Privacy Policy

This Privacy Policy explains how KOVERNA Ltd ("we", "us", "our") collects, uses and protects personal data in connection with the Koverna software platform (the "Service").

This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

KOVERNA Ltd as a controller: KOVERNA Ltd acts as a data controller for the personal data it collects and processes for its own purposes, such as account administration, billing, service delivery, communication and security.

KOVERNA Ltd as a processor: When a Customer (a practice, clinic, club or clinician) enters patient or athlete data into the Service, the Customer is the data controller for that data and KOVERNA Ltd acts as a processor on the Customer's behalf. The Customer determines why and how patient or athlete data is used; KOVERNA Ltd processes it only in accordance with the Customer's instructions through the Service.

This means that if you are a patient or athlete whose data has been entered into Koverna by your physiotherapist, clinic or club, your data controller is that organisation — not Koverna. You should contact them directly to exercise your data protection rights regarding your clinical records. Koverna can assist your controller in responding to your request.

Account and contact data: name, email address, password (hashed), role, organisation details.

Organisation data: practice or club name, address, phone, website, branding, settings.

Billing data: subscription plan, payment method (processed by Stripe — we do not store full card details), billing address, invoices.

Usage and technical data: IP address, browser type, access logs, feature usage, error reports.

Patient and athlete data (processed as a processor on behalf of Customers): name, date of birth, contact details, medical history, clinical notes, injury information, rehabilitation data, appointment records, exercise programmes, clinical documents and communications.

Communications data: emails sent through the Service (to patients, athletes or staff), email delivery logs and audit records.

We process personal data for the following purposes:

• Providing the Service — Legal basis: performance of a contract (UK GDPR Art. 6(1)(b)).
• Account administration and security — Legal basis: legitimate interests (UK GDPR Art. 6(1)(f)).
• Billing and subscription management — Legal basis: performance of a contract (UK GDPR Art. 6(1)(b)).
• Customer support and communication — Legal basis: legitimate interests (UK GDPR Art. 6(1)(f)).
• Service improvement and analytics — Legal basis: legitimate interests (UK GDPR Art. 6(1)(f)), subject to consent where required.
• Legal compliance — Legal basis: legal obligation (UK GDPR Art. 6(1)(c)).

Patient and athlete data entered by Customers is processed on the lawful basis determined by the Customer (the data controller). Koverna processes this data as a processor under the Customer's instructions.

The Service may process special category health data (including clinical notes, injury information and rehabilitation data) entered by Customers. This data is processed by Koverna as a processor on behalf of the Customer.

The Customer is responsible for ensuring that an appropriate condition for processing special category data under UK GDPR Art. 9 is satisfied (for example, explicit consent, or processing for the provision of health or social care under Art. 9(2)(h)).

Koverna applies appropriate technical and organisational measures to protect special category data, including access controls, encryption in transit and role-based permissions.

Koverna uses the following subprocessors to deliver the Service:

• Base44 — hosting, database and infrastructure. Data stored: all Service data.
• Stripe — payment processing. Data stored: billing and payment information. Stripe processes card data under its own PCI-DSS compliance.
• Resend — email delivery. Data stored: email content and delivery metadata for emails sent through the Service.
• Google — optional OAuth sign-in. Data accessed: email address and basic profile for authentication.

We do not sell personal data to third parties. We share data with these subprocessors only as necessary to provide the Service, and under appropriate data processing arrangements.

Some of our subprocessors may process data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTAs) or Addenda to EU Standard Contractual Clauses.

We retain personal data for as long as necessary to provide the Service and to comply with legal and regulatory obligations. After a Customer cancels or deletes their account, data is retained for a limited period to allow for reactivation and to meet any legal retention requirements, after which it is permanently deleted.

Clinical records may be subject to professional or regulatory retention requirements. Customers are responsible for understanding and complying with any retention obligations applicable to their profession (for example, health professional record-keeping requirements).

You may request deletion of your personal data, subject to any legal retention requirements. See section 10 for your rights.

We take reasonable measures to protect personal data, including:

• Role-based access controls — users only see data appropriate to their role.
• Encryption of data in transit (TLS/HTTPS).
• Regular backups managed by our hosting provider.
• Authentication and session management.
• Audit logging of key actions within the Service.

No system can be guaranteed to be completely secure. In the event of a personal data breach affecting your rights, we will take appropriate action in accordance with UK GDPR requirements (see section 12).

Under UK GDPR, you have the right to:

• Be informed about how your data is used (this policy).
• Access your personal data.
• Rectify inaccurate personal data.
• Erasure of your personal data in certain circumstances.
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time (where processing is based on consent).

If your data has been entered into Koverna by your physiotherapist, clinic or club, you should contact them directly to exercise these rights, as they are the data controller for your clinical records. Koverna will assist them in responding to your request.

To exercise rights regarding data Koverna holds as a controller (such as your account or billing data), contact us at hello@koverna.co.uk.

We use a limited number of cookies and similar technologies on our website. See our separate Cookie Policy for details of the cookies we use and how to manage your preferences.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR. We will also notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

If you have a concern about how we handle your personal data, please contact us first and we will investigate. You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Telephone: 0303 123 1113
Website: ico.org.uk

We may update this Privacy Policy from time to time. We will notify Customers of material changes by email or through the Service. The last-updated date at the top of this page indicates when it was last revised.

For any questions about this Privacy Policy or to exercise your data protection rights, contact us at hello@koverna.co.uk.