OsteoFlow

Summary

OsteoFlow Assess is built by AK BioSystems for physiotherapy and osteopathy professionals to record and organise their own practice: records of the people they see, appointments, assessment notes and the finances of the practice. The app writes to the device first and syncs to a server afterwards, so it works without a connection. There is no advertising, no analytics, no crash reporting and no third-party SDK beyond the sync service itself.

Who is responsible for the data

The professional who uses OsteoFlow is the controller of the data about the people they see: they decide what to record, why, and for how long. AK BioSystems acts as the processor, handling that data only to provide the app and following the professional's instructions. This distinction matters because most of the data in OsteoFlow belongs to people who never installed the app.

Data handled

Professional account: identification and sign-in credentials. The professional may fill in their name, professional registration number, specialty and tax ID - all optional - so that these appear on reports and receipts; the app works without them. If the cloud copy is enabled, these details travel with the encrypted copy, so they need not be retyped on every device. This is the professional's own data, not data about the people they see. Records of the people seen: name, contact details and document. Health data: assessment records, findings and progress notes, in adult and paediatric versions - this is sensitive data. Audio recordings of sessions and dictations, if the professional uses recording: stored only on the device where they were made, never sent to the cloud copy, and kept until the professional deletes them (the app suggests deleting old ones when they take up a lot of space). Deleting a person deletes their recordings. Practice data: appointments, amounts, payments, receipts and the monthly summary. On the device: an unlock PIN, held in the operating system's secure storage.

Where the data lives

Written locally on the device first and synced afterwards, if the professional turns on the cloud copy. That copy is encrypted on the device itself with AES-256, using a sync key that only the professional knows and that is never sent anywhere: the server stores the file without being able to read it. It sits on Supabase servers in the Brazil region (São Paulo); there is no international transfer of data. Each account can reach only its own file, a rule enforced on the server itself (row-level security), not merely in the app's screens. The professional can also export a password-encrypted backup to a folder of their choice and, on a computer, turn on an automatic daily copy to that folder; those files stay wherever the professional keeps them.

Google Calendar (optional)

Only if the professional turns it on in Settings → Google Calendar and grants the calendar permission on Android. The app then writes the appointments to the calendar the professional chooses on the device, which Google syncs with that Google account. Only the client name, session type, date, time and location are sent; notes and assessment data never leave the app. Rescheduling updates the event, and cancelling or deleting removes it. Those events are then subject to Google's privacy policy. The connection can be turned off at any time, and the app does not read the professional's other events.

Artificial intelligence (optional)

Only if the professional saves their own API key (Anthropic, OpenAI or Google) in Settings → Artificial intelligence and accepts the notice shown before first use; without a key the feature does nothing. When they use it, the app sends straight from their device to the AI company they chose the clinical text they typed or dictated and, for audio intake, the recording file itself. Once the AI returns its result, the app asks the professional whether to keep the audio on the device to listen to later or to delete it. AK BioSystems does not receive, store or process that content: the call leaves the device with the professional’s own key, and what the AI company does with the data follows that company’s policy, including possibly using the content to train models, which happens on some free plans. Before recording — with or without AI — the app asks the professional to confirm they have the client’s authorisation for the recording, which stays on the device until deleted; the professional is the controller of this data and answers for that authorisation. The key is held in the operating system’s secure storage on the device and is never sent to AK BioSystems.

Security

Encryption in transit (HTTPS). The cloud copy and the backups travel and are stored encrypted with the professional's key or password. On the device, the data sits in the app's private storage, protected by the operating system's own encryption (on by default on Android and iPhone; on Windows it depends on BitLocker being turned on) and by the app's unlock PIN. No sensitive data in logs or error messages.

Your rights and deletion

The app allows deleting a single appointment, deleting a person along with their whole history, and deleting the entire account with the data attached to it. Data about a person can be exported in a readable format. Requests from the people seen - access, correction, portability or deletion - should be addressed to the professional who recorded the data, since they are the controller; AK BioSystems supports the professional in fulfilling them. Step-by-step instructions for deleting your account and data.

Keeping records

Professional bodies set minimum retention periods for practice records, and it is the professional using OsteoFlow who is bound by them - in Brazil, COFFITO Resolution 414/2012 requires records to be kept for at least five years from the last entry. Deleting the account erases the data from our servers and cannot be undone, so export whatever you are required to keep before you delete.

What we do not do

We do not sell or share data with third parties; the Google Calendar connection and the sending to artificial intelligence only happen if the professional turns them on, with their own key and by their own action. We do not use the data for advertising. We do not use data about the people seen for any purpose other than providing the app to the professional who sees them.

Important notice

OsteoFlow Assess is a tool for recording and organising professional practice. It records and organises what the professional observed; it does not draw conclusions on their behalf, does not perform medical diagnosis and does not replace professional assessment. The exercise library stores the choice the professional made and prints it in the report - it does not propose or select anything.

Data protection officer

Privacy questions, and requests from the people whose data we hold or from the authorities, can be sent to contato@akbiosystems.com.br, the channel AK BioSystems keeps for that purpose.

Contact

contato@akbiosystems.com.br