Privacy policy

Who we are

Handara is offered by [Company name] (eenmanszaak), registered with the Dutch Chamber of Commerce (KvK) under number [KvK number], at [Address], the Netherlands. In this policy, “we” means [Company name].

For questions about privacy, email [Contact email].

The short version

• The camera image is processed only inside the browser on the patient's own device. We never record, store or receive video or images.
• We know patients only by a code their therapist chooses (for example “Patient A12”), not by name or email address.
• We store exercise counts and timings, and the answers patients give after a session.
• We only use analytics cookies if you click “Allow”.

Camera and hand tracking

During a session, hand tracking runs on the patient's own laptop or tablet, inside the browser. The camera image never leaves the device. We do not record, store or send video, images or the raw positions of the hand. Only the results described below are sent to us.

What we store, and why

Patients (through their therapist or clinic):

• The patient code, the hand (left or right) and a condition tag, all chosen by the therapist.
• The prescription: exercises, reps, sets, hold and rest times, sessions per day and programme dates.
• Per session: start and end time, reps per exercise, how much of the session was completed, a movement value relative to the patient's own range (not a clinical measurement), pain and effort scores (0–10) and an optional note.
• Technical data: browser type and the average frame rate, so we can fix performance problems.
• If a therapist emails the session link to a patient, we use that email address once to send it. We do not store it.

Purpose: to let the therapist see whether the prescribed exercises were done. The therapist or clinic decides why and how this data is used and is the controller. We process it on their behalf, under a data processing agreement. Because pain and effort scores can be health data, the controller is responsible for the legal basis; we only process it on their instructions.

Therapists: name, clinic name, country and work email; login data (a one-time login link, no password); and feedback you give us. Purpose: to run your account and improve Handara. Legal basis: performance of our agreement with you (art. 6(1)(b) GDPR) and our legitimate interest in improving the product (art. 6(1)(f) GDPR).

Demo requests: your name, work email, clinic and country, and if you give them, your role, number of patients per month, phone number and best time to call. Waitlist: your email address, and if you give them, your hand condition and country. For both we also store the language of the page and the campaign tags (utm) of the link you used. Purpose: to contact you about a demo, or to tell you when Handara is available. Legal basis: your consent (art. 6(1)(a) GDPR). Sharing your hand condition is optional; if you do, you give explicit consent for us to use it for this purpose (art. 9(2)(a) GDPR). You can withdraw consent at any time.

Website analytics: see “Cookies and analytics” below.

Cookies and analytics

We use essential cookies so the site works, for example to remember your language and to keep therapists logged in. We use PostHog (EU cloud) to count visits. Until you click “Allow”, PostHog runs without cookies and without storing anything on your device; it still receives your IP address to count the visit. If you click “Allow”, PostHog may store an identifier in your browser so we can see how visitors move through the site. Legal basis: your consent for analytics cookies; our legitimate interest for counting visits without cookies. Session recordings are switched off. Read more on our cookie page.

Who processes data for us

We use these processors. Each has a data processing agreement with us:

• Supabase — database and therapist login. Data is stored in the EU (Frankfurt, Germany).
• Vercel — hosting of the website and app. Some processing may happen outside the EU; transfers are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
• PostHog — website analytics, EU cloud.
• Zepto Mail (Zoho) — sending emails such as login links and confirmations, EU data centre.

We do not sell personal data, and we do not share it for advertising.

How long we keep data

• Session data and reps: deleted automatically 12 months after the programme ends.
• Therapist accounts: for as long as the account is active, and deleted within 3 months after it is closed.
• Demo requests and waitlist entries: 24 months after our last contact with you, or sooner if you ask.
• Analytics data: up to 12 months.

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time. Email [Contact email]. We answer within one month.

Patients: we only know you as a code, so we usually cannot tell which data is yours. Please ask your therapist; they can view, export or delete your data, or contact us on your behalf.

You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Security

All traffic is encrypted (HTTPS). Data is encrypted at rest. Each therapist can only see their own patients. Session links are long random codes that the therapist can revoke at any time. No video is ever stored, so it cannot leak.

Changes to this policy

If we change this policy, we update the date at the top. If the change matters for you, we will tell you by email or in the app before it applies.