held in the system keychain
• biometric app lock, which the practitioner can enable
• passwords stored as hashes, never in clear text
• consent sealed with an integrity hash, and an integrity journal on the server
• data partitioned per practitioner account

12. Your rights

Patients: rights of access, rectification, erasure, restriction, objection and portability, and withdrawal of consent at any time. These rights are exercised with the practitioner who saw you.

Practitioners: the same rights over your account data are exercised with FramIQ, at hello@framiq.fr.

You may lodge a complaint with the French data protection authority, cnil.fr.

13. Data breach

In the event of a personal data breach, FramIQ informs the practitioners concerned without undue delay, so that they can, as controllers, make the notification required by Articles 33 and 34 GDPR.

14. Changes

This document may change. The last updated date appears at the top of the page. Any substantial change is flagged to practitioners inside the app.

15. Contact

hello@framiq.fr

See also: FramIQ Pro · Legal notice (FR)