Privacy Policy

Last updated: October 18, 2026

1. Introduction

This Privacy Policy describes how HILNA collects, uses, stores, and protects personal information when you use our platform.

In this policy, "HILNA," "we," "us," and "our" refer to the HILNA platform and its operators. "You" refers to clinicians (physiotherapists, chiropractors, osteopaths, and other rehabilitation professionals) who use the HILNA mobile app and web portal. "Patients" refers to individuals whose information clinicians enter into HILNA.

2. Information We Collect

2a. Clinician Information (collected directly from you)

• Account information: name, email address, password (hashed using bcrypt — never stored in plain text)
• Professional profile: professional title, registration number, phone number, bio, social media links, profile photo
• Clinic information: clinic name, address, phone number, email, logo, brand colours
• Content: exercise programs, clinical notes, video recordings, exercise templates, document attachments
• Billing information: managed entirely by Stripe (see Third-Party Services below). HILNA stores your billing email address and Stripe customer ID, but we never see or store your credit card number, expiry date, or CVC.

2b. Patient Information

• Patient details: name, email address, phone number — entered by the treating clinician, not by patients directly
• Exercise program content assigned to the patient
• Progress updates submitted by patients through the patient portal, including pain levels, difficulty ratings, and written notes
• Patient authentication: one-time email verification codes (OTPs) for portal access. No patient passwords or persistent accounts are created.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the HILNA service
• To deliver exercise programs to patients via email and the patient portal
• To send exercise reminder emails to patients (configurable by clinicians)
• To show clinicians the progress updates their patients submit
• To generate AI-assisted exercise programs from the clinical notes you provide (see the AI and Your Data section below)
• To process subscription payments through Stripe
• To communicate with you about your account, service updates, and support requests

4. Third-Party Services

HILNA uses the following third-party services to operate the platform. Each service receives only the data necessary to perform its function:

• Supabase (database and clinician authentication) — stores the application database, including clinician profiles, patient records, exercise programs, and authentication credentials. Hosted on Amazon Web Services (AWS) in the United States. Supabase Privacy Policy
• Cloudflare (video and file storage via R2, website hosting via Workers, CDN) — stores exercise videos, file attachments, and public assets (clinic logos, clinician avatars). Also hosts the patient portal, web app, and landing page. Global CDN, with file storage in the United States or Canada. Cloudflare Privacy Policy
• Stripe (payment processing) — receives clinician billing email and processes subscription payments. Stripe handles PCI compliance — HILNA never receives or stores credit card numbers. Stripe Privacy Policy
• Anthropic (AI program generation via Claude) — receives the clinical notes a clinician types for AI generation, as written, with exercise names and descriptions. Names, email addresses and phone numbers from patient records are not sent, but anything typed into the notes is. Anthropic Privacy Policy
• Resend (transactional email) — receives patient and clinician email addresses for the purpose of delivering exercise programs, OTP verification codes, exercise reminders, and account notices such as deletion confirmations. Resend Privacy Policy
• Expo / EAS (mobile app distribution and updates) — builds and distributes the mobile application and delivers its updates. Installed apps send Expo a random installation identifier when checking for updates and, after an app crash, a short technical error report. These are not intended to contain patient information. Expo Privacy Policy
• YouTube / Google (embedded exercise video playback) — part of the exercise library consists of videos published on YouTube by third-party physiotherapy creators, played inside HILNA using YouTube's embedded player. When you watch one of these videos, YouTube and Google may receive your IP address, device identifiers, and viewing activity, and may set cookies, in accordance with Google's policies. HILNA does not control the data YouTube collects through its embedded player. Google Privacy Policy
• Railway (application hosting) - runs the HILNA application server, which processes data on its way between your device and the services above. Railway Privacy Policy

5. AI and Your Data

HILNA uses AI to generate exercise programs from clinical notes you provide. The notes are sent as you typed them. HILNA does not add a patient's name, email address or phone number from their record, and does not remove identifying details you type, so please leave them out.

AI-generated content is a clinical suggestion and must be reviewed and approved by the clinician before being prescribed to patients.

HILNA does not use your data to train AI models. Anthropic's data processing terms for API customers prohibit the use of API inputs and outputs for model training.

6. Data Storage and Security

We take the security of your data seriously. The following measures are in place:

• Server location: our database is stored in the United States (Supabase on AWS), and files and videos in the United States or Canada (Cloudflare R2).
• Encryption in transit: all data is encrypted using TLS/HTTPS for every connection between your device and our servers.
• Video security: videos you record or upload are served via signed URLs that expire after one hour. Library videos from YouTube play through YouTube's embedded player.
• Clinician authentication: secure email/password authentication with hashed passwords and session tokens.
• Patient portal authentication: one-time email verification codes with 7-day sliding session windows. No passwords are stored for patients.

7. Data Retention

Your data is retained for as long as your account is active, except our detailed log of AI program generation runs, which is cleared after 10 days.

Account deletion: when you delete your account, your login, your profile, your private exercises, exercise templates and library programs (with their videos), and your clinic if you are its only member are permanently removed. Programs you created for patients are kept, together with each patient's record, attachments and progress updates. Your patients can keep opening them until their current link expires, at most 90 days after you last sent them. After that, they cannot be resent. They are no longer linked to you, and their reminder emails are switched off. Exercises and programs you shared with your clinic or the HILNA community also stay available. Exercise videos stored on Cloudflare R2 are deleted when nothing that is kept still uses them. The full list is on our Delete your account page. Deletion takes effect 30 days after your request. Until then your account is on hold, and you can restore it by emailing hello@hilna.app.

Lapsed subscription: if your subscription lapses (account frozen), your data is preserved, except the AI generation log described above. You can reactivate at any time by subscribing, or delete your account as described above.

8. Cookies and Local Storage

• The HILNA mobile app stores authentication tokens locally on your device.
• The patient portal (patient.hilna.app) stores authentication tokens and exercise completion progress in browser localStorage.
• The web portal (my.hilna.app) stores authentication tokens in browser localStorage.

HILNA does not use advertising cookies, tracking pixels, or its own analytics scripts. However, exercise videos sourced from YouTube are shown via YouTube's embedded player, which may set its own cookies and collect viewing data, as described in "Third-Party Services" above.

9. Your Rights Under PIPEDA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights regarding your personal information:

• Access: you can request a copy of the personal information we hold about you.
• Correction: you can request correction of inaccurate or incomplete personal information.
• Deletion: you can delete your account at any time from the mobile app or web portal, or by contacting us. This permanently removes your account data, except the patient programs and shared content described under Data Retention. See Delete your account.
• Withdrawal of consent: you can stop using HILNA at any time. Deleting your account removes your account data from our systems, except as described under Data Retention.

To exercise any of these rights, contact us at hello@hilna.app.

10. International Users

HILNA is operated from Canada, and data is processed and stored in the United States, with files and videos stored in the United States or Canada. By using HILNA, you consent to the transfer and processing of your information in the United States and Canada.

If you are located in a jurisdiction with data protection laws (such as the EU/UK GDPR), please be aware that using HILNA involves transferring your data to the United States, which may not offer the same level of data protection as your home jurisdiction.

11. Children

HILNA is a professional tool for healthcare providers. The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

Clinicians who treat patients under 18 are responsible for obtaining appropriate parental or guardian consent before entering minor patients' information into HILNA, as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email at the address associated with your account.

The "Last updated" date at the top of this page indicates the most recent revision.

13. Contact

If you have questions about this Privacy Policy or would like to exercise your data rights, please contact us at hello@hilna.app.