1. Introduction
Welcome to Recalibrate ("we", "our", "us"). We are committed to protecting your privacy and the security of your personal health information. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use our chronic pain management platform, including the Recalibrate Android app and website.
2. Data We Collect
The categories below match the data types declared in our Google Play Data safety form.
2.1 Personal info
- Name and email address
- Account credentials (passwords are stored only as salted hashes)
- User IDs used to identify your account
- Profile information you choose to provide
2.2 Health info (health information)
- Pain levels, symptom locations and descriptions, and symptom tracking over time
- Sleep quality, energy and mood ratings
- Medications, dosages and reminders you enter
- Triggers, flare patterns, assessment answers and generated reports
- Notes and observations you provide
2.3 Fitness info (fitness information)
- Activity, movement and exercise entries you log
- Diet entries and habit streaks you log
2.4 Messages
- Other in-app messages: messages exchanged with your care team, clinician or carer
- Conversations with our in-app AI assistant, journal entries and private notes
2.5 Photos and videos
- Photos: images you choose to upload, such as a profile picture or a photo attached to a symptom entry or message. We access photos only when you select them; we do not scan your gallery.
2.6 Files and docs
- Documents and files you choose to upload or attach, such as clinical letters, imaging reports or resources shared within a care team, and PDF reports generated for you inside the app.
2.7 Financial info
- Purchase history: which subscription or product you bought and its status. Payments are processed by Google Play and Stripe. We never receive or store your card number.
2.8 App activity, app performance and device identifiers
- App interactions: screens viewed, features used, sign-up and purchase events
- Crash logs and diagnostics used to fix faults and improve stability
- Device or other IDs, device model, browser type and IP address (anonymised where possible)
2.9 Microphone and audio
The app requests microphone access only for voice dictation. Speech is transcribed by your device's own speech recogniser and only the resulting text is saved. No audio recording is stored, transmitted or shared.
2.10 Analytics
If you accept analytics cookies, we use Google Analytics 4 to understand how the website and app are used. We do not send Google Analytics your pain scores, symptom notes, diagnoses, clinician or care-team messages, assessment answers, names or email addresses.
3. How We Use Your Data
- App functionality: to deliver tracking, insights, reports, messaging and care-team features
- Account management: to create, secure and support your account
- Analytics: to measure feature usage, stability and conversion
- Service communications, support responses and legal compliance
- Anonymised research to improve chronic pain management
4. Data Sharing
We never sell your health data. Your health information is never sold, rented or shared with third parties for commercial purposes or advertising.
We share data only in these cases:
- With your consent: when you explicitly grant a clinician or carer access to your data
- Service providers under contract: Stripe (payments), Google Play Billing (payments), Resend (transactional email), Google Analytics (optional analytics only after consent), Google OAuth (optional sign-in), MongoDB Atlas, Railway and Vercel (database, backend and hosting), and AI providers that process only the content of features you choose to use
- Legal requirements: where required by law, court order, or to protect safety
- Business transfers: in a merger or acquisition, with continued privacy protection
5. Security
- Encryption in transit: all data sent between your device and Recalibrate, and between our servers and our database, is encrypted with TLS.
- Encryption at rest: our databases are encrypted on disk with AES-256. In addition we apply application-level AES-256-GCM encryption to the most sensitive fields, including clinical notes, care-team messages and AI conversations, with keys stored separately from the database.
- Authentication: JWT session tokens with expiry; clinicians must enable two-factor authentication and sign a Business Associate Agreement before accessing any patient data.
- Role-based access: patients, clinicians and carers see only what their role and your explicit consent allow. You can revoke care-team access at any time.
- Audit logging: care-team access, clinical notes, messages, exports, MFA checks, logins and account deletions are logged and visible to you.
- Rate limiting on login, password reset, MFA and account deletion endpoints.
6. Your Rights
- Access and portability: request or export a copy of your data, including PDF health reports
- Rectification: correct inaccurate or incomplete information
- Erasure: delete your account and all associated records, or request deletion of your data without closing your account
- Restriction and objection: limit how we process your information
- Withdraw consent: revoke care-team access or analytics consent at any time
To exercise any right, email info@recalibratepain.com. We respond within 30 days.
7. Deleting Your Account and Data
You can delete your account yourself at any time: open the app, go to Profile → Delete Account and type DELETE to confirm. Your account and all associated records are removed immediately and permanently.
If you cannot sign in, or you want your data deleted without deleting your account, email info@recalibratepain.com with the subject Data deletion request. Full instructions are on our account and data deletion page.
8. Data Retention
- Account data: until account deletion, or 3 years of inactivity
- Health, fitness, message, photo and file data: until account deletion, or as required by law
- Purchase and billing records: up to 7 years, held by our payment processors where tax and accounting law requires it
- Security and audit logs: up to 12 months, then deleted
- Email suppression list: retained so we do not email you again
- Anonymised, aggregated research data: may be retained indefinitely and cannot be linked back to you
9. International Transfers
Your data may be processed outside your country of residence. Where it is, we rely on Standard Contractual Clauses, adequacy decisions or equivalent safeguards.
10. Children's Privacy
Recalibrate is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children under 16. Contact us if you believe a child has provided us data.
11. Data Breach Response
If a breach affects your personal information we will notify affected users without undue delay and, where required, within 72 hours of becoming aware, and will notify the relevant data protection authority.
12. Changes to This Policy
We may update this policy. Material changes will be posted here, emailed to registered users and shown in the app.
13. Contact
Email: info@recalibratepain.com · Response time: within 30 days. You also have the right to lodge a complaint with your local data protection authority.