Introduction

This privacy notice tells you what to expect us to do with your personal information when you make contact with us or use one of our services.

It sets out:

Who we are and our contact details
The type of personal information we collect
How we get personal information and why we are allowed to use it - this is called the lawful basis of processing
How we store your personal information - this is sometimes called retention of information
Your data protection rights
How you can complain if you believe we have failed to maintain your rights and our commitment to you outlined in this notice.

Who we are

We founded Tortoise because we’ve been there; with the pain, long rehabilitation, slow progress and mental load that comes with musculoskeletal injuries and issues. Our mission is to help people recover well, giving them the freedom to lead the lifestyle they want to pursue. We’re called Tortoise because like in the story, slow and steady rehab wins the race.

Tortoise is registered as a limited company in the United Kingdom (no.14592802). You can contact us, via our website (www.tortoise.rehab) or by emailing help@tortoise.rehab.

The type of personal information we collect, how we collect it and the lawful basis for collecting it

We developed the Tortoise app to help you recover well from your musculoskeletal issue. To achieve this aim, we collect personal information directly from you in the app. This information allows you to register for the app, and use the app to:

set motivating goals
set and track your rehab
track your recovery
share your progress with your rehab team
learn about your injury and the recovery journey
take positive action to recover well
connect with others

The specific information that we collect, and the lawful basis for processing it is detailed in the table below:

Personal identifiers and contact details (Name, email, billing address, telephone number)
- Purpose: To register you for the Tortoise app and contact you about the service and related information.
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? Yes - we need this information to create your login, provide you with assistance and keep you updated about the service.
- I have a clinic subscription - will this data be shared with the clinic? Yes
Account data (Registration date, payment plan, subscription status)
- Purpose: To manage your Tortoise subscription
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? Yes - we need this information to subscribe you to Tortoise
- I have a clinic subscription - will this data be shared with the clinic? Yes
Device data
- Purpose: Device identifier, mobile operating system, mobile browser, time zone setting
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? Yes - this is required to deliver the service
- I have a clinic subscription - will this data be shared with the clinic? No
IP data
- Purpose: IP address, including approximate position
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? Yes - this is required to deliver the service
- I have a clinic subscription - will this data be shared with the clinic? No
Personal characteristics (year of birth, gender, activity level, profile picture)
- Purpose: To prioritise how the information in the app is presented to you, making it most relevant to your recovery journey
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? No - all optional
- I have a clinic subscription - will this data be shared with the clinic? Yes
Goals
- Purpose: To help motivate you on your recovery journey
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? No - only required for goal feature
- I have a clinic subscription - will this data be shared with the clinic? Yes - clinic can also edit your goals
Rehab exercises
- Purpose: To allow you to understand and track your rehab
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? No - only required for rehab tracking feature
- I have a clinic subscription - will this data be shared with the clinic? Yes - clinic can also edit your rehab exercises
Wellness questionnaire (mood, fatigue, activity level, notes)
- Purpose: To help you identify factors influencing your recovery
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? No - only for relevant aspects of tracking feature
- I have a clinic subscription - will this data be shared with the clinic? Yes
Community posts and engagement
- Purpose: To allow you to engage with the community
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? No - only for community feature
- I have a clinic subscription - will this data be shared with the clinic? No
Logbook entries
- Purpose: To help you recover well
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? No - only for completion of activities in app
- I have a clinic subscription - will this data be shared with the clinic? No
Specific information about your injury (e.g. when did it occur, what help you have already sought, how it is feeling, your progress against your goals and rehab you have done, notes)
- Purpose: To help you recover well by enabling you to track your recovery and identify what influences it and to enable us to prioritise information in the app to make it most relevant to you
- Lawful basis of processing: Performance of contract. Health related special category data - explicit consent
- Do I have to provide this data to use the app? No - only for relevant aspects of tracking feature
- I have a clinic subscription - will this data be shared with the clinic? Yes

Wearable data (activity and health data including, but not limited to steps, activities, body battery, sleep)
- Purpose: To help you track your recovery
- Lawful basis of processing: Performance of contract. Health related special category data - explicit consent
- Do I have to provide this data to use the app? No - only if you choose to connect your wearable
- I have a clinic subscription - will this data be shared with the clinic? Yes
Transaction data (details about payments and purchases, but excluding bank account and full payment card details)
- Purpose: To enable you to pay for our services
- Lawful basis of processing: Performance of contract
- Do I have to provide this data to use the app? Yes - required for you to subscribe to Tortoise
- I have a clinic subscription - will this data be shared with the clinic? No
App usage
- Purpose: To enable us to deliver and improve the app and our services
- Lawful basis of processing: Legitimate interests
- Do I have to provide this data to use the app? Yes - usage data will be collected through the app.
- I have a clinic subscription - will this data be shared with the clinic? Yes
Marketing data (Name, email, marketing preferences)
- Purpose: Includes your preferences in receiving marketing from us
- Lawful basis of processing: Legitimate interest
- Do I have to provide this data to use the app? No - you can opt-out
- I have a clinic subscription - will this data be shared with the clinic? No
Personal identifiers and contact details
- Purpose: To enable you to exercise your rights over your data. These are called data subject rights requests and are described in this Privacy Notice.
- Lawful basis of processing: Compliance with a legal obligation
- Do I have to provide this data to use the app? No - only if you make a data subject right request
- I have a clinic subscription - will this data be shared with the clinic? No

Special category information

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing your health-related special category information is explicit consent. You provide this consent by agreeing for your data to be processed according to this Privacy Notice when you sign-up for the Tortoise app. You are able to remove your consent at any time. You can do this by contacting help@tortoise.rehab

Retention period

App data will be retained until you choose to delete your account. Relevant statutes of limitation apply for legal claims. Data surrounding data subjects rights requests will be retained for 2 years from the date the information is collected, unless subject to further investigation by the regulator. When we no longer have a reason to retain your personal data, if you withdraw your consent, or if you successfully request that we erase it, we have a process for anonymising your personal data.

Clinic subscriptions

If you sign-up to Tortoise through a clinic subscription, the following personal information will be shared with the clinic:

Name
Account data (Registration date, payment plan, subscription status)
Personal characteristics (year of birth, gender, activity level, profile picture)
Goals
Rehab
Wellness questionnaire (mood, fatigue, activity level)
Specific information about your injury (including, but not limited to -. when it occurred, what help you have already sought, how it is feeling, your progress against your goals and rehab you have done, notes)
Wearable data (activity and health data including, but not limited to steps, activities, body battery, sleep)
App usage

This information allows your rehab team to monitor your progress and update your goals and rehab plan as appropriate.

Logbook entries will not be shared with your clinic.

Data processors

We use data processors who are third parties who provide elements of services for us, including cloud based storage providers (see Appendix 1). We share your personal data with our service providers to the extent needed to enable and provide the services to you. We have contracts in place with our data processors. This means that they cannot do anything with your personal information, such as share it with other organisations, unless we have instructed them to do it. They will hold your personal data/information securely and only retain it for the period we instruct. When it is necessary for us to transfer your personal information outside of the UK this will only be done in accordance with the UK GDPR and the Data Protection Act 2018 (DPA 2018).

We do not process your financial information, such as your bank account and full credit card number. This information is provided directly to our payment service providers. Our payment service providers are themselves responsible for processing your personal data. This means you will be asked to enter into separate agreements directly with them. The personal data you provide to them will be stored in accordance with their privacy policies, which we recommend you to read carefully.

Garmin Data will not be shared with any external AI providers.

International Transfers

To deliver the service, we share information with some data processors that are registered outside of the UK. We transfer data to these processors under UK adequacy regulations or appropriate safeguards, as defined in the UK GDPR. Wherever possible, personal data is stored on servers located in the UK or EU.

How we store your personal information

Your information is securely stored. Your information is retained for the durations outlined in the table above. When you request deletion of your data, we will dispose of your personal information by using GDPR compliant deletion tools.

Your data protection rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. To take up any of your rights as listed please contact us at help@tortoise.rehab

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right here.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right here.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.

Your right to object to processing

You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests. You can read more about this right here.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. You can read more about this right here.

Your rights in relation to automated decision making or profiling

We do not undertake any automated decision-making or profiling in relation to your personal data/information.

How to make a complaint

We strive to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we may receive about this very seriously. We encourage people to inform us if they think that any collection or use of information by us is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures. You can do this by contacting us through dpo@tortoise.rehab.

If you remain dissatisfied, you have the right to make a complaint to the Information Commissioner’s Office (ICO).

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Appendix 1 - Data processors

Supabase Inc: Provision of hosting, authentication and database services
Vercel Inc: Frontend hosting services
PostHog Inc.: Analytics services
Sinch: Email delivery services
Stripe Payments Europe, Limited: Payment services
Decodifi Limited: App development services