Privacy Policy

Orthonomics · Last updated: March 2026

1. Who We Are

Orthonomics is a professional occupational health tool designed for orthopaedic surgeons at Venizeleio General Hospital of Heraklion, Greece. It is developed at the University of Crete (Computer Science Department) under the academic supervision of Prof. Haridimos Kondylakis and the medical supervision of Dr. Konstantinos Zampetakis. Lead Developer: Nikolaos Kanakousakis. The application helps surgeons log work-related incidents, track musculoskeletal symptoms, and access evidence-based ergonomics education.

Data controllers: FORTH-ITE (Foundation for Research and Technology - Hellas), in cooperation with Venizeleio General Hospital, Heraklion.

2. Data We Collect

• Account data: name, email address, medical specialty.
• Health data (Article 9 GDPR): self-reported incident details, pain scores (VAS), affected body regions, symptom history, and wellness responses. This is special-category data and is processed only with your explicit consent.
• Usage data: module progress, quiz scores, notification preferences.
• Technical data: device type, app version, timezone (required for scheduling reminders).

3. Legal Basis for Processing

Health data is special-category data under GDPR Article 9. We process it under Article 9(2)(a) - explicit consent, which you provide during onboarding and can withdraw at any time. All other data is processed under Article 6(1)(b) (performance of the service you requested) and Article 6(1)(f) (legitimate interest in improving occupational health outcomes).

4. How We Use Your Data

• Display your personal incident history and symptom trends within the app.
• Track your progress through educational modules and quizzes.
• Send you reminders for microbreaks and stretching (only if you enable them).
• Generate aggregated, anonymised statistics for research purposes (individual users are never identifiable).

We do not use your data for marketing, advertising, or any commercial purpose.

5. Data Storage & Security

• Authentication tokens are stored in the device's secure enclave (iOS Keychain / Android Keystore) via Expo SecureStore.
• Cached incident data is stored in the device's local AsyncStorage for offline access.
• Server data (account info, incidents, progress) is stored on secure servers hosted at FORTH-ITE (Foundation for Research and Technology - Hellas), Heraklion, with encryption in transit (HTTPS/TLS), access restricted to the development team.

We apply industry-standard security controls. No internet transmission is 100% secure; please use a strong, unique password.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for commercial purposes.

We may share anonymised, aggregated statistics with academic supervisors for research. Google Gemini AI processes your text queries to the in-app assistant; no identifiable health data is sent - see Google's privacy policy.

7. Data Retention

Your data is retained for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days. Anonymised aggregates derived from your data may be retained indefinitely for research.

8. Your Rights (GDPR)

Under GDPR you have the right to:

• Access a copy of your personal data (Article 15).
• Rectify inaccurate data (Article 16).
• Erase your data ("right to be forgotten", Article 17).
• Portability - export your data in a machine-readable format (Article 20).
• Withdraw consent at any time without affecting prior processing (Article 7(3)).
• Object to processing (Article 21).
• Lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

To exercise any of these rights, contact us at supportorthonomics@gmail.com.

9. Children

This app is intended for medical professionals aged 18 and older. We do not knowingly collect data from minors.

10. Changes to This Policy

Material changes to this policy will be reflected on this page, with the "Last updated" date revised accordingly. Continued use of the app after a change constitutes acceptance of the updated policy.