Version: 2026-10-15.1 Effective date: 15 October 2026 Operator: Auraflex Intelligent Healthcare Services Private Limited (CIN U85500MR2026PTC474713), A-104, Surya Park, Opp. Nageshwar Shiv Mandir, Neral, Karjat, Raigad, Maharashtra 410101, India ("PhysioAI", "we", "us").
This notice explains how Case Worker handles information about your patients. How PhysioAI handles your own account data (your name, email, payments and app usage) is covered by the PhysioAI Privacy Policy. This notice forms part of the Case Worker Terms of Use.
Each section has a short "What this means for you" note in plain English. If a note and the text differ, the text applies.
1. Who is responsible for what
1.1 You are the data fiduciary for your patients' data. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), you decide why and how your patients' personal data is processed when you choose to enter it into Case Worker. That makes you the data fiduciary (often called the "controller" outside India) for that data, and your patient is the data principal.
1.2 PhysioAI is your data processor. PhysioAI processes patient data in Case Worker only on your behalf and on your instructions, which are given by how you use Case Worker, in order to produce the workup and documents you ask for and to keep the service running safely. This notice, together with the Terms, is our written agreement with you as your processor under section 8(2) of the DPDP Act.
1.3 Where PhysioAI acts for itself. PhysioAI is a data fiduciary in its own right for (a) your account and usage data, under the PhysioAI Privacy Policy, and (b) de-identified or aggregated information described in section 6.3.
1.4 Outside India. If you practise in another country, the equivalent roles apply under your local law (for example, you are the "controller" and PhysioAI the "processor" under the EU/UK GDPR). You are responsible for any extra local requirements.
What this means for you: In law, your patients' data is your responsibility. PhysioAI handles it for you, only to run Case Worker.
2. What patient information Case Worker processes
| Category | Examples | Sent to AI providers? |
|---|---|---|
| Basic profile | Age group (e.g. "30–39"), sex | Yes |
| Presenting problem | Body region, side, onset, duration, mechanism, pain score, irritability, symptoms, aggravating and easing factors, sleep, activity level | Yes |
| History | Past medical history, comorbidities, previous episodes | Yes |
| Medications | Medicines the patient takes | Yes |
| Examination findings | Range of movement, special-test results (250+ tests), notes on findings | Yes |
| Red-flag answers | Answers to region-specific safety questions | Yes |
| Case history | Earlier versions of the same case and follow-up updates | Yes |
| Synergist chat | Questions you ask about the case in Synergist chat | Yes |
| Patient name and patient reference | Name and your own reference/ID for the patient | No. Stored only to fill in your generated documents |
| Case label | Your private label for the case (e.g. "Mon clinic, knee") | No. Stored only to help you find the case |
| Generated outputs | Workup, SOAP note, draft documents, your edits | Generated by AI; stored in your account |
2.1 Names stay out of the AI. The patient's name and reference are kept in your account and inserted into documents on your device or our servers after the AI has written them. The AI only ever sees a placeholder. They are never sent to an AI model provider.
2.2 Free text is the exception you control. Anything you type into clinical fields and notes is sent to the AI. If you type a name, phone number, address, date of birth, ID number (such as Aadhaar or ABHA), employer or other identifier into those fields, it will be processed like the rest of the clinical details. Don't do this (see section 4).
2.3 Age group, not date of birth. Case Worker asks for an age group rather than an exact date of birth, to reduce identifiability.
What this means for you: The AI sees the clinical picture, not who the patient is, as long as you keep names and ID numbers out of the clinical boxes.
3. Why we process it
We process patient data in Case Worker only to:
- (a) generate the workup, safety screen, differential, plans, SOAP note and evidence summary you ask for;
- (b) draft, store, edit, render and export the documents you request on your letterhead;
- (c) keep the history of the case so that follow-up versions and progress documents make sense;
- (d) keep Case Worker secure, prevent misuse, enforce usage limits, and investigate errors and safety problems you report; and
- (e) meet legal obligations.
We do not sell patient data, use it for advertising, or contact your patients.
What this means for you: Patient data is used to do the job you asked for and for nothing else.
4. Your responsibilities as data fiduciary
4.1 Lawful basis and consent. Before you enter a patient's information, make sure you have a lawful basis to do so. Under the DPDP Act this will usually be the patient's consent, which must be free, specific, informed and unambiguous, given after a clear notice (sections 5 and 6 of the DPDP Act). We recommend that you:
- tell the patient that you use an AI-assisted clinical support tool, which processes their clinical details through service providers that may be outside India, and that their name is not shared with the AI;
- record their consent in your clinical notes or on your intake/consent form; and
- respect a patient who says no. You can still treat them without using Case Worker.
Case Worker can draft a consent form for you to adapt. You are responsible for its final wording.
4.2 Children. For patients under 18, the DPDP Act requires verifiable consent from a parent or lawful guardian (section 9). You are responsible for getting it.
4.3 Minimise identifiers. Enter only what is clinically needed. Keep names, contact details, ID numbers, photos and other direct identifiers out of the clinical fields, notes and case label. Use the dedicated patient name/reference fields on the Documents tab, which are never sent to the AI.
4.4 Patients' rights. Your patients may ask you to access, correct or erase their data, to withdraw consent, or to raise a grievance (sections 11 to 13 of the DPDP Act). You handle those requests. We will help you on request (see section 8). If a patient contacts PhysioAI directly, we will pass the request to you where we can identify you, and we will not respond to the patient on the substance without your instruction, unless the law requires us to.
4.5 Your own records. Case Worker is not your official clinical record system. You remain responsible for keeping clinical records as your professional rules require.
4.6 Local law. If you practise outside India, you are responsible for meeting your local health-data rules before entering patient data.
What this means for you: Tell your patients, get their consent (a parent's for under-18s), keep names out of the clinical boxes, and handle patient requests about their data.
5. Who we share it with (our sub-processors)
We use the following service providers to run Case Worker. They process data only to provide their service to us.
| Provider | What it does | What it receives | Location |
|---|---|---|---|
| Supabase, Inc. | Database, file storage, authentication and server functions | All Case Worker data in your account, including patient name/reference and documents | Australia (Sydney) |
| Anthropic, PBC (Claude AI models) | Generates the workup, documents and chat answers | The clinical details in section 2 (no name, reference or case label) | United States |
| TypeSafe AI ("Jev" decision model) | Scores how well each suggested condition fits the reported findings and research | A structured case summary (age group, sex, region, symptoms, history, medications, exam findings) and the suggested conditions (no name, reference or case label) | Outside India |
| US National Library of Medicine / NCBI (PubMed) and public trial registries | Searching published research | Search terms generated from the case (such as condition and test names). No patient profile is intended to be sent | United States |
5.1 We will tell you in the app or on this page before we add or replace a sub-processor that receives patient data. We will give at least 15 days' notice. If you object, you may stop using Case Worker.
5.2 No training on patient data. We do not use patient data from Case Worker to train AI models, and our agreements with AI model providers do not permit them to train their models on it. Providers may keep data for a limited time for abuse monitoring or as required by law, under their own terms.
5.3 We may disclose data if the law, a court or a regulator requires it. Where we lawfully can, we will tell you first.
What this means for you: A small number of named technology providers handle the data so that Case Worker can work. None of them get the patient's name, and none may use the data to train their AI.
6. Retention and deletion
6.1 While your account is active, we keep your cases, versions, documents, letterhead and patient name/reference so that you can return to them.
6.2 When you delete your PhysioAI account, all of your Case Worker cases, versions and documents are deleted from our live database. Copies in backups are overwritten within 30 days.
6.3 Deleting a single case. Email support@physioai.in with the case and we will delete it within 30 days. When a patient withdraws consent or asks for erasure, you should delete their case.
6.4 De-identified data. We may keep anonymous usage statistics (for example how many workups were run, how long they took, and which features or document types were used) that do not contain clinical details and cannot identify a patient.
6.5 Inactive accounts. After 24 months of inactivity we will notify you and then delete your Case Worker data. We will also delete patient data when it is no longer needed for the purpose, as section 8(7) of the DPDP Act requires, unless the law requires us to keep it.
What this means for you: Your cases stay until you delete them or your account. Deleting your account deletes all of them.
7. Security
7.1 We use reasonable security safeguards, including encryption in transit (TLS) and at rest, row-level access controls so that only your account can read your cases, restricted staff access, and separation of patient names from the data sent to AI providers.
7.2 No system is completely secure, and we cannot guarantee that data will never be accessed without authorisation.
7.3 Your part. Keep your device and password secure, don't share your account, and use a device lock. You are responsible for documents once you download, print or share them.
7.4 Breaches. If we become aware of a personal data breach that affects patient data in your account, we will tell you without undue delay and within 48 hours, give you the information we have, and help you meet your duty to notify the Data Protection Board of India and affected patients.
What this means for you: We protect the data with standard safeguards and will tell you quickly if something goes wrong. Once a document leaves the app, it's in your hands.
8. Our commitments as your processor
As your processor, PhysioAI will:
- (a) process patient data only to provide Case Worker as described in this notice, or as the law requires;
- (b) ensure that our staff and contractors with access are bound by confidentiality;
- (c) keep reasonable security safeguards and require the same of our sub-processors;
- (d) help you, as far as reasonably possible, to respond to patients' rights requests and grievances;
- (e) notify you of breaches as set out in section 7.4;
- (f) delete patient data as set out in section 6; and
- (g) give you information reasonably needed to show compliance with the DPDP Act.
9. International transfers
9.1 Some of our providers process data outside India, including in Australia and the United States (see section 5). The DPDP Act allows transfers outside India except to countries that the Government of India restricts by notification (section 16).
9.2 If you practise outside India, your patients' data may be processed in India, Australia and the United States. Where your local law requires transfer safeguards (for example standard contractual clauses under the GDPR), contact support@physioai.in before using Case Worker for those patients.
What this means for you: Clinical details (without names) may be processed in the US by our AI providers. Let your patients know.
10. Legal background
- The DPDP Act and the Digital Personal Data Protection Rules, 2025 are being brought into force in phases. Until they are fully in force, the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 may also apply. Health and medical records are "sensitive personal data" under those Rules.
- Professional confidentiality duties under your registering council's code of ethics apply in addition to data protection law.
11. Changes to this notice
We will update this notice when our processing or providers change. For material changes we will notify you in the app and ask you to accept again before you continue using Case Worker.
12. Contact
Privacy questions and requests: support@physioai.in Grievance Officer: Grievance Officer, PhysioAI, support@physioai.in (subject line "Grievance"), at the registered office address below. Post: Auraflex Intelligent Healthcare Services Private Limited, A-104, Surya Park, Opp. Nageshwar Shiv Mandir, Neral, Karjat, Raigad, Maharashtra 410101, India
Patients with questions about their data should contact their physiotherapist first.