The data controller is Dr Andrea Mistrazzoso, OMPT and MTA physiotherapist, registered with the Rome Register of Physiotherapists no. 10211 (TSRM-PSTRP Order), VAT no. 02096120858, with a clinic at Viale del Ciclismo 10, 00144 Rome, Italy.

For anything about your data, you can write to andreamistrazzoso@gmail.com.

Kinetica lets you log your workouts and follow your progress, and anyone can use it. Patients of the clinic also find their therapy with the clinic in it: that is why, after this part, there is a second one for patients.

• Account. Your email address, your name if you choose to give it, your password (stored only in encrypted, non-reversible form) or the identifier you sign in with through Apple or Google. From Apple and Google we only receive your email and, if you share it, your name.
• Workouts. Exercises, sets, reps, weights, times, rest periods, notes, the routines you create and the goals you set yourself.
• Social. Your username, which you choose (for accounts opened before 1 October 2026 it starts as the part of your email before the @, and you can change it whenever you like), your profile photo if you add one, who you follow and who follows you, likes, comments, blocks and reports.
• Health data, optional. The pain (from 0 to 10) and range of motion (ROM) you log on your sets, body measurements, progress photos, the heart rate measured by the Apple Watch during workouts, the Apple Watch sensor data of the sets you measure (below), and weight, steps, walking distance and sleep if you connect the Health app or Health Connect. These are data concerning health (Art. 9 GDPR): we only handle them if you enter or measure them, and with your explicit consent.
• Walks and runs, optional. If you measure them with your phone, between Start and Stop: steps, distance, elevation, cadence and, if you allow location access, the GPS route. Your location is recorded only while the walk is in progress, and the route is saved with the workout.
• Workout photos and videos, optional. Only the ones you choose to upload, including the sound of videos.
• Sets measured with the Apple Watch, optional. If you measure a set with the Apple Watch: the wrist sensor data (acceleration and rotation) from the start to the end of the set, the movement trace derived from it and, for each rep, velocity and range. They are saved with the workout. To measure better, the watch calibrates itself while your wrist is still: the calibration stays on the watch.
• Movement analysis. Camera images are processed on your phone and never leave it: only the measured angles are saved. No facial biometric data is collected and no one is recognised.
• Technical data. The code used to send you notifications, the app language, and what is needed to run and protect the service, such as sign-in attempts.

• To run the app and your account: Art. 6(1)(b) GDPR (performance of the service you ask for).
• For health data: Art. 9(2)(a) GDPR (explicit consent). You give it with a separate tick box, apart from accepting this policy and the terms. It is necessary to use the app, whose purpose is precisely to log workouts, pain and measurements; each piece of data remains optional. You can withdraw it at any time by deleting your account (Settings > Data), which also deletes this data; withdrawal does not affect processing carried out before. Without withdrawing it, you can also stop entering such data, for example by turning off the pain column in the workout settings.
• To protect the service from abuse: Art. 6(1)(f) GDPR (legitimate interest).
• For the social features, which are part of the app: Art. 6(1)(b) GDPR (performance of the service). You decide who sees what, as explained below.

We never sell your data and never use it for advertising or commercial profiling. The app has no advertising cookies or trackers. We make no decisions about you based solely on automated processing and do no profiling (Art. 22 GDPR): the app’s calculations, such as rep counting or comparisons with previous sessions, only serve to show you your own data.

The physiotherapist, who is the app's data controller, sees what you record even if you are not a patient of the clinic, as he does for his patients: the name you gave when signing up, your username, your workouts in detail, pain and range of motion, measurements, photos, videos, goals and your answers about how you feel. He uses this to know how the app is used, to improve it and to be able to offer to follow you. He does not see the private notes you write for yourself. The legal basis is the one in section 4: for health data, the explicit consent you give with the checkbox. Other users only see what you choose to show on the social (below).

Having the physiotherapist follow you: If you are not a patient you can ask the physiotherapist to follow you, or accept his invitation, from the «Andrea» screen in the app. Only if you both agree, from then on he can write to you in the app chat, comment on your workouts, set you goals and send you exercise routines, also by email to your account address, with the PDF attached; the routines are kept in the clinic's management system. The clinical parts of the clinic (medical history, sessions, documents) stay out, as they don't exist for you. The legal basis is your explicit consent (art. 9(2)(a) GDPR), which you give with the button on that screen after reading its terms. You can stop whenever you want from the same screen, and so can he: from then on he can no longer write to you or send you routines, the routines you already received stay yours, and withdrawal does not affect processing carried out before.

Whoever develops and maintains the app on behalf of the controller may access data only when needed for support you ask for, for the security of the service or to fix an error, and is bound by confidentiality.

The social: The app has a social side, like the most popular workout apps, and every account has its profile. Other users see your username, your profile photo if you add one, who you follow and who follows you, and your workouts according to each one’s visibility: name, date, duration, volume, exercises with weights and reps, photos and videos. For each workout you choose who sees it (everyone, your followers, only you); you set the starting one in the settings. Your profile is public until you make it private: then people who want to follow you have to ask, and see your workouts only if you accept. Workouts saved before the social existed are visible only to you, until you open them one by one.

People who can see one of your workouts also see what the Apple Watch measured in its sets: reps, speed, power, range and wrist movement. Others never see pain, the range of motion you enter, notes, body measurements, movement analysis, raw sensor data, walking routes, your real name or anything about your therapy with the clinic: the physiotherapist’s routines, including the ones you copy into yours, and the workouts done with them stay between you and the clinic. Likes, comments and mentions are seen by the people who can see that workout.

Reports are reviewed by a person at the clinic, with no automated systems: the clinic can hide the reported content, suspend a profile from the social or, for serious or repeated violations, close the account, and tells the person affected why, as explained in the terms. You can block anyone: you will no longer see each other. Your username and photo are visible to people who search for you even when your profile is private; to delete them, together with follows and followers, likes, comments and notifications, you delete your account.

If you become a patient of the clinic and use in the app the same email you gave the clinic, the app links your account to your clinical record: from then on the patients’ part applies too, and the app shows it to you to accept.

• Cloudflare, Inc.: servers, database and file storage (photos and videos). Communications are encrypted (TLS) and data is encrypted at rest too.
• Resend, Inc.: sending service emails, such as the code to confirm your address.
• Apple: Sign in with Apple, if you choose it; on iPhone, notifications and the map of your walks (Apple Maps).
• Google: Sign in with Google, if you choose it; on Android, notifications (Firebase Cloud Messaging), the map of your walks (Google Maps) and Google Play location services.
• YouTube and Google Drive: some exercise videos in the clinic’s routines are published there: when you watch them, Google receives your IP address and technical data about your device, under its own privacy policy.

The app’s database and file storage are kept in Europe, on Cloudflare’s servers; temporary copies used to deliver files faster may pass through its data centres around the world.

Some of these providers are based in the United States: transfers take place with the safeguards required by the GDPR (EU-US Data Privacy Framework or standard contractual clauses). Providers only handle data on behalf of the controller and according to his instructions.

The connection is optional and stays off until you turn it on, from Settings > Health app. You turn it off from the same place, and you can also revoke permissions in your phone’s settings (Privacy & Security > Health).

• Read: weight, steps, walking and running distance, and sleep; on the Apple Watch, heart rate during workouts.
• Written: completed workouts, with duration and estimated calories; for walks and runs also distance, elevation and route; the weight you log in the app. If you delete a workout or a weigh-in in the app, the app also removes what it had written to Health.

Weight, steps and the day’s distance reach the app’s servers. Sleep and heart rate are read and shown only on your phone, and are never transmitted. As Apple requires, Health data is not used for advertising or marketing, is not shared with third parties, and serves only the features described here.

On Android the same connection goes through Google’s Health Connect, with the same rules: optional, off until you turn it on from Settings > Health Connect, and you can also revoke permissions in the Health Connect app. Weight, steps, distance and sleep are read; completed workouts (with duration, estimated calories and, for walks and runs, distance, elevation and route) and the weight you log in the app are written. Weight, steps and the day’s distance reach the app’s servers; sleep stays on your phone. The use of information received from Health Connect adheres to Google’s Health Connect Permissions Policy, including the Limited Use requirements: no advertising, no sharing with third parties, only the features described here.

Connecting is optional: you do it yourself, by adding Kinetica as a connector in Claude (Anthropic’s assistant) and signing in with your account. We ask for your consent first, listing what Claude will be able to see and do, Apple Health and Health Connect data included.

• It sees: workouts, records, routines and folders, the exercise library and your own exercises, weight and measurements, goals, walks and runs, Apple Watch data, Apple Health and Health Connect data and the social feed as you see it in the app; for people followed by the clinic, the physiotherapist’s plans and notes and your answers on how you feel compared to the start of therapy. Never the chat with the clinic or the medical history.
• It does: logs, corrects and deletes workouts; creates, edits, copies and deletes routines and folders; adds and deletes weight and measurements; creates and deletes your goals; creates your own exercises. Always after your yes in the chat. It never changes the physiotherapist’s plans, never acts on the social feed and never changes your profile or settings.

The data Claude reads goes to Anthropic PBC (United States), which handles it as an independent controller under its own privacy policy and your Claude account settings. To disconnect, remove the connector in Claude; with “Delete account” the connection is also closed on our side.

• For as long as you have an account. With “Delete account” (Settings > Data) you immediately delete your account, workouts, measurements, photos and videos and Apple Watch data; the provider’s technical backups are overwritten within 30 days.
• If you delete a workout, its photos, videos and the Apple Watch data of its sets are deleted with it.
• Codes sent by email are valid for 15 minutes, then deleted.
• Social notifications are deleted after 90 days.
• Preferences saved on your phone stay until you uninstall the app.
• To work offline, the app keeps on your phone a copy of your routines, the exercise catalogue and the workouts still to be sent: it is deleted when you sign out or uninstall the app.

At any time, under Articles 15-22 GDPR, you can:

• access your data and receive a copy;
• correct or complete it;
• delete it, including by yourself with “Delete account”;
• ask to restrict its processing or object to it;
• receive it in an open format: “Export data (CSV)” in Settings > Data;
• withdraw your consent for health data.

You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, or with the authority of the country where you live: garanteprivacy.it.

To exercise your rights, write to andreamistrazzoso@gmail.com.

You must be at least 14 years old to sign up, the age at which you can consent to the processing of your data on your own in Italy. If you live in a country that requires a higher age (16 in many European countries), your country’s age applies.

If this policy changes in substance, the app shows it to you again and asks you to accept it before you continue.

Vale se nell’app risulti seguito dallo studio: sei nel gestionale dello studio, sei un paziente attivo e il fisioterapista non ha spento l’opzione “Seguito nell’app”. Se il percorso si chiude o l’opzione viene spenta, torni a usare l’app come chiunque altro, e le schede che ti erano state assegnate restano.

• Le sedute prenotate con lo studio.
• La Scheda Clinica e il questionario Örebro da compilare prima delle sedute.
• Le metriche misurate in studio, se il fisioterapista le rende visibili.
• Le schede e gli obiettivi che il fisioterapista ti assegna.
• La domanda su come ti senti dopo gli allenamenti.

Per seguirti, il Dott. Mistrazzoso vede nell’app i tuoi allenamenti con carichi, dolore, ROM e sforzo, e i dati dell’Apple Watch delle serie che misuri; la nota che gli scrivi a fine allenamento e le note che fissi sugli esercizi e sulle routine; le routine che crei tu; le foto e i video che carichi; le misure del corpo e le foto dei progressi; i passi; le risposte su come ti senti; le analisi del movimento. Non vede le tue note private.

Se avevi usato l’app prima di diventare paziente, con la stessa email, anche quello che avevi registrato passa alla tua cartella e lo vede il fisioterapista. Le note che avevi scritto per te restano private.

Il fisioterapista può consultare questi dati e la tua cartella anche con Claude, l’assistente di Anthropic, solo per seguire il tuo percorso; le schede che prepara così le rivede e le conferma lui prima che ti arrivino.

I dati relativi alla tua salute sono trattati per finalità di cura e di assistenza sanitaria (art. 9, par. 2, lett. h, GDPR), da un professionista sanitario tenuto al segreto professionale, e con il tuo consenso esplicito (art. 9, par. 2, lett. a, GDPR), che dai con la spunta per i dati sulla salute.

Scheda Clinica, questionari, metriche, schede e sedute stanno nel gestionale dello studio, sugli stessi fornitori indicati nella parte per tutti. App e gestionale si parlano fra server, con comunicazioni cifrate.

La documentazione clinica si conserva per 10 anni dall’ultima prestazione, come prevedono le norme sulla documentazione sanitaria. Eliminando l’account dell’app cancelli l’account e quello che hai salvato nell’app; la documentazione clinica resta allo studio, e rientrando con la tua email la ritrovi.

Lo studio può mandarti notifiche legate al percorso: i moduli da compilare prima di una seduta, un obiettivo nuovo o raggiunto. Si spengono dalle impostazioni del telefono.

Per qualunque domanda sui tuoi dati clinici scrivi a andreamistrazzoso@gmail.com.