Physo ("Physo", "we", "us") · Effective 11 August 2026 · Last updated 17 August 2026
Physo is a practice-management and teleconsultation platform for physiotherapists and the patients they care for, available at physo-health.com. This policy explains what we collect, why, and the choices you have. We keep it in plain language on purpose.
Account information. Physiotherapists: name, email address, profile photo, qualifications, registration number, clinic details, availability, services and rates, UPI ID, Instagram/website handles. Patients: name, phone number, a 6-digit PIN (stored only as a salted credential, never in plain text), optional profile photo, age and gender.
Care records. Appointment details, session notes, treatment and management plans, exercise prescriptions, exercise adherence self-reports and pain scores, range-of-motion and outcome measurements, prescriptions, bills, chat messages (including progress photos either side attaches), ratings, and payment screenshots that patients attach to booking requests. These records are created by the physiotherapist or patient in the course of care.
Verification documents. Physiotherapists may upload their degree, certificates and a government identity document (Aadhaar/UID) to earn a verified badge. Identity images are reviewed by our team and permanently deleted from our servers immediately after review. We retain only the verification outcome.
Technical data. Standard server logs (IP address, timestamps, requested pages) kept briefly for security and debugging. We do not run third-party advertising or analytics trackers.
If a physiotherapist chooses to connect Google Calendar, we request the
calendar.events scope and use it for exactly two things:
Limited Use disclosure. Physo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your explicit consent, for security purposes, or to comply with law.
You can disconnect Google Calendar at any time in Settings, and additionally revoke Physo's access at myaccount.google.com/permissions. Disconnecting deletes the stored refresh token.
We do not sell personal data. We do not use your data for advertising. Care records are visible only to the physiotherapist who created them and the patient they belong to.
Each processor receives only what it needs to perform its function.
For care records, the physiotherapist acts as the data controller of their own practice's records and Physo acts as a processor providing the tools. Physiotherapists are responsible for meeting their professional obligations regarding patient records. For account data, Physo is the controller.
Grievance Officer: Debanshu Roy · [email protected] — grievances are acknowledged within 48 hours and resolved within 30 days.
Breach response: in the event of a personal-data breach we will notify the Data Protection Board of India and affected users without delay, with a description of the breach, its likely impact, and the measures taken.
All traffic is encrypted (HTTPS). Data access is scoped per account with row-level security. Secrets and API keys are held server-side only. Video calls require a profile photo on both sides and display a professional-conduct notice.
Physo is not an emergency or urgent-care service. If you experience a medical emergency — severe pain, a suspected fracture, loss of sensation, or an injury — call your local emergency number 112 or go to the nearest hospital.
Physo is intended for adults. Minors may be registered as patients only by their physiotherapist in the course of care, with consent obtained by the physiotherapist as required by law.
We will post any changes to this policy on this page and update the date at the top. Material changes will be announced in the app.
Physo · [email protected] · physo-health.com