ai'am motion — Privacy Policy

Version 2.0 · Effective date: 1 October 2026

This Privacy Policy explains how personal data is processed in connection with ai'am motion (the "App"), a mobile application for professionals in prosthetics, orthotics and physiotherapy that records and measures human gait and produces measurement reports.

ai'am motion is a measurement and documentation tool. It is not a medical device, it does not diagnose, and it does not make or recommend treatment decisions. All clinical assessments and decisions are made by the professional using the App.

1. Who we are

The App is provided by Orto Algorytmics sp. z o.o., ul. Prądnicka 12, 30-002 Kraków, Poland, entered in the Polish National Court Register under KRS 0000809997, NIP 6772447684, REGON 384674956 ("Orto Algorytmics", "we", "us"). ai'am.care is our brand.

Contact for all privacy matters: hello@aiam.care, or by post to the address above.

2. Who the App is for

The App is intended only for professionals — for example prosthetists, orthotists, physiotherapists and physicians — acting on behalf of an organisation such as a clinic or practice, or conducting a professional business in their own name (the "Customer"). A User and the Customer may be the same natural person; account and service closure in that case is explained in section 12.

The App is not intended for use by patients, and not for persons under 18 years of age as users.

People whose gait is recorded ("Patients") do not use the App and do not have an account. Patients may include minors; in that case the Customer is responsible for obtaining the consent of the parent or legal guardian.

3. Our two roles

We process personal data in two different roles. It matters which one applies, because it determines who decides about the data and who you should contact.

Data	Our role	Who decides about the data
Patient recordings, measurement results and reports created in the App for a Customer	Processor acting on the Customer's documented instructions (Article 28 GDPR)	The Customer (the clinic or practice) is the controller
Accounts of professional users, contract and billing data, support requests, security and technical logs, app analytics, notification data and minimal compliance evidence	Controller, for our own stated purposes	Orto Algorytmics
Patient recordings used to develop and improve our models — only where the Patient has given separate, explicit consent	Independent controller	Orto Algorytmics

Where we act as a processor, the Customer's own privacy notice applies to Patients, and Patients should exercise their rights with the Customer (see section 13).

4. What data we process

4.1 Data of professional users (we are the controller)

Account data: name, business e-mail address, password (stored only in hashed form), language setting.
Organisation data: name of the Customer and the User's role in the organisation.
Contract and billing data: the Customer's company details and invoicing data. We do not sell subscriptions in the App and we do not process payment card data.
Support data: the content of messages you send us.
Technical and security data: device model, operating system and App version, IP address, log-in times, access and audit logs, and error, crash, performance and other diagnostic reports. Firebase Crashlytics is used for crash diagnostics.
Analytics data: interactions with the App, installation identifiers, and approximate location derived from the IP address, collected by Firebase Analytics. Advertising features are disabled and we do not send an account identifier or its hash to Firebase. Installation identifiers are used, so we do not describe this telemetry as anonymous.
Notification data: a push token issued for your installation of the App, registered with Firebase Cloud Messaging and used with Apple Push Notification service, together with the fact and delivery status of the notifications we send you. Notifications tell you that an analysis you ordered has finished.
Compliance evidence: minimal records that the Terms were accepted, that this Privacy Policy was made available, and that the first-launch disclaimer was acknowledged, including the document version, the date and time, and the language. These acknowledgements are not consent to analytics and not consent to the development of our models. Patient consent and withdrawal records are kept separately, as described in sections 8 and 11.

4.2 Patient data processed on behalf of the Customer (we are a processor)

Video recordings of the Patient walking, showing their image, body, movement and any visible prosthesis or orthosis. Recordings made with the App camera have no audio. Imported videos are copied as complete files and may contain an audio track, which may also be uploaded.
Body keypoints derived from the recordings — the positions of joints and body segments over time. Keypoints may be produced on the device, before anything is sent to us.
Analysis data: the results of the pose analysis associated with a recording. Where the analysis runs on the device, these results exist on the device; where a recording is uploaded, the recording and its associated analysis data are sent to the Service.
Analysis order data: the fact and status of an analysis order placed with the Service, and the report language selected for that order.
Measurement results: gait parameters, joint angles, symmetry and similar kinematic values, and comparisons between recordings.
Clinical context entered by the professional: for example the level and side of an amputation, the type of prosthesis or orthosis, and notes.
Patient records created by the professional: a patient profile to which recordings are linked so that they can be found through the patient list, together with the identifying details the professional chooses to enter and any Patient identifier assigned by the Customer. We recommend that professionals use an identifier or pseudonym rather than a full name.
Reports generated from the above, in the language selected when the analysis was ordered, made available as PDF files that the professional can download.

This data concerns health and therefore belongs to the special categories of personal data under Article 9 GDPR. Depending on how it is used, image and movement data may also qualify as biometric data. We handle all of it with the safeguards described in section 10.

4.3 Data we do not collect

We do not collect advertising identifiers, we do not track you across other apps or websites, we do not use the App's data for advertising or marketing, and we do not sell personal data. We do not collect precise location, contacts or browsing history. The approximate location derived from IP addresses for analytics is described in section 4.1.

5. How we collect data

From you, when you register, use the App or contact us.
From the Customer, when an administrator creates or manages your account.
Through the App, when you record a Patient with the device camera or import a video using the system Files picker. The App accesses only the file you select and does not request full access to the photo library.
When you send a recording to us. Pose analysis can be run on the device without sending anything. Uploading is a separate action you choose: it sends the recording and its associated analysis data to the Service, where the analysis order is processed and the report is generated.
Automatically, through security and operational logs, Firebase Analytics and Firebase Crashlytics, as described above.
When you allow notifications. iOS issues a push token for your installation, which is registered with Firebase Cloud Messaging so that we can notify you when a report you ordered is ready.

6. Device permissions

The App requests camera access to record gait. You can change this in iOS settings; denying it prevents camera recording but does not prevent importing a file.

The current version does not request microphone access and records camera videos without sound. Video import uses the system Files picker, not full photo-library access; imported files may already contain audio.

The App also requests notification permission, so that it can tell you when a report you ordered is ready. Notifications are delivered through Apple Push Notification service and Firebase Cloud Messaging. This permission is optional: you may refuse it, and you may withdraw it at any time in iOS settings. The rest of the App works without notifications, and no paid function depends on granting this permission.

7. Purposes and legal bases

7.1 Where we are the controller

Purpose	Data	Legal basis (GDPR)
Creating and running your account and providing the App under the contract with the Customer	account and organisation data	Art. 6(1)(b) — contract; for users acting for a Customer, Art. 6(1)(f) — our legitimate interest in performing the contract with the Customer
Invoicing, accounting and tax obligations	contract and billing data	Art. 6(1)(c) — legal obligation
Security, fraud prevention, access and audit logs, and necessary error diagnostics	technical and security data, Crashlytics diagnostics	Art. 6(1)(f) — legitimate interest in the secure and reliable operation of the Service
Handling support requests and communicating about the Service	support data, contact data	Art. 6(1)(b) and (f)
Notifying you about your own analysis orders, including push notifications that a report is ready	notification data	Art. 6(1)(b) and (f) — providing the Service and informing you about work you initiated. The device-level notification permission required by iOS is obtained separately and can be withdrawn at any time.
Understanding how the App is used, so that we can maintain and improve it	analytics data	Art. 6(1)(f) — our legitimate interest in understanding how the App is used so that we can maintain and improve it. You may object to this processing at any time by writing to hello@aiam.care.
Demonstrating that the Terms were accepted and that notices were provided	minimal versioned, timestamped evidence and the identifier linkage needed for it	Art. 6(1)(f) — legitimate interest in demonstrating contractual acceptance and the provision of information. An acknowledgement is not consent.
Demonstrating Patient consent, its withdrawal and our compliance	minimal consent and withdrawal evidence, not a retained copy of the clinical dataset	Art. 6(1)(c), to the extent required to demonstrate consent under Art. 7(1), and Art. 6(1)(f) for necessary legal-claims evidence. Where such evidence reveals health data, an applicable Art. 9 condition also applies; after withdrawal, Art. 9(2)(f) applies only so far as necessary for legal claims, never to continued training.
Establishing, exercising or defending legal claims	relevant, minimised evidence	Art. 6(1)(f); where necessary health data is involved, Art. 9(2)(f)
Developing and improving our gait measurement models using Patient recordings	recordings, keypoints, measurement results and clinical context — without names or contact details	Art. 6(1)(a) and Art. 9(2)(a) — the Patient's explicit consent, or the consent of a parent or legal guardian

7.2 Where we are a processor

We process Patient data solely to provide the App's functions to the Customer — recording, measurement, comparison and reporting — in accordance with the data processing agreement concluded with the Customer. The Customer determines the legal basis for that processing.

8. Use of recordings to develop our models

We use Patient recordings to train, test and improve the models behind the App only where the Patient, or their parent or legal guardian, has given separate, explicit consent to that use. This consent:

is separate from any consent to the measurement itself, and refusing it has no effect on the Patient's care or on the use of the App for that Patient;
is collected by the Customer on our behalf using the consent form we provide, and recorded by the Customer in the App;
can be withdrawn at any time, by contacting the Customer or us at hello@aiam.care.

For this purpose we act as an independent controller. We use only the recordings and the associated measurement data — not the Patient's name or contact details. Access is limited to authorised members of our development team, and we apply further safeguards including pseudonymisation and technical measures that reduce identifiability where they do not defeat the measurement purpose.

If consent is withdrawn, we remove that Patient's recordings from our training and evaluation datasets and do not use them in future training. Models that have already been trained cannot be reversed to remove the influence of an individual recording; such models do not contain the recordings themselves.

We do not publish recordings, we do not share them with third parties for those parties' own purposes, and we never use them to train systems that recognise or identify a specific person by their gait, body or face.

Patients in the United States. Recordings of Patients whose data is protected health information under HIPAA are used for model development only where the Patient has signed a HIPAA-compliant authorization, or after the data has been de-identified in accordance with HIPAA.

9. Who receives the data

We disclose data according to the purpose and the role involved.

Infrastructure and service providers that process data on behalf of the Customer through us — hosting, file storage, backup, transactional e-mail, and operational monitoring. The current list of these providers, with their roles and the regions in which they operate, forms part of the data processing agreement and is available on request at hello@aiam.care.
Google/Firebase services receive the analytics, diagnostic and notification data described in section 4.1. The services in use are Firebase Analytics, Firebase Crashlytics and Firebase Cloud Messaging. Firebase Cloud Messaging receives the push token for your installation and the content of the notifications we send; it is not used for Patient recordings, keypoints or reports. We do not send an account identifier or its hash to Firebase. This is not an assurance that a diagnostic payload can never contain other personal data.
Apple distributes the App through the App Store under its own privacy policy, and Apple Push Notification service transports the notifications described in section 6 to your device.
The Customer's authorised Users and administrators access that Customer's data according to their permissions. Access to another Customer's data is not permitted.
Professional advisers and competent authorities, where required by law or necessary for legal claims, receive only the information needed for that purpose.

Our gait models run in our own infrastructure. The App does not send recordings or keypoints to any third-party AI service for analysis. This does not exclude the analytics, diagnostic and notification services described above.

10. Where the data is stored and how we protect it

Patient Data processed for a Customer is stored in the European Union. The provider, the region, and the locations of backups and of administrative access are identified in the subprocessor list referred to in section 9.

This does not mean that every analytics, diagnostic, notification or support operation takes place solely in the EU. Locations and transfers are assessed separately for each recipient, including the Firebase services. Where personal data is transferred outside the European Economic Area, we rely on the applicable transfer mechanism under Chapter V GDPR, and we make information about the safeguards available on request.

We maintain appropriate technical and organisational safeguards, described in Appendix A to the data processing agreement, including access restrictions, separation of each Customer's data, secure transmission, controlled storage, backup and incident procedures.

11. How long we keep data

Data	Retention
Patient recordings, measurement results and reports processed for the Customer	Kept on the Customer's instructions while the Customer's organisation account and the relevant service agreement remain active, unless the Customer instructs earlier deletion through an authorised representative. Deleting a User account, or a User losing access, does not end the Customer's service and does not delete its Patient Data. Where a verified sole-practitioner Customer closes both their account and their service, the export and deletion procedure starts instead, and no further instruction is needed. The Customer determines the medical-record retention that applies to it and may instruct deletion only consistently with its own legal obligations.
Recordings in our model-development datasets	Until consent is withdrawn, or until the data is no longer needed for model development, subject to section 8. Deletion of a Customer's service data and withdrawal of a Patient's model-development consent are separate processes; see section 12.
User account profile and credentials	Deleted or anonymised after the User's account-deletion request, subject only to the specific legal-retention needs identified below. The separate evidence records are not an active account and cannot be used to log in.
Closure contact and export access for a sole-practitioner Customer	The minimum verified contact details and restricted retrieval credentials, held separately from the deleted account and only for the duration of the notified export and deletion process. Removed or invalidated when that process ends, unless a separately identified legal basis requires a limited record. They do not restore normal access.
Contract and billing records	For the applicable accounting and tax periods, and for the applicable limitation period where evidence for claims is necessary; where a dispute is pending, only as long as it is needed for that dispute.
Our technical and security logs	No longer than 12 months, unless a specific incident requires a documented and limited legal hold. This period does not describe data held by Firebase.
Firebase Analytics	Event data and user data are retained for no longer than 14 months, as configured in our Firebase project.
Firebase Crashlytics	The provider states that crash traces, extracted minidump data and the associated installation identifiers are retained for 90 days, after which their removal from live and backup systems begins.
Notification data (Firebase Cloud Messaging)	The push token is kept while your installation remains registered for notifications. It is removed or invalidated when you withdraw notification permission, uninstall the App, or your account is deleted.
Minimal consent, withdrawal, acceptance and acknowledgement evidence	Only for as long as necessary to demonstrate lawful processing, to meet an applicable legal obligation, or to establish, exercise or defend claims. After an account is closed or consent is withdrawn, the retained evidence is restricted to that purpose and does not authorise any future use of Patient Data. A documented period applies to each category, and records are removed or irreversibly anonymised when it ends.
Service backups	Data deleted from active systems expires from backups through rotation within 35 days of that deletion. Deleted records are excluded from normal use, and any restore re-applies the deletion instruction before the data becomes operationally accessible.

Where a Customer's service is terminated, its data is erased from active systems within 30 days after the agreed retrieval period ends, or following a verified instruction for earlier deletion that can lawfully be carried out. Data is not erased while the export and retrieval period remains open.

12. User account deletion and the Customer's data

You can start the deletion of your personal User account in the App, in your account settings. We revoke access and remove the active profile and credentials. We may retain only the limited evidence and other records described in section 11. Retained evidence cannot be used to log in, to restore your profile, or to authorise new processing.

The Customer retains control of its Patient Data. Its authorised administrator or another expressly authorised representative may delete specified patient records, recordings or reports, or instruct the closure of the Customer's organisation account. Where the relevant in-app function is unavailable, an authenticated written instruction may be sent to hello@aiam.care. We verify the person's authority and carry out the instruction under the data processing agreement. We do not make a clinic's right to delete its data depend on the continued existence of the User who created a record.

Where the Customer is a separate organisation, deleting a User account — including the account of its last administrator — does not automatically delete the Customer's data or end its agreement. We arrange another authorised contact, and we do not use that process to refuse a personal account deletion.

If you are also the sole-practitioner Customer. Where no other authorised person will continue your Motion service, the deletion flow explains and records your confirmation of both the account deletion and the closure of the Motion service. That confirmation starts the export and retrieval process, followed by deletion. We do not wait for a new contact or for a second deletion request. Secure retrieval and instructions remain available to you through a limited verified route, without restoring your deleted login. You may instead choose lawful earlier deletion without an export. Failure to collect an available export does not extend storage beyond the notified timetable. Where continuation through another authorised person is verified, you may delete only your personal account. A blank organisation field, or a separate organisation having only one User, is not sufficient to trigger this case.

Ending Motion does not authorise the deletion of data still needed for another continuing product; that scope and its continuity are recorded expressly. Your own duties as controller of Patient Data do not end merely because you delete a login. Any legal exception to deletion identifies the affected data, the purpose and the duration.

Minimal records of Terms acceptance, disclaimer acknowledgement and Patient consent or withdrawal are managed separately from active account and clinical records, so that removing account fields cannot accidentally erase evidence required for its limited lawful purpose. Retaining that evidence is not permission to keep the underlying recordings.

Withdrawal of a Patient's consent to model development is a separate instruction, which can be given to the clinic or to hello@aiam.care. A Customer's instruction to delete its clinical copy is not by itself a Patient's withdrawal of that separate consent. Where a request covers both, we clarify it and route each part to the responsible controller; deleting clinical data never recreates or reactivates a withdrawn consent.

13. Your rights

Under the GDPR you have the right to:

access your data and receive a copy of it;
have inaccurate data corrected;
have your data deleted;
restrict processing;
object to processing based on our legitimate interest;
data portability;
withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority in your country of residence or work.

Professional users can exercise these rights by writing to hello@aiam.care.

Patients should contact the clinic or practice that recorded them, because that organisation is the controller of their data; if a Patient contacts us, we forward the request to the Customer. For the use of recordings in model development under section 8, Patients can contact us directly.

We respond within one month. We may need to verify your identity first.

14. Automated processing

The App calculates measurement results from recordings automatically. Those results are measurements for the professional to review. The App does not take decisions about Patients that produce legal effects or similarly significant effects; all clinical decisions are made by the professional.

15. Additional information for specific countries

Switzerland. We process the personal data of persons in Switzerland in accordance with the Swiss Federal Act on Data Protection. You may lodge a complaint with the Federal Data Protection and Information Commissioner.

United States. Where the Customer is a covered entity under HIPAA, we process protected health information as its business associate under a Business Associate Agreement, and the Customer's own Notice of Privacy Practices applies to Patients.

16. Changes to this policy

We may update this policy when our services or the applicable legal requirements change. The current version is always available at this address, together with its effective date. Earlier versions are available on request at hello@aiam.care. Where changes are significant, we notify users in the App and ask for renewed acceptance where that is required.

17. Contact

Orto Algorytmics sp. z o.o. ul. Prądnicka 12, 30-002 Kraków, Poland E-mail: hello@aiam.care Phone: +48 505 583 571