Last updated 15 July 2026
In short: your data is encrypted in transit, stored privately per user, never sold, and never used for advertising. It is stored and processed entirely within the EU — including our AI. You can export or permanently delete it at any time.
1. Who we are
InjuryLog ("we", "us", "our") provides a personal injury and recovery companion app. This policy explains what personal data we collect, why, and the rights you have over it. If you have any questions, contact us at info@injurylog.ai.
2. Information we collect
- Account information you provide, such as your email address and sign-in identifier (email, Apple, or Google).
- Injury and recovery data you choose to log, including injuries, body-map locations, goals, daily check-ins, notes, and recovery status.
- Documents you upload to your Injury Vault, such as scans, MRIs, prescriptions and reports.
- Care cost entries you add, such as appointments, physio, and gear.
- Basic device information needed to run the app, such as app version and device type.
We do not bundle any third-party analytics, advertising, or crash-reporting SDK, and we do not collect your location, contacts, or browsing history. (Apple and Google may collect their own diagnostic data at the operating-system level, governed by their policies rather than ours.)
3. How we use your data
We use your data to provide the app's core features: to store your records, track your recovery against your goal, generate educational recovery insights, and keep your account secure. We also use aggregated, non-identifying usage data to improve the product.
4. AI recovery insights
When you request an AI recovery assessment or a Physio Visit Pack, relevant logs you have entered are processed to produce educational insights and an estimated return window. These insights are educational recovery support, not medical advice, and never a diagnosis. Recovery timelines are estimates, not promises. Always consult a qualified healthcare professional for medical decisions.
AI requests are sent through our own secure server-side gateway to our AI provider, Mistral AI SAS (France), and are processed entirely within the European Union. We send only the injury text you choose to submit — never your name, email, or account identifiers. Your data is not used to train third-party AI models.
Document summaries. When you choose AI Read on a document in your Injury Vault, that document (PDF or image) is processed by Mistral Document AI — within the EU — to extract its written text, which is then summarised in plain English. This happens only when you request it, only for the document you choose, and the document is not used to train AI models. Interpreting medical imaging remains your clinician's job: Pulse summarises the words in a report; it does not, and cannot, diagnose from the images themselves.
5. How we share data
We do not sell your personal data, and we do not use it for advertising. We share data only with the service providers below, who act as our processors under contract and may use your data only to deliver their part of the service:
- Supabase — account, database and encrypted document storage. Hosted in the EU (Ireland).
- Mistral AI SAS (France) — AI recovery insights, processed in the EU (see section 4).
- RevenueCat, with the App Store and Google Play — subscription status and billing. Apple and Google process the payment; we never see your card details.
- Apple / Google — only if you choose to sign in with them, to verify your identity.
- Expo — delivering push notifications, only if you enable reminders.
We may also disclose data where required by law.
6. Storage, security and where your data lives
Your data is encrypted in transit and stored in private, per-user storage hosted within the EU (Ireland). Our AI provider is also in the EU (France), so your health data is not transferred outside the EU/EEA. We apply appropriate technical and organisational measures to protect it against unauthorised access, loss, or misuse.
7. Your rights
Under the GDPR and applicable law, you have the right to access, correct, export, and delete your personal data, and to object to or restrict certain processing. You can permanently delete your account and all associated data in one tap under Profile then Delete Account, or by emailing info@injurylog.ai. To make any other request, contact us at the same address.
8. Data retention
We keep your data for as long as your account is active. When you delete your account, we permanently remove your associated data within 30 days, and it is purged from encrypted backups within 90 days. Billing and subscription records may be kept for up to 7 years where tax and financial law requires it.
9. Children
InjuryLog is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will remove it.
10. Changes to this policy
We may update this policy from time to time. We will post the updated version here and revise the "last updated" date above. Material changes will be communicated in-app or by email.
11. Contact
Questions about your privacy or this policy? Email info@injurylog.ai.