RehabCardia ("the App", "we", "us") is a digital cardiac rehabilitation platform that connects patients recovering from cardiac events with their treating doctors, who assign exercises, monitor progress, and communicate through the App. This policy explains what data we collect, why, and the choices you have.
RehabCardia accounts are created by your healthcare provider (your doctor or the clinic administrator). You cannot self-register. By using the credentials given to you, you consent to the processing described in this policy as part of your care program.
Information your care team provides: first name, last name, email address; your assigned doctor, rehabilitation plan, and prescribed exercises (sets, repetitions, schedule, duration).
Information generated as you use the App: exercise and session completion data; post-workout feedback such as pain level, difficulty rating, and optional notes; chat messages with your care team; appointments and confirmations; login timestamps used for account security and clinical audit; and a Firebase Cloud Messaging token used to deliver reminders and notifications.
Information collected automatically: basic technical information needed for the App to function (authentication state, app version). We do not collect your precise location, contacts, photos (except media you explicitly attach), or browsing history.
We do not use your data for advertising, profiling unrelated to your care, or sale to third parties.
Your data is stored in Google Firebase (Cloud Firestore, Firebase Authentication, Firebase Cloud Storage), operated by Google LLC. Data is encrypted in transit (TLS) and at rest. Access is restricted by role-based security rules: patients can only access their own records; doctors can access records of patients under their care; administrators access data solely for clinical and operational management.
Exercise demonstration videos may be hosted as unlisted videos on YouTube. These videos are instructional content produced by the care team and do not contain patient data.
We do not share your personal data with any other third party unless required by law.
Your records are retained for as long as your account is active, as part of your clinical care record. If your account is deleted by your clinic, your profile and associated care data (plans, assignments, sessions, messages, notifications) are deleted from our active systems. Residual copies in encrypted backups are purged on the backup rotation cycle.
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, or to object to or restrict its processing. Because your account is managed by your healthcare provider, please direct requests to your clinic, or contact us directly at the address below. We will respond within 30 days.
To request account deletion, contact your clinic or email us at the address below. You can also follow the steps on our account deletion request page. Deletion of clinical records may be subject to medical record retention laws applicable to your provider.
RehabCardia is intended for adult cardiac rehabilitation patients and is not directed at children under 18. We do not knowingly collect data from children.
We use industry-standard safeguards: encrypted transport (HTTPS/TLS), encrypted storage, role-based access rules enforced on the server, encrypted on-device preference storage, and Play Integrity–backed app verification. No method of storage or transmission is 100% secure, but we work to protect your data with appropriate technical and organisational measures.
We may update this policy from time to time. Material changes will be communicated through the App or by your clinic. The "Last updated" date at the top reflects the latest revision.
RehabCardia support
Email: sr.cardiocare@gmail.com
If you believe your data has been handled in a way that does not comply with this policy, please contact us and we will investigate promptly.