Privacy Policy

1. Who we are

BJJ Rehab Assistant is operated by North Canaan AB, a company registered in Sweden. This policy explains what personal data we collect when you use the BJJ Rehab Assistant website and mobile app, why we collect it, and what rights you have over it. Questions or requests: legal@northcanaan.se.

2. Data we collect

• Injury description and symptom information you provide during an assessment session
• Self-test results you report
• Your email address, if you choose to provide it
• Account credentials (email + password), if you create an optional account to save your history
• Feedback and ratings you submit
• Basic technical data (IP address, browser/device type) for security and rate-limiting purposes
• Usage analytics (pages viewed, general interaction events) as described in Section 4

Session data (injury information, test results) is stored in our database so we can serve your plan and improve the assessment engine. We do not sell it or share it with third parties for their own marketing purposes.

3. Who processes it

We use Supabase (hosted in the EU) for database storage, OpenAI for AI processing of your session content, and Resend to deliver account and rehab-plan emails. By using this app you acknowledge that your session content is processed by these sub-processors in accordance with their respective data processing agreements.

4. Analytics and advertising

On the website, we use Google Analytics and the Meta (Facebook) Pixel to understand aggregate usage and measure the effectiveness of our own ads. These only load after you accept the cookie/tracking consent banner — EU visitors are opted out by default. They are not used in the mobile app.

We also use Resend's open/click tracking on emails we send you, so we know whether a check-in or plan email reached you.

5. GDPR and your rights (EEA residents)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — request that we limit processing of your data
• Right to portability — receive your data in a portable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw any consent you have given at any time

To exercise any of these rights, email us at legal@northcanaan.se. We will respond within 30 days. The legal basis for processing your data is your consent (Article 6(1)(a) GDPR) and our legitimate interest in improving the service (Article 6(1)(f) GDPR).

6. Consent to contact

If you provide your email address during an assessment, you are consenting to North Canaan AB contacting you about your assessment results, rehabilitation guidance, and updates to the BJJ Rehab Assistant service. This may include:

• Follow-up information relevant to your assessed injury
• Updates to rehabilitation protocols
• Product updates and new features

You can unsubscribe at any time by clicking the unsubscribe link in any email we send, or by emailing legal@northcanaan.se. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

7. Data retention

Session data is retained for a maximum of 24 months from the date of collection, after which it is deleted or anonymised. Email addresses are retained until you unsubscribe or request deletion. Anonymised, aggregated data (with no personally identifiable information) may be retained indefinitely for research and product improvement purposes.

8. Children's privacy

BJJ Rehab Assistant is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page will reflect the most recent revision. Continued use of the service after changes constitutes acceptance of the updated policy.