Privacy notice

Qumira is care-plan software for practitioners — human physiotherapy, rehab and sports therapy, and animal practices (vets, hydrotherapy, animal rehab and trainers). This notice describes how Qumira("we", "us") handles personal data.

Qumira is Qumira, a sole proprietorship. For the personal data that practitioners enter about their own patients or owners, the practice is the data controller and Qumira acts as a processor on their behalf. For account and billing data we hold about practitioners themselves, we are the controller.

We collect:

• Account data — your name, email, sign-in details and preferences.
• Practice data — your practice name, domain (human or animal), branding, team members and settings.
• Patient / owner data entered by practitioners — visit notes, care plans, progress logs and messages you create or record for the people and animals in your care.
• Usage and technical data — basic logs needed to run, secure and improve the service. [confirm]

We use personal data to:

• provide the service — creating, sharing and tracking care plans;
• authenticate users and keep accounts and data secure;
• respond to support requests and communicate about the service;
• maintain, troubleshoot and improve Qumira. [confirm lawful bases — e.g. contract, legitimate interests, consent]

We do not sell personal data, and we do not use the patient or owner data you enter to train public AI models. [confirm]

We rely on a small number of trusted providers to run the service, for example:

• cloud hosting and managed PostgreSQL database — Neon; app hosting and analytics — Vercel;
• transactional email — Resend;
• file/object storage — Cloudflare R2;
• AI processing used to draft care plans from your notes — Anthropic (Claude). Your notes are sent to generate a draft; they are notused to train Anthropic's models.

This list is kept current; we'll give notice of material changes to our sub-processors. [confirm change-notice mechanism]

We serve practices in the United Kingdom and South Africa. Data is held in a managed PostgreSQL database (Neon) hosted in the EU/UK region. [confirm exact hosting region] Where a provider (for example our AI or email sub-processors) processes data outside that region, we put appropriate safeguards in place — such as standard contractual clauses. [confirm transfer mechanism]

We keep personal data for as long as your account is active and as needed to provide the service, then delete or anonymise it within a reasonable period, unless we're required to keep it longer by law. Practitioners control the patient/owner records in their practice and can delete them. [confirm retention periods]

Subject to applicable law (UK GDPR / GDPR), you have rights to access, correct, export, delete and restrict the processing of your personal data, and to object to certain processing.

Within Qumira, practitioners can export the data held about a client and request its erasure when it's no longer needed. To exercise your rights, or if a practice is the controller of your data, contact us and we'll help. [confirm process]

We use a small number of cookies (or similar technologies) that are necessary to sign you in and keep the service working (a secure, http-only session cookie), plus privacy-friendly product analytics (Vercel) to understand usage. We do not use advertising or cross-site tracking cookies. [confirm final cookie table]

Questions about this notice or your data? Email us at hello@qumira.app. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office (ICO); in South Africa, the Information Regulator. [confirm any UK/EU representative or DPO]

See also our Terms of Service.