Last updated 24 October 2026
In short: your data is encrypted in transit, stored privately per user, never sold, and never used for advertising. It is stored and processed entirely within the EU, including our AI. You can export or permanently delete it at any time.
1. Who we are
InjuryLog ("we", "us", "our") provides a personal injury and recovery companion app. This policy explains what personal data we collect, why, and the rights you have over it. If you have any questions, contact us at support@injurylog.ai.
2. Information we collect
- Account information you provide, such as your email address and sign-in identifier (email, Apple, or Google).
- Injury and recovery data you choose to log, including injuries, body-map locations, goals, daily check-ins, notes, and recovery status.
- Documents you upload to your Injury Vault, such as scans, MRIs, prescriptions and reports.
- Care cost entries you add, such as appointments, physio, and gear.
- Basic device information needed to run the app, such as app version and device type.
We do not bundle any third-party analytics, advertising, or crash-reporting SDK, and we do not collect your location, contacts, or browsing history. (Apple and Google may collect their own diagnostic data at the operating-system level, governed by their policies rather than ours.)
3. How we use your data
We use your data to provide the app's core features: to store your records, track your recovery against your goal, generate educational recovery insights, and keep your account secure. We also use aggregated, non-identifying usage data to improve the product.
4. AI recovery insights
When you request an AI recovery assessment or a Physio Visit Pack, relevant logs you have entered are processed to produce educational insights and an estimated return window. These insights are educational recovery support, not medical advice, and never a diagnosis. Recovery timelines are estimates, not promises. Always consult a qualified healthcare professional for medical decisions.
AI requests are sent through our own secure server-side gateway to our AI provider, Mistral AI SAS (France), and are processed entirely within the European Union. We send only the injury text you choose to submit, never your name, email, or account identifiers. Your data is not used to train third-party AI models.
Document summaries. When you choose AI Read on a document in your Injury Vault, that document (PDF or image) is processed by Mistral Document AI, within the EU, to extract its written text, which is then summarised in plain English. This happens only when you request it, only for the document you choose, and the document is not used to train AI models. Interpreting medical imaging remains your clinician's job: Pulse summarises the words in a report; it does not, and cannot, diagnose from the images themselves.
5. How we share data
We do not sell your personal data, and we do not use it for advertising. We share data only with the service providers below, who act as our processors under contract and may use your data only to deliver their part of the service:
- Supabase: account, database and encrypted document storage. Hosted in the EU (Ireland).
- Mistral AI SAS (France): AI recovery insights, processed in the EU (see section 4).
- RevenueCat, with the App Store and Google Play: subscription status and billing. Apple and Google process the payment; we never see your card details.
- Apple / Google: only if you choose to sign in with them, to verify your identity.
- Expo: delivering push notifications, only if you enable reminders.
We may also disclose data where required by law.
6. Storage, security and where your data lives
Your data is encrypted in transit and stored in private, per-user storage hosted within the EU (Ireland). Our AI provider is also in the EU (France), so your health data is not transferred outside the EU/EEA. We apply appropriate technical and organisational measures to protect it against unauthorised access, loss, or misuse.
7. This website: cookies and analytics
This section covers the injurylog.ai website only. The InjuryLog app has no analytics or advertising SDK, as described in section 2.
Nothing until you choose. On your first visit we ask whether we may use analytics cookies. Until you accept, no analytics script loads and no analytics cookie is set. Rejecting is as easy as accepting, and you can change your choice at any time with Cookie settings, which is also in the footer of every page.
If you accept, we use Google Analytics 4, provided by Google Ireland Limited, to count visits and see which pages and buttons are used, for example how many people tap the App Store or Google Play buttons. We use it for measurement only: Google's advertising features are off, and no injury or health information is ever sent to Google. Analytics data is kept for no longer than 14 months. The legal basis is your consent, which you can withdraw at any time.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
il-consent (local storage) | injurylog.ai | Remembers your cookie choice so we don't ask on every page. Strictly necessary. | Until you clear your browser data |
_ga | Google Analytics, only after you accept | Tells one visitor apart from another, without identifying you | 2 years |
_ga_<ID> | Google Analytics, only after you accept | Keeps track of the current visit | 2 years |
If you accept and later reject, the site deletes these Google Analytics cookies.
Hosting. The website is hosted by Netlify, which processes standard technical data such as your IP address and browser type in its server logs to deliver and secure the site.
Cookieless visit and download counts. Separately from Google Analytics, and whether or not you accept cookies, our server counts page visits and taps on our download buttons and short links (injurylog.ai/app, /ios and /android). For each one it records only the day, the page, the type of device (iPhone, Android or computer), where the visit came from (for example a search engine, an AI assistant, TikTok or Instagram, taken from the link, the referring website or the app you opened it in), any campaign name in the link, and your country. It does not store your IP address, your browser details or any identifier, and nothing is stored on or read from your device, so these counts cannot be linked to you. To see them in reports, our server also passes the same counts to a separate Google Analytics property (Google Ireland Limited) with a random number in place of any identifier, no IP address and no cookie, so Google cannot link them to you or to the Google Analytics cookies above either. We use them, in aggregate only, to see which pages, posts and ads bring people to InjuryLog; the legal basis is our legitimate interest in understanding how people find us.
Android waitlist (closed). Before InjuryLog launched on Google Play in October 2026, we collected email addresses for an Android waitlist with Netlify Forms. We use them only to tell people that the Android app is live, then delete them. Email support@injurylog.ai and we will delete yours straight away.
Google and Netlify may process this website data outside the EU/EEA. Where they do, the transfer is covered by safeguards such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. None of this applies to the health data you keep in the app, which stays in the EU (section 6).
8. Your rights
Under the GDPR and applicable law, you have the right to access, correct, export, and delete your personal data, and to object to or restrict certain processing. You can permanently delete your account and all associated data in one tap under Profile then Delete Account, or by emailing support@injurylog.ai. To make any other request, contact us at the same address.
9. Data retention
We keep your data for as long as your account is active. When you delete your account, we permanently remove your associated data within 30 days, and it is purged from encrypted backups within 90 days. Billing and subscription records may be kept for up to 7 years where tax and financial law requires it.
10. Children
InjuryLog is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will remove it.
11. Changes to this policy
We may update this policy from time to time. We will post the updated version here and revise the "last updated" date above. Material changes will be communicated in-app or by email.
12. Contact
Questions about your privacy or this policy? Email support@injurylog.ai.