Version 4.1 · October 2026 · Fisify Technology, S.L.
At Fisify we are committed to protecting your privacy. Fisify Technology, S.L. (tax ID B02789527), based in Bilbao, Spain, is the controller of the personal data collected through our platform and services.
If you have any questions about how we process your data, you can contact our Data Protection Officer (DPO), Egoitz Lazkano Juaristi, at any time at privacidad@fisify.com. For security incidents, write to seguridad@fisify.com.
This policy applies to everyone who interacts with Fisify, including:
When you sign up and use the Fisify app, we collect the data needed to provide the service: your name, work email and login credentials. As you use the platform, we also record your activity: the exercises you complete, how often you use it and your pain or wellbeing self-assessments. We use this information to personalise your exercise programme using artificial intelligence algorithms and to track your progress.
The reports we share with client companies are always aggregated and anonymised: we never identify specific individuals.
We also automatically collect technical data such as your IP address, device type and access logs. We use them to keep the system secure and diagnose technical issues.
The main legal basis for this processing is the performance of the service contract (art. 6.1.b GDPR). For usage data and security logs we rely on our legitimate interest (art. 6.1.f GDPR).
If you are a contact person at a client or supplier company, we process your name, job title, work email and phone number to manage the contractual and business relationship. We may also contact you with information about our services where there is a legitimate interest in doing so, under art. 6.1.f GDPR and art. 21.2 of the Spanish LSSI.
When you visit www.fisify.com we measure traffic with Google Analytics. If you accept analytics cookies, Google Analytics sets cookies and records your browsing activity pseudonymously. The legal basis is your consent (art. 6.1.a GDPR).
If you reject analytics cookies or have not yet chosen, no cookie is set on your device, but Google Analytics sends Google a cookieless technical signal for each page visited and each measured interaction. This signal includes, among other data, the page address, date and time, browser type and your IP address. We use it only to estimate the volume of visits in aggregate: it contains no persistent identifiers and does not allow us to recognise you across visits. The legal basis is our legitimate interest in knowing the aggregate volume of visits to our website (art. 6.1.f GDPR). You can object at any time from the cookie preferences panel or by writing to privacidad@fisify.com. Details are in section 8 of our Cookie Policy.
The in-person physiotherapy service requires health data. Because of its special sensitivity, we explain it in section 9.
We keep your information only for as long as necessary for the purposes for which it was collected:
If you delete your account: it is deactivated immediately and you have 7 days to recover it by signing in. After that we delete your account data and personal content. Clinical records and consents are kept blocked for 5 years as required by law (art. 17 of Spanish Law 41/2002) and then deleted. Your activity in the app (sessions, pills, points, pain levels) is kept pseudonymised, without name, email or contact details, for usage statistics.
Clinical records (Fisify Care): at least 5 years from the last visit, under art. 17 of Spanish Law 41/2002. In some regions the period is longer.
B2B contact data: 3 years from the last contact, or until you exercise your right to object.
Security logs: 12 months as a general rule, unless there is an active investigation.
Billing data: 5 years for tax obligations and 6 years for commercial-law obligations.
We do not sell or transfer your personal data to third parties for their own commercial purposes. We only share information in the following cases:
We work with technology providers that process data on our behalf and with whom we have signed the corresponding data processing agreements (art. 28 GDPR):
Contracting companies receive service effectiveness reports, always in aggregated and anonymised form. We never identify individuals in those reports.
We may share information with competent authorities (Spanish Data Protection Agency, tax authorities, courts) when we are legally required to do so or to establish or defend legal claims.
Some of our providers are located outside the European Economic Area, mainly in the United States. In all these cases we apply the corresponding legal safeguards:
If you have questions about the specific safeguards we apply to any transfer, write to privacidad@fisify.com.
Our website uses first-party and third-party cookies. Except for those strictly necessary for the site to work, we do not set any cookie without your prior consent.
The third parties whose cookies may be present on our site are: Google Analytics (web analytics), HubSpot (CRM and marketing), YouTube (embedded videos) and Cloudflare (security and performance).
If you do not accept analytics cookies, Google Analytics works in advanced consent mode: it sets no cookies, but sends cookieless technical signals to measure traffic in aggregate. You can object to this in the cookie preferences panel. We explain it in section 8 of the Cookie Policy.
The Fisify app (app.fisify.com) only uses technical cookies necessary for the service to work. We do not use analytics or marketing cookies in the app without consent.
You can manage or withdraw your consent at any time through the cookie preferences panel on our website. For detailed information on each cookie, see our full Cookie Policy.
The security of your data is a priority for us. We apply technical and organisational measures appropriate to the risk, including:
Fisify Care is our in-person physiotherapy service, provided by physiotherapists employed by Fisify at client company premises. Because this service involves creating a clinical record and processing health data, it is subject to a stricter legal regime.
In Fisify Care we collect health information: medical history, functional diagnosis, treatment progress, the physiotherapist's clinical notes and functional assessment data (such as range of motion). We also collect contact details to manage appointments and communications.
Processing health data requires explicit consent (art. 9.2.a GDPR). Before receiving any care in Fisify Care, we will ask you to sign a specific Informed Consent, a document separate from this Policy, which details the nature of the service, the scope of the clinical record and your rights as a patient under Spanish Law 41/2002 on patient autonomy.
Your clinical record will be kept for at least 5 years from the last visit, under art. 17 of Spanish Law 41/2002. In the regions where Fisify Care operates (Madrid, Castilla y León, Galicia and Andalusia) regional periods will apply if longer. You have the right to access your clinical record and obtain a copy at any time.
Fisify Technology, S.L. is the controller of Fisify Care data. The physiotherapists who treat you are Fisify employees and act under its direction, not as independent professionals.
The Fisify platform uses artificial intelligence algorithms to personalise therapeutic exercise programmes based on your profile, activity history and self-assessments. These recommendations are wellbeing suggestions: they do not constitute a medical diagnosis or clinical prescription.
We do not make any decision with significant effects on you based solely on automated processing. If we implement such features in the future, we will carry out a prior Data Protection Impact Assessment (DPIA) and update this policy.
The GDPR and the Spanish LOPDGDD grant you the following rights over your personal data:
If you are not satisfied with our reply, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es. We kindly ask you to contact us first so we can try to resolve the situation directly.
Fisify's services are intended for people over 18. We do not knowingly collect data from minors without the consent of their parents or guardians. If you become aware that a minor has provided us with data without authorisation, let us know at privacidad@fisify.com and we will delete it as soon as possible.
This policy may be updated to reflect changes in our services, applicable law or our data processing practices. When changes are relevant, we will notify you reasonably in advance through a notice on the platform or by email.
The current version will always be available at fisify.com/en/politica-de-privacidad. The date of the last update appears in the header of this document.
For any question related to privacy and data protection.
Privacy and GDPR rights Security incidents AEPDFisify Technology, S.L. · www.fisify.com · privacidad@fisify.com
Version 4.1 · October 2026
This is an English translation for information purposes. In case of discrepancy, the Spanish version prevails.
.png)
