Playphysio helps people maintain their airway clearance treatment routine by turning the treatment into games, and allows the player and their care team to see how the treatment is going. Doing this involves processing personal data, including health data. This policy explains what data the Playphysio app and the PhysioPal device collect, how we use it, who we share it with, how long we keep it and what your rights are.
Playphysio C.I.C. (company number 10593738, registered office 8 Meadow Rise, Bourn, Cambridge CB23 2TG) is the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO), registration number A8704156.
If Playphysio was supplied to you by the NHS or another care provider. Your care provider decides to offer you Playphysio and uses your treatment reports to look after you, so for the data your care team can see in the Playphysio clinician Dashboard your care provider and Playphysio are joint controllers. Playphysio remains responsible for the app, the PhysioPal and our servers; your care provider remains responsible for your medical record. Each care provider signs a data sharing agreement with us that sets out these responsibilities. You can exercise your rights against either of us.
Contact for anything in this policy: data@play.physio.
Who this policy covers
- Players: people who use the Playphysio app and PhysioPal device as part of their treatment. Many players are children.
- Parents and carers: adults who set up or supervise a child’s use of Playphysio, and who answer the parent and carer questions in the app.
- Care team: clinicians (for example NHS physiotherapists) who prescribe Playphysio, set the player’s session plan and view the player’s treatment reports.
How the app works and where your data lives
The app connects to a PhysioPal device over Bluetooth LE. The PhysioPal predicts therapy when you blow through your airway clearance device and sends it to the app. The app uses these predictions to drive the games and make a record of each treatment session.
This data is stored on your phone first. It stays on your phone unless you (or your parent or carer) agree in the app to share it with Playphysio. If you do not agree, you can still play the games with PhysioPal, but your care team cannot see your reports, and the app cannot sync your session plan or history to a new phone. You can change this choice at any time on the Profile screen of the app.
Data we collect
Account and registration data
- Your PhysioPal serial number and the registration code printed with it, which link your device to the account your care team created for you.
- The player profile your care team entered: name, date of birth and gender.
- Your avatar and in-game nickname, if you set one.
Treatment and health data
- Therapy predictions from the PhysioPal during each session (rating, duration and timing of each blow).
- Session records: when you did your treatment, how much of your session plan you completed, your scores and achievements in the games.
- The session plan and appointment dates your care team have set.
- Answers to the questions the app asks players and their parents or carers after a session (for example how you felt, or whether you needed help).
- Your consent choices.
Device and technical data
- Crash reports and performance data from the app, collected by Firebase Crashlytics and Firebase Performance Monitoring (Google). These include the app version, iOS version, device model and what the app was doing when it crashed. They do not include your name or your treatment data.
- Diagnostic log events stored on your phone to help us support you.
- The app uses the camera only to read the registration QR code. No photos are ever taken or stored anywhere.
Data we do not collect
- We do not collect your location.
- We do not use advertising identifiers, show adverts or sell your data.
- Google Analytics for Firebase, which is part of the crash-reporting toolkit, collects anonymous app-usage events (app opens, screens viewed) and a device identifier so that crash reports can be grouped. We do not use it to profile you or to target anything at you.
- If you take part in Game Center leaderboards, Apple handles that under Apple’s own privacy policy; we do not receive your Apple ID.
Why we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) | Health data condition (Article 9) |
|---|---|---|
| Providing the Playphysio service when you or your family bought it from us directly: running the games and recording your therapy sessions on your phone | Performance of a contract with you | Explicit consent (given in the app) |
| Providing the Playphysio service when the NHS or another care provider supplied it to you | Legitimate interests: delivering the service your care provider has commissioned for you | Explicit consent (given in the app) |
| Sharing your session reports and plan with your care team so they can manage your treatment | Consent (given in the app) | Explicit consent (given in the app) |
| Letting you move your account and history to a new phone | Consent | Explicit consent |
| Monitoring the safety and performance of Playphysio as a medical device, including investigating problems and complaints | Legal obligation (medical device regulations) | Public interest in public health (Article 9(2)(i)) |
| Supporting you when something goes wrong (crash reports, diagnostic logs) | Legitimate interests (keeping the app working) | Not health data |
| Improving the app and the games using anonymised or aggregated usage data | Legitimate interests | Not personal data once anonymised |
| Research with partner organisations | Separate explicit consent, with ethics approval | Explicit consent; data pseudonymised wherever possible |
Children
Playphysio is designed for children as well as adults. Where a player is under 13, we ask that a parent or carer gives the consent to share data; the app asks for this consent at set-up and it can be changed at any time on the Profile screen. We ask parents and carers, not the child, to answer the parent and carer questions. When the player turns 13 they can take over their own consent choices. We do not send marketing to children.
Who we share your data with
We share data only for the purposes above, and only with:
- Your care team. Clinicians at the organisation that prescribed/recommended Playphysio can see the reports for their own patients through the Playphysio clinician Dashboard.
- Amazon Web Services, which hosts our servers. Data is stored in the United Kingdom.
- Google (Firebase Crashlytics, Performance Monitoring and Analytics for Firebase), which processes crash reports, performance data and the anonymous usage events described above for us. Google may process this data outside the UK under the UK Addendum to the standard contractual clauses.
- Apple, for the App Store, Game Center and Bluetooth permissions on your device, under Apple’s privacy policy.
- Research partners, only with your separate explicit consent and only the minimum data needed, pseudonymised wherever possible.
Amazon Web Services, Google and any research partner process data for us under a data processing agreement and must protect your data to at least the standard in this policy. Apple acts under its own privacy policy for the App Store and Game Center. Your care provider’s responsibilities are set out above. We do not sell personal data and we do not share it with advertisers.
International transfers
Your treatment data is stored in the UK. Where a provider (such as Google) processes data outside the UK, we rely on the UK International Data Transfer Addendum or an adequacy regulation.
How long we keep your data
- Past data on your phone stays there until you delete the app or ask the app to clear it.
- Data shared with Playphysio is kept for as long as you use Playphysio, and is deleted 24 months after your account becomes inactive.
- Records we must keep under medical device regulations (complaints, safety investigations) are kept for the period the regulations require, which may be longer, but are limited to what those records need.
- Crash reports are kept by Firebase for 90 days.
Withdrawing consent and deleting your data
- To stop sharing data with Playphysio, open the app, go to Profile, and change your consent choice. The app stops uploading your sessions from then on.
- To have the data we already hold deleted, email data@play.physio from the address your care team has for you, or ask your care team to request it. We will confirm deletion within 30 days. Deleting your data may mean your care team can no longer see your treatment history.
- Deleting the app from your phone removes the data stored on the phone.
Your rights
Under UK data protection law you (or a parent or carer on behalf of a child) have the right to:
- access a copy of the personal data we hold about you or your child;
- correct inaccurate data;
- erase your data (see above);
- restrict or object to our processing for certain purposes;
- data portability: receive your data in a machine-readable form or have it sent to another organisation;
- withdraw consent at any time, without affecting processing done before you withdrew it.
Not all rights are absolute and some have exemptions. To exercise any of them, contact data@play.physio. You can also complain to the ICO at ico.org.uk or casework@ico.org.uk.
Security
Data travels between the app and our servers only over encrypted HTTPS connections. Access to the servers and the Dashboard is restricted to Playphysio staff and to the clinicians responsible for each patient. Data on your phone is protected by your phone’s own security.
Changes to this policy
We will publish any change here and update the date below. If a change affects how your health data is used, the app will ask you to consent again.
This version: 21 October 2026. Previous version: published on play.physio, last archived 8 October 2025.