Last updated: 4th March 2026
These Data Processing Terms govern personal data that Rehab Guru processes on behalf of its business customers when providing the Services. They form part of the agreement between you and Rehab Guru. The processing details and security measures below form part of these terms.
1.1 These terms apply whenever we process Customer Personal Data on your behalf, including during trials, subscriptions, permitted use without a paid subscription, and any retention or deletion period after active use ends.
1.2 A separately signed agreement takes priority over these terms to the extent that it expressly governs the same processing and conflicts with them. Otherwise, these terms take priority over the Agreement on the processing of Customer Personal Data. The Agreement’s liability provisions apply as set out in clause 12.
1.3 Mandatory provisions of applicable international transfer instruments take priority over any conflicting term. Nothing in these terms reduces either party’s obligations under Data Protection Law.
Agreement: the agreement governing your use of the Services, including the Terms of Service and any applicable order or separately signed agreement.
Customer, you and your: the organisation or individual acting in a business or professional capacity that contracts with Rehab Guru. An authorised user acting for an organisation is not a separate customer merely because they use the Services.
Rehab Guru, we, us and our: Rehab Guru Limited, registered in England and Wales under company number 06725431, with its registered office at Unit 13e, 92 Burton Road, Sheffield, South Yorkshire, S3 8BX.
Customer Personal Data: personal data that we process on your behalf in connection with the Services, whether supplied by you, your authorised users, patients or other individuals, received through an integration, or generated through use of the Services. This includes identifiable patient records, programme identifiers and relevant information submitted in support requests.
Data Protection Law: data protection and privacy legislation applicable to the processing, including the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR and the Privacy and Electronic Communications Regulations 2003, in each case as amended or replaced.
Services: the Rehab Guru software, applications and related services supplied under the Agreement.
Sub-processor: another processor appointed by us to process Customer Personal Data on your behalf.
Controller, processor, data subject, personal data, personal data breach and processing have the meanings given in applicable Data Protection Law. References to writing include email and recorded instructions submitted through the Services.
3.1 You determine the purposes of processing Customer Personal Data as controller, and we act as your processor. Where you act as a processor for another controller, we act as your sub-processor. You must have authority from that controller to appoint us and give the instructions contemplated by these terms.
3.2 You are responsible for the lawfulness of your instructions and the personal data you provide, for giving required privacy information, and for identifying an applicable lawful basis and, for health or other special category data, an applicable additional condition. You must obtain consent where the law requires it; consent is not required merely because these terms apply.
3.3 Your responsibilities include appropriate arrangements for children’s information, authority to share records and programme links, and the use of optional features or integrations. You must limit information shared with us and our support service to what is necessary for the relevant purpose.
3.4 We act as an independent controller only for processing whose purposes and means we determine, such as our own billing, business administration and security records, as described in our Privacy Policy. This does not permit us to repurpose patient records or other Customer Personal Data for our own purposes.
4.1 We will process Customer Personal Data only on your documented instructions, including instructions concerning transfers. The Agreement, these terms, your service configuration, deliberate use of features, authorised support requests and subsequent written instructions constitute your instructions.
4.2 To the extent permitted by Data Protection Law, we may process data where required by applicable law. We will inform you of that legal requirement before processing unless the law prohibits us from doing so on important grounds of public interest.
4.3 We will immediately inform you if, in our opinion, an instruction infringes Data Protection Law. We may suspend the affected processing while the parties resolve the issue. We are not required to follow an unlawful instruction.
4.4 Instructions outside the agreed Services may require a separate written agreement and reasonable charges. This does not restrict assistance or other obligations that Data Protection Law requires us to provide.
4.5 We will not sell Customer Personal Data, use it for our own advertising, or use it to train general-purpose AI models. AI or transcription processing of customer content occurs only following deliberate use of the relevant feature by an authorised user. We will require relevant Sub-processors to process that content only for the instructed service and applicable legal requirements.
5.1 We will ensure that people authorised to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality. Access will be limited to what they need for their authorised duties.
5.2 We will implement and maintain technical and organisational measures appropriate to the risks, taking account of the nature of the data, the processing, the state of the art and implementation costs. These include the measures in Schedule 2 and, where appropriate, encryption, pseudonymisation, resilience, timely restoration and regular assessment of effectiveness.
5.3 We may update security measures as technology and risks change, provided that we do not materially reduce the overall protection of Customer Personal Data.
6.1 Taking account of the nature of the processing, we will assist you through appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise data subject rights. We will promptly forward relevant requests received directly and will not substantively respond except on your instructions or where required by law.
6.2 Taking account of the nature of the processing and information available to us, we may assist you with security obligations, breach notifications, data protection impact assessments and prior consultation with a supervisory authority.
6.3 We may charge reasonable costs for assistance beyond the standard functionality and information included in the Services, giving you advance details where practicable. We will not charge for assistance needed to remedy our breach of these terms. Charges will not prevent or unreasonably delay compliance with mandatory obligations.
7.1 We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We will use your nominated security contact or, if none has been provided, the account contact details. You must keep those details current.
7.2 We will provide the information reasonably available to us about the breach, affected data and individuals, likely consequences and measures taken or proposed, together with a contact for further information. We may provide information in stages without undue further delay as the investigation progresses.
7.3 We will take reasonable steps to contain, investigate and mitigate the breach and cooperate with you. You remain responsible for notifications by the controller to individuals and authorities. We will not make notifications on your behalf without your instructions unless legally required. A notification is not an admission of liability.
8.1 You give general written authorisation for us to appoint Sub-processors for the Services. We will maintain the list on our GDPR page, identifying each relevant provider, its processing purpose and processing locations, including material overseas access arrangements.
8.2 We will give you at least 30 days’ advance notice by email or a direct account notification of an intended addition or replacement. You may object within 14 days of that notice on reasonable grounds relating to the protection of Customer Personal Data. Publishing a changed list alone does not replace this notice.
8.3 Any objection under clause 8.2 must specify reasonable grounds relating to the protection of Customer Personal Data. We will consider the objection in good faith and seek a commercially reasonable way to address it. We are not required to develop bespoke functionality or maintain a particular supplier. If the objection cannot reasonably be resolved before the proposed change, we may terminate the affected Services on written notice before the proposed Sub-processor receives your Customer Personal Data. Any fees or refunds will be determined under the Agreement and applicable law.
8.4 We will appoint Sub-processors under written contracts imposing the data protection obligations required by Article 28 of the applicable GDPR, providing an equivalent level of protection for Customer Personal Data, including appropriate security measures. We remain responsible to you for our Sub-processors’ performance of those obligations as required by Data Protection Law. To the extent permitted by law, our liability is subject to clause 12, including the applicable exclusions and aggregate liability limit in the Agreement.
9.1 Our standard central clinical database and its backups are hosted in London, United Kingdom, unless a separately signed agreement specifies otherwise. This is distinct from processing by optional features and other service providers.
9.2 Support personnel outside the UK may see information you submit in support tickets, including patient information in messages, screenshots or attachments. You should remove unnecessary personal data before submitting a request. Such information remains protected by these terms.
9.3 You authorise transfers and access needed for the instructed Services through the arrangements described in the Sub-processor list, subject to this clause and the change procedure in clause 8. This contractual authorisation does not itself provide a lawful international transfer mechanism.
9.4 We will ensure that each restricted transfer complies with the law applicable to it. Depending on that law and the destination, this may require an applicable adequacy decision or regulation, the current EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, together with required assessments and supplementary measures. UK and EU transfer requirements will be considered separately where both apply.
9.5 The parties will reasonably cooperate to execute or update transfer documentation where needed. We will provide relevant information about safeguards on request, subject to proportionate protection of confidential information. No clause requires you to approve an unlawful transfer.
10.1 We will process Customer Personal Data for the instructed Services and retain it only for the period needed for those Services, your documented instructions or applicable law. Your instructions include the dormant-account process in clause 8 of the Terms of Service unless a separately signed agreement provides otherwise.
10.2 Under that process, an account with no current Subscription becomes dormant after 90 consecutive days without access or login activity. We will then email a warning allowing a further 30 days to prevent deletion by reactivating the account or arranging this with support. Cancelling subscription renewal alone does not immediately erase account records.
10.3 When all processing Services for your account end, you may choose the return or deletion of Customer Personal Data. We will return the data in a reasonably practicable electronic format or delete it as instructed, and delete remaining live copies after return, without undue delay. Unless you request earlier deletion, we will allow 30 days after account closure to request return. If you give no instruction, you instruct us to delete live copies at the end of that period. Where your account instead remains available after a paid Subscription ends, the continuing service and dormant-account process in clause 10.2 apply. We will apply the return and deletion obligations to relevant Sub-processors.
10.4 Deleted live data may remain in encrypted backup copies for up to one year after deletion from live systems. During that period we will keep it protected and beyond ordinary use, restrict access to necessary disaster recovery and security purposes, and delete it through the backup expiry cycle. If a backup is restored, applicable deletion instructions will be reapplied before the restored data returns to ordinary use. Restoration will not restart the one-year retention period.
10.5 Where law requires retention, we will retain only the required data for the required period, restrict processing to that legal purpose and continue to protect it. Data we lawfully hold as an independent controller is subject to our Privacy Policy, rather than being retained as a copy of your patient database for general business purposes.
10.6 These terms continue for as long as we or our Sub-processors retain Customer Personal Data. On reasonable request, we will confirm completion of deletion and identify any remaining protected backup or legally required retention.
11.1 We will make available information necessary to demonstrate compliance with these terms and Article 28 of the applicable GDPR, and allow for and contribute to audits, including inspections, by you or an auditor you appoint.
11.2 Audits will normally begin with available documentation, security reports and relevant certification evidence. If these do not reasonably address the compliance issue, the parties will agree a proportionate further audit. Audits should normally take place during business hours on reasonable notice and no more than once in any 12 months.
11.3 Those arrangements do not limit a supervisory authority’s powers or prevent additional or urgent audits where required by law, following a relevant personal data breach, or where there are reasonable grounds to suspect material non-compliance. We will not use them to prevent an effective audit.
11.4 Auditors must be suitably qualified and subject to confidentiality obligations. The audit must protect other customers’ data, confidential information and system security and avoid unnecessary disruption. You bear your auditor’s costs. We may charge reasonable, proportionate costs of assistance, except to remedy our breach; charges must not deter the exercise of mandatory audit rights.
12.1 To the fullest extent permitted by law, liability arising under these terms forms part of, and does not increase, the aggregate liability governed by the exclusions and limits in the Agreement. These terms do not create a separate liability cap or an additional indemnity. Responsibility for Sub-processors remains subject to that allocation to the extent legally permitted.
12.2 Nothing limits liability that cannot lawfully be limited, a data subject’s statutory rights, a supervisory authority’s powers, or rights and obligations under mandatory international transfer clauses that cannot be limited by the Agreement.
12.3 Changes to these terms follow the Agreement’s notice procedure, subject to any longer or more specific notice required here. No website update overrides a separately signed agreement, validates an unlawful instruction or retrospectively reduces protection required by law.
12.4 Contact our Data Protection Officer at dpo@rehabguru.com about these terms. The Agreement’s governing law and dispute provisions apply, subject to mandatory Data Protection Law and transfer provisions.
Subject matter and purpose: providing exercise prescription, patient programme access, clinical record management and associated services selected by the customer, including administration, communications, authorised integrations, support and migrations. Optional AI and transcription are used only following deliberate action by an authorised user.
Nature of processing: collecting and receiving data; organising, storing, retrieving and displaying records; generating programmes and outputs; transmitting information to authorised recipients; performing requested analysis or transcription; troubleshooting; backing up; returning and deleting data. The processing performed depends on the features and instructions used.
Duration: while the instructed Services are provided and during the applicable return, deletion, protected backup and legally required retention periods in clause 10.
Categories of individuals: patients and prospective patients, including children; parents, guardians or carers where their details are supplied; customer personnel and authorised users; and other individuals whose information the customer lawfully provides for the Services.
Types of data: names, contact information, account and programme identifiers; relevant demographic information; exercise prescriptions and programme activity; feedback, communications and outcome measures; symptoms, conditions, assessments, clinical notes and other health information; and audio, transcripts, prompts and generated outputs where the relevant feature is used. Support requests may contain messages, screenshots and attachments. Unique programme links and identifiers may be personal data even without a conventional patient account.
Special category data and safeguards: health data and any other special category information lawfully included in clinical records or recordings. The confidentiality, access, security, transfer and deletion provisions of these terms apply. The customer determines the lawful basis, additional condition, permitted recipients and clinical retention requirements.
Customer rights and obligations: giving lawful documented instructions; determining the permitted processing and retention within the agreed Services; receiving assistance and compliance information; objecting to Sub-processor changes; and choosing return or deletion as provided in these terms.
Access and confidentiality: restrict access to authorised personnel according to their duties; manage access permissions and credentials; require confidentiality and appropriate security training. Authorised staff may decrypt data where needed for support, migrations or other instructed service operations. The service is not designed to prevent all access by Rehab Guru.
Encryption and network protection: use TLS for supported service connections and encryption at rest for the central database and its backups; manage encryption keys and use network segregation, firewalls and access controls appropriate to the service architecture.
Availability and recovery: maintain backups in the UK for the standard service, protect them against unauthorised access and use, and maintain procedures to restore availability following an incident. Apply the backup retention and restoration safeguards in clause 10.
Security management: maintain documented security policies, risk management, incident response and access management procedures. Review security risks and assess the effectiveness of protective measures regularly, including appropriate vulnerability assessment and testing.
Development and changes: use controlled development, testing and release processes and segregate development environments from production. Do not use Customer Personal Data for general development or model training outside the customer’s instructions.
Supplier assurance: assess relevant Sub-processors’ security and contractual protections in proportion to the data and service involved. Current information about Rehab Guru’s ISO 27001 and Cyber Essentials Plus certifications is available on our Security page.
