Privacy Policy

Welcome to ViaCommuna, a health application designed to support stroke patients and their families throughout the recovery process. We are committed to protecting your privacy and ensuring the security of your personal health information. This Privacy Policy explains how we collect, use, and protect your information when you use our app and services.

As a Swiss health-focused application, we adhere to the highest standards of data protection, including compliance with the Swiss Federal Act on Data Protection (FADP), the GDPR for EU users, and Swiss healthcare regulations. Your trust is essential to us, and we are transparent about our data practices.

Two apps, one Privacy Policy

This Privacy Policy covers two applications operated by Via Communa GmbH: ViaCommuna, the stroke-recovery app, and Via Communa Physio, the app used for physiotherapy treatment in the practice and at home. The two apps process different data and are operated under different roles. Sections that apply to only one of them are marked as such at the top; every other section applies to both.

Roles in Via Communa Physio

The following applies to Via Communa Physio by way of exception to the controller named above. In Via Communa Physio, the physiotherapy practice treating you is the controller of the treatment data (controller within the meaning of Art. 5 lit. j FADP and Art. 4(7) GDPR). The practice decides which recordings are made, what they are used for, and how long they are kept. Via Communa GmbH merely provides the practice with the technical means to store that data securely and share it with you, and processes it solely on the practice's behalf and on its instructions (processor within the meaning of Art. 9 FADP and Art. 28 GDPR). We hold a data processing agreement with every practice.

For the technical data required to run the app itself — your login, authentication, and security and error logs — Via Communa GmbH is the controller.

Questions about your treatment and your treatment data should go to your practice. If you bring such a request to us, we forward it to the practice concerned and support them in answering it.

We collect different types of information to provide you with personalized stroke recovery support:

2.5 Via Communa Physio — video and audio recordings

Applies to Via Communa Physio. Sections 2.5 to 2.9 concern this app only. For the ViaCommuna stroke-recovery app, sections 2.1 to 2.4 apply.

Via Communa Physio works by recording you. During an appointment, your physiotherapist uses the app to record a short video of you performing an exercise, so that you can later train at home against a recording of your own body rather than a stock demonstration. These recordings are the core of the service; the app cannot deliver its purpose without them.

The app requests access to your device's camera and microphone for this purpose and for no other. It does not access your photo library, and recordings are not saved to your device's camera roll. Recording is always initiated deliberately by your physiotherapist within a session; the app never records in the background and cannot be triggered remotely.

2.6 Exercise and treatment data

Alongside the recording we store the exercise your physiotherapist prescribed (its title, written instructions, and the prescribed dose — sets, repetitions, hold or duration, how often per week), and what you record afterwards at home: whether you completed the exercise, a pain rating from 0 to 10, how difficult it felt, and any comment you write.

2.7 Messages

Messages exchanged between you and your physiotherapist in the app, together with automatic notifications generated when you complete an exercise or report a high pain score.

2.8 Account information

For physiotherapists, an email address, used solely to send a six-digit sign-in code. For patients, an email address only if you choose to provide one — you may use the app without one, in which case your account exists only on your device (see «Using the app without an email address» in section 6.3). We also store the display name you or your physiotherapist give you, and the language you have chosen to read the app in.

2.9 Reminder settings stay on your device

If you set exercise reminders, the times and days are stored on your phone and are never uploaded. Your physiotherapist cannot see them.

We use your information exclusively to provide and improve our stroke recovery services:

Your health information receives special protection under Swiss and international medical privacy laws. It qualifies as particularly sensitive personal data under Art. 5 lit. c FADP:

4.4 Via Communa Physio — recordings as health data

Applies to Via Communa Physio. The following paragraphs concern this app only.

Recordings are health data. A video of you performing a prescribed therapeutic exercise, made at your physiotherapist's direction as part of your treatment, is data concerning health under Art. 9 GDPR and sensitive personal data under Art. 5 lit. c FADP. We treat it as such regardless of how it is categorized in any app store's privacy label, whose taxonomies classify it as «user content». That store classification is a labelling convention and does not lower the protection the recording receives here.

Who can see a recording. Only you and the physiotherapist who recorded it. Recordings are held in private storage, are never publicly addressable, and are retrieved only through short-lived signed links issued to one of you. Other physiotherapists using the app — including others in the same practice — cannot see them. We do not view recordings in the ordinary course of operating the service.

Where recordings are stored. In our hosting provider's Zurich, Switzerland region, encrypted in transit and at rest.

Consent. Before a patient is connected to a physiotherapist, the app records that the patient has confirmed their consent to being recorded, and stores the date and time of that confirmation. Consent may be withdrawn at any time by disconnecting from the practice or by deleting your account.

We only share your information in specific, controlled circumstances:

You have full control over your personal information and health data under Swiss and international law:

Via Communa Physio — using the app without an email address

Applies to Via Communa Physio. The following paragraphs concern this app only.

Using the app without an email address. As a patient you can use Via Communa Physio without giving us any contact details. Your account is then held only on the device you started on: we cannot connect it to you as a person, and we cannot recover it if you lose or replace the phone. You may attach an email address later to secure access, and doing so is the only point at which we learn one.

This has a consequence for your rights that we would rather state than let you discover: if you have not attached an email address, we cannot identify your account from outside the app. Access, export and deletion are all available inside the app, on the device that holds the account. A request sent to us by email cannot be matched to an account we have no identifier for, and we will not act on a request we cannot verify.

Via Communa Physio — rights towards your practice

Applies to Via Communa Physio. Your physiotherapy practice is the controller of the treatment data held in Via Communa Physio. Requests for access, rectification or erasure of that data should therefore be addressed to the practice, and we support them technically in answering. Independently of that, you can export and delete your account and your data yourself in the app at any time — section 8 explains how.

We retain your information only as long as necessary for the agreed purposes or as required by statutory retention obligations:

7.1 ViaCommuna (stroke recovery)

Applies to the ViaCommuna stroke-recovery app. For Via Communa Physio, section 7.2 applies.

7.2 Via Communa Physio

Applies to Via Communa Physio. The following paragraphs concern this app only.

Recordings and treatment data are kept until deleted. We do not apply an automatic expiry to recordings, exercise plans or check-ins: an exercise plan that expired on a schedule would stop working mid-treatment. They are retained for as long as your account exists, and are removed when you delete it.

Disconnecting is not deletion. If you disconnect from a practice, your existing entries remain part of that practice's treatment documentation. Your physiotherapist stops receiving new entries.

Backups. We do not currently keep restorable backup copies of this data, so deletion is immediate and final rather than propagating over a backup cycle.

Applies to Via Communa Physio. This section explains how to delete your account and your data in Via Communa Physio. For the ViaCommuna stroke-recovery app, sections 6 and 7.1 apply; the email route and the 30-day deadline below, however, apply to both apps.

The fastest route is in the app. Open Profil → Datenschutz → Konto löschen (patients) or Konto (physiotherapists) and confirm. Deletion takes effect immediately. Nothing is queued for review, and there is no waiting period. The app also offers Meine Daten exportieren, which gives you everything we hold about you as a single file, including links to your recordings.

If you cannot use the app — you no longer have it installed, you have lost access to your device, or you would simply rather write to us — send a deletion request to:

privacy@viacommuna.com

with the subject line «Account deletion — Via Communa Physio». Please write from the email address associated with your account, so that we can verify the request is yours. We carry out the deletion within 30 days of receiving your request at the latest, and confirm it to you in writing.

What gets deleted. For patients: your video recordings, your exercise history, your pain ratings and comments, your messages, your profile, and your login. For physiotherapists: your profile, your recordings, and your login; your patients keep their own treatment history, which belongs to them and not to you.

What is kept, and why. Your entries form part of the treatment documentation held by the practice that treated you, and your physiotherapist may be under a professional or statutory obligation to retain that documentation for a period set by law. Deleting your account removes your data from our systems; it does not, and cannot, discharge your practice's own record-keeping obligations. Direct questions about treatment documentation to your practice.

If you never gave us an email address. Patients may use the app without an account. If you did, we hold no identifier that would let us find your data from a written request — there is nothing to match your email against. In that case deletion is available only in the app itself, on the device that holds the account.

Your data may be processed in different countries with appropriate safeguards:

To operate our services we rely on carefully selected providers who process personal data on our behalf. We maintain a Data Processing Agreement (DPA) with every provider listed below, in accordance with Art. 9 FADP and, where applicable, Art. 28 GDPR. Where a provider processes data outside Switzerland and the EEA, the transfer relies on the safeguards described in section 9.

Via Communa Physio uses no other providers. The app contains no analytics SDK and no Google components, and reaches no other provider at runtime.

The website's fonts are served from our own servers; no data is transmitted to Google when you load the site.

Changes to this list will be reflected in this Privacy Policy. Users will be informed in advance of material changes (e.g. the addition of a third-country provider).

Special protections for users under 16:

In the event of a data breach that may result in a high risk to the rights of data subjects:

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements:

Contact us regarding privacy concerns:

We respond to all privacy inquiries within 72 hours and aim to resolve issues within 30 days. You have the right to lodge complaints with the FDPIC.