Draft — pending legal review
This document is a working skeleton. It has not been reviewed by counsel and must not be relied on by users, partners, or staff. Final text will be published once reviewed against HIPAA (US), Costa Rica Ley 8968 / Reglamento N° 37554-JP, and Florida FIPA / FDBR.
Privacy Policy
Effective date: to be determined
Jurisdictional scope
Fisionow processes personal data of users in Costa Rica, Mexico, and the United States (initially Florida). This policy must satisfy: HIPAA where US Protected Health Information (PHI) is in scope; Costa Rica Ley 8968 and its Reglamento N° 37554-JP, including PRODHAB registration where databases of personal data are maintained; applicable Mexican federal data-protection law; Florida FIPA for breach-notification timing; and the Florida Digital Bill of Rights where in scope. Each section below must reflect the regime that applies.
Roles and responsible party
Placeholder. Identify the Fisionow legal entity acting as data controller for its own processing, and clarify the Business Associate posture toward US physiotherapists who are HIPAA Covered Entities. Include the registered office address and the Data Privacy Officer / Responsable contact.
Personal data we collect
Placeholder. Account data, professional credentials, patient-record content entered by physiotherapists, scheduling and treatment data, payment metadata (handled by Stripe), device and analytics signals. Mark sensitive categories explicitly (health data, professional license numbers).
How we use personal data
Placeholder. Service operation, scheduling, payments, customer support, product analytics, security and fraud prevention, legal compliance.
Legal bases (Costa Rica Ley 8968 / EU-style framing)
Placeholder. Per processing purpose: consent, contract performance, legal obligation, legitimate interest. Sensitive-category data requires explicit informed consent under Ley 8968.
Sharing and sub-processors
Placeholder. List of categories of recipients (payment processors, hosting, email/SMS providers, calendar APIs, observability, customer-support tooling). Each sub-processor handling US PHI must sign a BAA. Maintain a public sub- processor list.
International data transfers
Placeholder. Data flows between Costa Rica, Mexico, and the US. Note Ley 8968 cross-border transfer requirements and the safeguards in place (contractual clauses, equivalent-protection assessment).
Retention
Placeholder. Per-category retention periods. Note HIPAA-mandated minimum retention (e.g., 6 years for certain documentation in the US) and how patient- medical records are retained and disposed of.
Your rights
Placeholder. Per regime: access, correction, deletion, portability, objection, consent withdrawal. Costa Rica residents may also lodge complaints with PRODHAB; Florida residents may exercise FDBR rights where applicable. Describe how to submit a request and our response SLA.
Security measures
Placeholder. Encryption at rest and in transit, access controls, MFA enforcement for staff, audit logging, vulnerability management, incident response runbook, training. HIPAA technical and administrative safeguards must be enumerated.
Breach notification
Placeholder. Florida FIPA requires notification within 30 days; HIPAA Breach Notification Rule requires notification within 60 days. Describe how affected users and authorities are notified.
Cookies and tracking
Placeholder. Categories of cookies and trackers, lawful basis, opt-out mechanism.
Children's data
Placeholder. Fisionow is not directed at children. Where minor patients receive care from a Fisionow physiotherapist, the treating professional is responsible for the parental-consent process; this section describes our handling obligations.
Changes to this policy
Placeholder. Notice mechanism for material changes and effective-date handling.
Contact
Privacy and data-rights requests: privacy@fisionow.com. General support: support@fisionow.com.