Legal · App
Andama app — privacy notice
Applies from when the Andama app opens to patients. The app isn't open to patients yet. We publish this now so you can read it in advance; if anything changes before launch, we'll update it here.
Last updated: 28 October 2026 · Version 1.0
Who we are
The Andama app is operated by App Andama Technology Ltd, a company registered in the Republic of Cyprus, with its registered office at Savva Rotsidi 8, Agios Dometios, 2364 Nicosia, Cyprus ("Andama", "we"). Our registration number will be added here shortly. Contact: info@andama.app.
Two roles, so you know who to ask
Your care — your plan, check-ins, progress, messages, photos, videos and voice notes, and your physiotherapist's notes — is between you and your physiotherapist. They decide what is collected for your care and why, so they are responsible for it (the "controller"). Their privacy notice, shown in the app before you share anything, explains it. Andama stores and runs that information for them under a data processing agreement and uses it only on their instructions.
Running the app itself — your account, keeping it secure, reminders, ratings you choose to publish, and messages you send us — is Andama's responsibility. This notice covers that part.
What we use, why, and for how long
- Your account — name, email, password (stored only as a secure hash), language and app settings, and which physiotherapists you're connected to. Why: to give you an account and sign you in (contract, GDPR Art 6(1)(b)). How long: while you have an account; deleted within 30 days after you delete it.
- Security — IP address, device type, app version, sign-in and security logs. Why: to protect your account and stop misuse (our legitimate interest, Art 6(1)(f)). How long: 90 days.
- Reminders — the reminder time you choose and a notification token for your device. Why: to send the reminders you asked for (contract, Art 6(1)(b)). You can turn them off at any time. How long: until you turn them off or delete your account.
- Ratings you publish — your score, your words, the type of plan and the month (for example "Knee plan · Jun 2026"), and, only if you choose to sign it, your first name, last initial and the month you joined Andama ("on Andama since Apr 2026"). Because the type of plan says something about your health, we publish a rating only with your explicit consent, which you give when you post it (Art 9(2)(a)). You can edit it for 14 days and delete it at any time. How long: until you delete it or your account. After you delete a rating we keep only the date it was first posted, so the 14-day edit window can't be restarted by deleting and re-posting (our legitimate interest in fair ratings, Art 6(1)(f)); deleting your account removes that date too.
- Usage statistics — which screens and features are used (for example "opened the plan"), device type, app version and a random ID that isn't linked to your name or email. Never your health information, check-ins, messages, photos, videos or anything you write. Why: to see which parts of the app help and improve them. Only with your permission (consent, Art 6(1)(a)), which you give or refuse when you join and can change any time in the app's settings. How long: 12 months.
- Error reports — if the app crashes or something fails: device type, app version and technical details of the error, with your health information and messages left out. Why: to find and fix problems (our legitimate interest, Art 6(1)(f)). How long: 90 days.
- Messages to us — what you write to info@andama.app. Why: to answer you (our legitimate interest, Art 6(1)(f)). How long: up to 12 months after the conversation ends.
We don't use advertising tools in the app, and we never use your information for advertising.
You need an account to use the app; ratings are optional. When your physiotherapist invites you, we may receive your name and email from them. We don't make decisions about you based only on automated processing.
Who helps us run the app
Providers that act on our instructions under contract: Supabase (database, sign-in and file storage, servers in Frankfurt, EU), Cloudflare (hosting and network security), Google Workspace (email), Resend (sign-in and account emails), Expo (app notifications, delivered through Apple and Google), Sentry (error reports, EU servers) and PostHog (usage statistics, EU servers — only if you allow it). We keep this list current. We don't sell personal data or use it for advertising, and we share it with authorities only when the law requires.
Where your data is
App data is stored in the European Union (Frankfurt). Some of our providers are US companies and may access data from outside the European Economic Area; when they do, the transfer is protected by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards.
Deleting your account
You can delete your account in the app. We delete your account, settings and published ratings. Information that is part of your care is kept for your physiotherapist, who may have to hold health records for a period the law requires; their privacy notice says what they keep and for how long.
Your rights
You can ask us to access, correct or delete your data, to restrict how we use it, and to receive it in a portable form. Where we rely on our legitimate interest, you can object at any time. You can withdraw consent at any time — for example by deleting a rating — without affecting what happened before. For information about your care, ask your physiotherapist; if you write to us, we'll pass your request to them and help them answer. We reply within one month.
You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus.
Age
The Andama app is for people aged 18 and over.
Changes
If this notice changes, we'll update it here, change the date at the top and, for important changes, tell you in the app.