Privacy Policy

Introduction

Acubia ("we," "our," or "us") operates the Acubia exercise prescription platform available at acubia.com and related mobile and web applications (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Service.

Acubia is designed for healthcare practitioners and their patients. We take the privacy of health-related information seriously and are committed to handling it responsibly.

Information We Collect

Practitioner Account Information

When a healthcare practitioner registers for Acubia, we collect:

• Full name (first and last)
• Professional email address
• Password (stored as a one-way cryptographic hash — never in plain text)
• Subscription plan and billing information (processed by Stripe; we do not store full card numbers)

Patient Information

Acubia is designed with patient privacy by default. When a practitioner creates a prescription, we store:

• Patient initials only — never full names, dates of birth, or other identifying information
• Exercise prescriptions assigned to that patient (exercises, sets, reps, and clinical notes)
• Prescription status (active, expired, or revoked)
• Anonymous delivery receipt data when a patient views their prescription (timestamp, approximate device type)

By design: Acubia does not store patient names, contact information, dates of birth, medical diagnoses, or health insurance details.

Automatically Collected Information

• IP addresses (retained temporarily for security and rate-limiting purposes)
• Browser and device type (for display optimization)
• Usage logs (pages visited, actions taken) for service improvement

How We Use Your Information

• To provide and maintain the Acubia Service
• To authenticate practitioners and authorize access to their prescriptions
• To generate shareable prescription links and QR codes
• To send transactional emails (account creation, subscription updates)
• To detect and prevent fraud, abuse, or unauthorized access
• To improve the Service through aggregate, anonymized analytics

How We Store and Protect Your Data

All data is stored in an encrypted PostgreSQL database hosted on secure cloud infrastructure. We implement the following protections:

• Encryption at rest: Database storage is encrypted. Patient health information fields are additionally protected with application-level encryption.
• Encryption in transit: All communication between your device and our servers uses TLS (HTTPS). Unencrypted HTTP connections are rejected.
• Access controls: Practitioners can only access prescriptions they created. No cross-practitioner data access is permitted.
• Audit logging: All access to and modifications of prescription data are logged with timestamps and user identity for security review.
• Session security: Access tokens expire after 8 hours. Refresh tokens expire after 7 days.

Data Retention

• Prescriptions: Expire and become inaccessible to patients after 180 days by default (or the practitioner-configured expiry). Expired prescriptions are retained in the database for 90 additional days for audit purposes, then permanently deleted.
• Account data: Retained while your account is active. Deleted within 30 days of account closure upon request.
• Audit logs: Retained for 1 year for security and compliance purposes, then permanently deleted.

Sharing of Information

We do not sell your personal information or patient data to any third party. We may share information only in the following limited circumstances:

• Service providers: Infrastructure partners (database hosting, email delivery) who process data on our behalf under strict data processing agreements.
• Payment processing: Stripe processes subscription payments. We share only what is necessary for billing.
• Legal requirements: If required by applicable law, court order, or governmental authority.
• Business transfer: In the event of a merger or acquisition, your data may be transferred. You will be notified in advance.

HIPAA Considerations

Acubia operates in the healthcare space and takes HIPAA seriously. The platform is designed to minimize PHI (Protected Health Information):

• Patient full names are never collected or stored — only initials
• No direct patient contact information is stored
• Prescriptions are accessed via anonymous short-codes and QR codes
• Practitioners using Acubia as a Business Associate should contact us at support@acubia.com to establish a Business Associate Agreement (BAA).

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Request restriction of processing
• Data portability

To exercise any of these rights, contact us at support@acubia.com. We will respond within 30 days.

Cookies and Tracking

The patient-facing prescription portal does not use cookies or tracking technologies. The practitioner dashboard uses strictly necessary session cookies for authentication. We do not use advertising cookies or third-party tracking pixels.

Children's Privacy

Acubia is designed for use by licensed healthcare practitioners. The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided personal information, contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered practitioners of material changes via email at least 14 days before they take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Contact Us

For privacy-related questions, data requests, or to report a concern: