App Privacy Policy

1. Who this policy is from, and what it covers

GonioPlus is developed and published by Jacob Whibley, an independent developer in England (“the developer”, “we”, “us”). You can contact us at any time at gonioplus@protonmail.com.

This policy explains how personal data is handled in connection with the GonioPlus iPhone app. It is written to meet the transparency requirements of Articles 12 to 14 of the UK GDPR, and of the EU GDPR where that applies to you. Separate policies cover the gonioplus.com website and its waiting list, and Apple's own handling of your App Store account.

We are not required to appoint a Data Protection Officer under Article 37: the developer is not a public authority, and the app's core activity is neither large-scale monitoring nor large-scale processing of special category data — as set out below, the app processes nothing on the developer's behalf at all. All data protection enquiries go to the address above.

2. What GonioPlus is — an educational reference tool, not a medical device

GonioPlus is an educational joint angle estimator and range-of-motion reference aid, provided for education, training, and general reference only.

It is not a medical device. It has no medical purpose within the meaning of the UK Medical Devices Regulations 2002 or EU Regulation 2017/745, it is not UKCA or CE marked as a medical device, and it is not registered with the MHRA or any other regulator. It is not intended to diagnose, treat, cure, monitor, prevent, predict, or prognose any disease, injury, or disability, nor to investigate or modify the anatomy or a physiological process, nor to guide, inform, or support any clinical decision.

Three things follow, and they apply every time the app is used:

• It is a reference, not a result. Every angle GonioPlus displays or stores is an estimate derived from consumer phone sensors. Its accuracy is affected by device placement, calibration, movement, and the hardware itself, and it has not been clinically validated for any purpose.
• A supporting measurement must take place. No reading from this app may be relied upon on its own. Each one must be independently confirmed by a separate, validated measurement method — such as a manual goniometer — before it is recorded, acted upon, communicated, or used in any way.
• Professional judgement governs. The app supplies a number and nothing more. Any clinical or practical meaning given to that number is supplied by you, using your own training, assessment, and professional judgement, for which you remain solely responsible.

This belongs in a privacy policy because it defines the whole of the processing described below. The app performs no clinical processing of what you record. It produces no diagnosis, no health assessment, and no risk score. It makes no automated decision about you or about anyone you measure, and it evaluates or predicts nothing about any person. It stores numbers you chose to save, on a device you control.

Nothing in this policy is medical advice, and nothing in it should be read as a claim that GonioPlus is a certified, regulated, or clinically validated instrument. The full terms of use, including the limits of the developer's liability, are in the Terms & Conditions, which you accepted when you first opened the app.

3. The short version

GonioPlus has no account, no sign-in, no server, and no analytics. Everything you enter — your name and job title, client or session names, measurements, and reports — is stored only on your own device, in the app's own storage. It is never collected, transmitted, or seen by the developer. The only personal data the developer ever holds about you is an email you choose to send us.

4. What the app stores on your device

All of the following is written to the app's storage on your device and nowhere else. It is included in your iCloud or computer backups if you have those switched on, under Apple's terms rather than ours.

• Your clinician details — name, job title, and optional place of work, so they can be stamped on reports.
• Client or session names — whatever text you choose to type.
• Measurements — the joint, movement, angle, date, and any notes you add.
• App settings — such as the auto-record hold, and whether saved readings are locked behind Face ID or Touch ID.

Because none of this reaches the developer, the developer is neither a controller nor a processor of it: there is no transmission, no hosting, no remote access, and nothing processed on anyone's behalf. It is data held by you, on hardware belonging to you.

5. Client information — you are the data controller

If you record a client's name, initials, reference, or measurements, you are the data controller of that information within the meaning of Article 4(7) of the UK GDPR. The developer is not a controller of it and, because the app never transmits it, is not your processor either — so no Article 28 processing agreement arises or is possible.

Range-of-motion data about an identified or identifiable person is data concerning health, and therefore special category data under Article 9. Processing it lawfully is your responsibility, and it requires both a lawful basis under Article 6 and a separate Article 9 condition — for most clinicians, Article 9(2)(h), processing for the provision of health or social care by a professional subject to a duty of confidentiality, read with Schedule 1 of the Data Protection Act 2018.

In practice, this means you are responsible for:

• having a lawful basis and an Article 9 condition before you record anything;
• giving the people you measure the information they are entitled to under Articles 13 and 14, and obtaining any consent your professional obligations require;
• keeping what you record accurate, secure, and no more extensive than you need;
• answering any data subject rights request about that information — the developer cannot answer one, because we hold nothing;
• meeting the obligations that apply to you, whether that is the UK GDPR, the EU GDPR, HIPAA, or the standards of your professional body;
• assessing whether your use requires a Data Protection Impact Assessment under Article 35.

A practical suggestion. Recording a client initial or a case reference rather than a full name is the simplest way to satisfy the data minimisation principle in Article 5(1)(c), and it means a lost or stolen phone exposes far less.

6. What the developer actually receives, and why

The app sends us nothing. There are only three narrow circumstances in which any personal data reaches the developer at all, and each is set out below with its lawful basis.

On that third row: Apple gives every developer aggregated, non-identifying App Store metrics, and — only if you have chosen to share analytics with app developers in Settings → Privacy & Security → Analytics & Improvements — crash and diagnostic reports. GonioPlus itself contains no analytics, advertising, or tracking software of any kind, sets no advertising identifier, and shows no App Tracking Transparency prompt because it does not track you. Nothing Apple provides is combined with anything you record in the app, and nothing in it identifies you.

You have the right to object to processing based on legitimate interests at any time under Article 21. We have assessed both of the legitimate interests above as low-impact, expected by you, and impossible to achieve by less intrusive means.

7. Motion sensors

Measurements are taken using your device's built-in accelerometer and gyroscope. The sensor stream is read live, on the device, purely to work out an angle. Only the angle you choose to save is kept. The raw sensor data is never stored, transmitted, or retained after the reading, and it is not used to infer anything about you, your movement, your location, or your device.

8. Face ID and Touch ID

If you switch on the lock for saved measurements, authentication is performed entirely by iOS. The app is told only whether authentication succeeded or failed. It never sees, receives, or stores your face, fingerprint, or passcode, and no biometric data is available to the developer at any point.

9. Subscriptions and the App Store

Subscriptions are sold and processed by Apple through the App Store. The app asks iOS whether a valid subscription exists and receives only that answer. It never sees your name, payment card, or billing address, and no payment information is stored on your device by GonioPlus.

For your purchase, Apple is an independent data controller, and its handling of your data is governed by the Apple Privacy Policy, not by this one. Manage or cancel a subscription in Settings → your name → Subscriptions, or at apps.apple.com/account/subscriptions.

10. Exporting and sharing reports

When you export or share a report as text or PDF, that file leaves the app under your control, through whichever destination you pick — Mail, Messages, Files, AirDrop, or anything else iOS offers. From that moment it is handled by that app or service under its own terms, and how it is stored, transmitted, retained, or deleted is your responsibility as its controller. Exported reports carry the educational-use statement on every page, so that anyone who receives one knows what it is and what it is not.

11. How long data is kept, and how to delete it

Data on your device stays there until you remove it — the developer sets no retention period over it, because the developer cannot see it. You can delete individual measurements, sessions, or reports inside the app, and deleting the app removes all of its stored data from the device.

Because nothing is uploaded, there is no copy for us to delete on your behalf, and none for us to disclose if we were ever compelled to. Copies may still exist in any device backup you have made, which is under your control and Apple's, not ours. Support correspondence held by the developer is deleted 24 months after the exchange closes, or sooner if you ask.

12. Security

What you record is protected by the device's own protections: iOS application sandboxing, which prevents other apps from reading GonioPlus's storage; full-device encryption, which is active whenever a passcode is set; and, if you switch it on, Face ID or Touch ID over saved measurements. Because nothing is transmitted, there is no server to breach, no database to leak, and no credentials to steal.

The most effective things you can do are within your control: keep a passcode on the device, keep iOS up to date, switch on the in-app lock if you record client information, and use Find My so a lost device can be erased remotely. If you believe you have found a security or privacy flaw in the app, please write to gonioplus@protonmail.com.

13. International transfers

Nothing you record in the app is transferred anywhere — it does not leave your device. The developer's support mailbox is provided by Proton Mail and is held in Switzerland, which is covered by UK and EU adequacy decisions, so an email you send us is protected without any further safeguard being required. Any transfer arising from your App Store purchase is made by Apple under its own policy and safeguards.

14. No automated decision-making or profiling

GonioPlus does not carry out automated decision-making producing legal or similarly significant effects, and does not profile you or anyone you measure, within the meaning of Article 22 of the UK GDPR. It does not evaluate, score, categorise, or predict anything about any person. It converts sensor readings into an angle and displays it. Every judgement made from that angle is made by a human being — you.

15. Children

GonioPlus is a professional reference tool. It is intended for qualified healthcare professionals and for students using it under appropriate supervision; it is not designed, marketed, or directed to children, and the Terms & Conditions require you to be at least 18 years old to use it.

This policy does not, however, rest on that age condition, because it does not need to. The app collects no personal data from any user, of any age. Everything you enter is written to your own device and stays there. There is no account, no sign-in, and no server for anything to be sent to, and the app contains no analytics, advertising, tracking, or third-party software of any kind. It follows that the developer does not collect, receive, store, share, or sell the personal data of a child, and could not do so — there is no mechanism by which it could reach us.

The consequences of that are worth stating plainly:

• UK GDPR Article 8 does not arise. Article 8 governs a child's consent to an information society service offered directly to them. We rely on consent for no processing of app data, because we carry out no processing of app data.
• The protections in the ICO's Age Appropriate Design Code are met by design. The app performs no profiling and no automated decision-making, uses no nudge techniques, collects no geolocation, serves no advertising, shares nothing with third parties, and defaults to the most privacy-protective setting available — because it keeps everything local and transmits nothing.
• No US COPPA obligation is engaged. COPPA attaches to the online collection of personal information from children under 13. The app collects personal information from no one.

The single channel through which anything could reach the developer is an email sent to support, as described in section 6. If we receive a message that appears to have come from a child, we will not use it for any purpose beyond answering or closing it, and we will delete it promptly. A parent or guardian who believes a child has sent us personal data can write to gonioplus@protonmail.com and we will confirm its deletion.

16. Your rights

Under the UK GDPR — and the EU GDPR where it applies to you — you have the right to be informed; of access (Art. 15); to rectification (Art. 16); to erasure (Art. 17); to restrict processing (Art. 18); to data portability (Art. 20); to object, including to processing based on legitimate interests (Art. 21); and not to be subject to automated decision-making (Art. 22).

Over data in the app, you exercise these rights directly and immediately, without asking anyone: view it, edit it, export it, or delete it inside the app. There is no request to make and no waiting period, because there is no intermediary — the developer holds nothing to disclose, correct, or erase.

Over anything you have emailed us, write to gonioplus@protonmail.com and we will respond within one month, as Article 12(3) requires. Exercising any of these rights is free, and we will not treat you any differently for doing so.

The right to complain. If you believe your data protection rights have not been respected, you can complain to your local supervisory authority. In the UK that is the Information Commissioner's Office, at ico.org.uk/make-a-complaint or 0303 123 1113. We would appreciate the chance to put things right first, but you are not obliged to come to us before going to them.

17. Cookies, tracking, and marketing

The app uses no cookies, no software development kits belonging to third parties, no advertising network, and no cross-app or cross-site tracking. It does not build a profile of you, does not sell or rent personal data, and does not share it with anyone for marketing purposes. There is no mailing list attached to the app, and no data collected in it is used to send you anything.

18. Changes to this policy

We may update this policy from time to time, to reflect a change in the app, in how it is distributed, or in the law. The version number and “Last updated” date at the top of this page always show the current version, and the current version is available here and in the app's Settings. Where a change materially affects your rights, we will make that clear rather than relying on the date alone.

19. Contact

Any question about this policy, about how GonioPlus handles data, or about exercising your rights should be sent to gonioplus@protonmail.com. It reaches the developer directly.