Privacy Policy

Who We Are

Joint Journey (jointjourney.org) is a digital prehabilitation programme designed to help people preparing for hip or knee replacement surgery. The service is operated from the United Kingdom.

For any privacy-related queries, contact us at hello@jointjourney.org.

What Data We Collect

When you use Joint Journey, we may collect the following information:

Information you provide directly:

• Account details - your name, email address, and password
• Profile information - which joint you are having replaced (hip/knee/both), your surgery date (if known), your height and weight
• Health-related data - exercise completion records, weight logs, mood logs, and mindset module progress
• Preferences - calorie targets, recipes tried, shopping lists

Information collected automatically:

• Usage analytics - which pages you visit, how long you spend on different sections, and general usage patterns (collected via Google Analytics)
• Device information - browser type, screen size, and operating system (collected anonymously for improving the service)

Information we do NOT collect:

• We do not collect your NHS number, medical records, or detailed health history
• We do not collect payment information
• We do not access your contacts, camera, microphone, or location

How We Use Your Data

We use your data solely to:

• Provide the service - track your exercise progress, save your preferences, personalise your programme
• Improve the service - understand how people use Joint Journey so we can make it better
• Send reminders - if you have opted in, we may send you motivational reminders and nudges (you can opt out at any time)

We will never:

• Sell your data to third parties
• Use your data for advertising
• Share your identifiable data with anyone outside of Joint Journey

Legal Basis for Processing (GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we process your data on the following legal bases:

• Consent - you consent to data collection when you create an account and agree to these terms
• Legitimate interest - we have a legitimate interest in understanding how the service is used in order to improve it
• Contract - processing is necessary to provide you with the service you have signed up for

Data Storage & Security

Your data is stored securely in Google Firebase (Cloud Firestore), hosted on Google Cloud infrastructure in Europe. A local copy is also cached in your browser for faster loading and offline access. We use the following measures to protect your data:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Data encrypted at rest using AES-256 encryption on Google Cloud servers
• Firebase Authentication for secure password handling (passwords are hashed, never stored in plain text)
• Firestore Security Rules ensuring each user can only access their own data
• Google Cloud infrastructure is SOC 2, ISO 27001, and GDPR compliant

Your data syncs across devices, so you can log in from your phone, tablet, or computer and pick up where you left off.

You are responsible for keeping your password secure.

Data Retention

We retain your data for as long as you have an active account. If you delete your account:

• Your personal data will be permanently deleted within 30 days
• Anonymised, aggregated usage data may be retained for analytical purposes

Your Rights (GDPR)

Under the UK GDPR, you have the following rights:

• Right of access - you can request a copy of all data we hold about you
• Right to rectification - you can ask us to correct inaccurate data
• Right to erasure - you can ask us to delete all your data ("right to be forgotten")
• Right to data portability - you can request your data in a machine-readable format
• Right to restrict processing - you can ask us to limit how we use your data
• Right to object - you can object to processing based on legitimate interest
• Right to withdraw consent - you can withdraw your consent at any time

To exercise any of these rights, email us at hello@jointjourney.org. We will respond within 30 days.

Cookies & Local Storage

Joint Journey uses:

• Browser local storage - to save your session and cache your data for offline use. This is essential for the service to work.
• Google Analytics cookies - to collect anonymous usage statistics. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

We do not use advertising cookies or tracking cookies from social media platforms.

Third-Party Services

We use the following third-party services:

• Google Firebase - for user authentication and secure data storage (Firebase Privacy Policy)
• Google Analytics - for anonymous usage analytics (Google's Privacy Policy)
• Netlify - for website hosting (Netlify's Privacy Policy)

Children

Joint Journey is not intended for use by anyone under 18. We do not knowingly collect data from children.

Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you through the app. The date at the bottom of this page shows when it was last updated.

Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

Contact

For any privacy-related questions, email: hello@jointjourney.org