PhysioKeys Privacy Policy

Last updated: 12 August 2026

PhysioKeys is a research discovery and AI evidence support platform for physiotherapy and rehabilitation professionals, students, researchers, and related users.

This Privacy Policy explains how PhysioKeys collects, uses, stores, shares, and protects personal information when you use our website, web app, account features, research search tools, AI answer features, saved article tools, uploaded PDF features, assignment tools, billing features, newsletters, transactional emails, MCP connector features, and related services.

For this policy, “PhysioKeys,” “we,” “us,” and “our” refer to the operator of PhysioKeys. “You” means a visitor, account holder, subscriber, or other user of the service.

This policy applies to PhysioKeys services, including our public website, WordPress site, web app, newsletter, and connected app features. It does not apply to third-party websites, journals, databases, payment pages, university systems, ChatGPT, Claude, Google, Sender.net, Lemon Squeezy, PubMed, or other external services that have their own privacy policies.

1. Important clinical and research notice

PhysioKeys is designed to support research discovery, evidence review, educational work, and clinical reasoning. It is not a medical record system, patient management system, emergency service, or replacement for professional clinical judgment.

Please do not upload, enter, or store patient-identifiable information, confidential patient records, medical notes, images, or other sensitive patient data in PhysioKeys. If you choose to include personal health information or patient-identifiable information in a search, AI prompt, uploaded PDF, assignment, note, or other content, that information may be processed and stored as described in this policy.

Do not include personal health information or patient-identifiable information in an MCP request. The connector is intended only for de-identified research and is designed to reject requests that appear to contain restricted identifiers before a tool action runs. Other app content you choose to submit may be processed as described in this policy.

2. Information we collect

We collect information in several ways: information you provide directly, information generated when you use the service, information received from third-party login or payment providers, and technical information collected automatically.

Account and login information

When you create or use an account, we may collect and process:

• Email address.
• Password authentication information, handled through our authentication provider.
• Google account information if you choose “Continue with Google,” such as your Google account email and basic profile details made available during sign-in.
• Password reset and account verification information.
• Profile information such as full name, plan, account tier, admin status, dashboard order, and account settings.
• Authentication tokens, session cookies, and related security information needed to keep you signed in.

Research search and usage information

When you use search, answer mode, or related research tools, we may collect and store:

• Search queries.
• Filters, selected disciplines, publication type filters, sort options, search mode, evidence scope, and related search settings.
• Generated PubMed or internal search queries.
• Search run IDs, thread IDs, parent search IDs, result metadata, top results, result counts, and timestamps.
• Usage events, request paths, quota usage, credit usage, plan code, and related billing or entitlement metadata.
• Anonymous trial identifiers and trial usage counters for visitors who use limited free search or answer previews without signing in.

Saved articles, inbox, notes, and preferences

When you save or manage articles, we may collect and store:

• Saved article source, external article ID, PMID, DOI, title, journal, publication date, and article URL.
• Saved article status, tags, user tags, discipline, study design, article type, conditions, treatments, priority, notes, and last opened time.
• View presets, saved views, filters, column settings, sort order, and dashboard layout preferences.
• PDF metadata linked to a saved article, such as file name, file path, MIME type, size, upload time, and whether a PDF is attached.

AI questions, answers, and evidence history

When you use AI-powered features, we may collect and store:

• Your questions, prompts, follow-up messages, and selected context.
• AI-generated answers.
• Answer threads, thread titles, last question, answer style, reference count, and timestamps.
• Evidence snapshots, article references, cited papers, study facts, source metadata, and related AI context.
• Feedback you provide, such as thumbs up/down, selected reasons, and optional comments.
• Summaries, thread memory, and AI state used to continue or improve the user experience.

Uploaded PDFs and extracted text

If you upload a PDF or ask PhysioKeys to extract text from a PDF, we may collect and store:

• The uploaded PDF file.
• File name, storage path, MIME type, file size, upload time, PMID, DOI, and article title when available.
• Extracted full text, extracted sections, page count, word count, character count, truncation status, extraction quality score, and extraction quality reason.
• Metadata showing that the file belongs to your account.

Uploaded PDFs and extracted text may contain personal data or sensitive information if you include it. You are responsible for ensuring you have the right to upload and process any document you submit.

Assignments and writing workspace content

If you use assignment or writing-related features, we may collect and store:

• Assignment title, course, due date, tags, status, and content.
• Sources attached to an assignment, including article metadata, snippets, URLs, and pinned/position settings.
• Assignment chat messages, AI messages, selected text, and timestamps.

MCP connector information

PhysioKeys may allow you to connect your PhysioKeys account to external AI assistants such as ChatGPT, Claude, or other compatible MCP clients.

When you use the MCP connector, we may collect and process:

• Your PhysioKeys user ID.
• OAuth client information, authorization codes, token hashes, scopes, redirect URIs, token expiry times, refresh token metadata, revocation status, and last-used times.
• MCP request metadata such as request path, IP address, timestamps, rate-limit data, and tool usage.
• Search queries sent through the MCP connector.
• Article IDs, PMIDs, DOIs, saved-title filters, saved article requests, saved article lists, account-status requests, and article-fetch requests.
• Search, fetch, save, and account status results returned to the connected AI assistant.

When you connect PhysioKeys to ChatGPT, Claude, or another MCP client, the external assistant may receive information returned by PhysioKeys, including article metadata, abstracts, cached full text where available, saved article information, account allowance information, and the queries and filters sent for the current request.

Your use of ChatGPT, Claude, or any other external MCP client is also governed by that provider’s own terms and privacy policy. PhysioKeys does not control how those external assistants process conversations or data outside PhysioKeys.

Billing, subscriptions, and credits

When you purchase a subscription or credit top-up, we may collect and store billing-related information, including:

• User ID linked to your account.
• Billing customer ID from our payment provider.
• Billing name and email.
• Subscription ID, customer ID, order ID, product ID, variant ID, plan code, subscription status, renewal date, cancellation status, current billing period, end date, and related webhook payloads.
• Order ID, customer ID, order type, pack code, status, subtotal, tax, total, currency, credits granted, refunds, and related webhook payloads.
• Credit grants, credit usage, wallet consumption records, plan grants, top-up grants, manual adjustments, refunds, and related metadata.

We do not intentionally store full payment card numbers. Payment card information is handled by our payment provider.

Communications, newsletter, and transactional emails

If you contact us, request support, join a newsletter, receive transactional emails, respond to an email, or participate in a survey or promotion, we may collect:

• Name.
• Email address.
• Message content.
• Newsletter preferences.
• Subscription or unsubscribe status.
• Email delivery, open, click, bounce, and complaint data where provided by our email service provider.
• Support request details.
• Any information you choose to provide.

We use Sender.net for email management, including newsletters and transactional emails.

Analytics, technical, security, and device information

When you use PhysioKeys, we and our service providers may automatically collect:

• IP address.
• Browser type and version.
• Device type and operating system.
• Referring page, pages visited, events, approximate location derived from IP address, timestamps, and performance information.
• Request path, request metadata, server logs, error logs, security logs, and rate-limit data.
• Cookies, local storage, session storage, and similar technologies needed for authentication, preferences, analytics, abuse prevention, and trial usage limits.

We use Google Analytics on the WordPress/public website and Vercel Analytics on the PhysioKeys web app.

Public research and publication data

PhysioKeys also stores and processes public or lawfully available research metadata, such as article titles, abstracts, authors, PMIDs, DOIs, journal names, publication dates, MeSH terms, publication types, links, full text where lawfully available, and classification data. This information is generally not user account data, but it may include author names and publication metadata from public research databases.

3. How we use information

We use personal information to:

• Create, authenticate, and manage user accounts.
• Provide search, saved article, inbox, assignment, PDF, MCP connector, and AI answer features.
• Save your research history, answer history, notes, uploaded files, preferences, workspace content, and connected tool state.
• Generate AI answers, evidence summaries, search rewrites, rankings, and article recommendations.
• Allow connected MCP clients, such as ChatGPT or Claude, to search, fetch, save, and use PhysioKeys research information when you authorize the connection.
• Process subscriptions, billing, invoices, credits, refunds, and account entitlements.
• Enforce free trial limits, plan limits, credit limits, search limits, saved article limits, and fair use limits.
• Monitor, debug, secure, and improve the service.
• Prevent abuse, fraud, spam, unauthorized access, and misuse.
• Respond to support requests and communications.
• Send service messages, billing notices, password reset emails, account notices, newsletters, research updates, and marketing communications where permitted.
• Comply with legal, tax, accounting, security, and regulatory obligations.
• Develop, test, and improve PhysioKeys features, including search quality, AI quality, article ranking, MCP connector reliability, and usability.

4. Legal bases for processing

Where GDPR, UK GDPR, or similar laws apply, we rely on one or more of the following legal bases:

Purpose	Legal basis
Creating and managing your account	Contract
Providing search, AI, saved article, assignment, PDF, and MCP connector features	Contract
Processing billing, subscriptions, orders, credits, and refunds	Contract and legal obligation
Authentication, security, fraud prevention, abuse prevention, rate limiting, and service integrity	Legitimate interests and, where required, legal obligation
Analytics, debugging, performance monitoring, and product improvement	Legitimate interests or consent where required
Sending newsletters or marketing communications	Consent or legitimate interests, depending on applicable law
Sending transactional emails	Contract, legitimate interests, and legal obligation where applicable
Responding to support and contact requests	Contract, legitimate interests, or consent depending on the request
Complying with law, tax, accounting, dispute, and regulatory obligations	Legal obligation
Protecting legal rights and enforcing terms	Legitimate interests and legal obligation

Where we rely on legitimate interests, we balance our interests against your rights and freedoms.

5. AI processing

PhysioKeys uses AI systems to support research discovery, search rewriting, evidence retrieval, article ranking, evidence synthesis, and answer generation.

Our current active AI provider for app AI features is OpenAI. Voyage is not currently enabled for production AI/reranking use.

When you use AI-powered features, your questions, search terms, selected context, article metadata, abstracts, extracted PDF text, saved article information, and other relevant content may be processed by OpenAI to provide the requested service.

When you use PhysioKeys through an MCP connector, an external AI assistant such as ChatGPT or Claude may also process the information you send to that assistant and the information returned from PhysioKeys. That external processing is governed by the provider of the AI assistant.

You should not submit confidential patient data, patient-identifiable data, or information you are not allowed to share with AI providers.

AI outputs may be incomplete or incorrect. PhysioKeys is not a substitute for clinical judgment, professional responsibility, or direct review of source literature.

6. Cookies and similar technologies

We use cookies, local storage, session storage, and similar technologies for:

• Authentication and keeping you signed in.
• Security and fraud prevention.
• Saving preferences and app state.
• Anonymous trial usage limits.
• Google Analytics on the WordPress/public website.
• Vercel Analytics on the web app.
• Email performance measurement where supported by Sender.net.
• Improving the service.

Some cookies are necessary for the service to work. Analytics or optional cookies may depend on your location, browser settings, and any cookie controls we provide.

You can usually control cookies through your browser settings. Blocking some cookies may prevent parts of PhysioKeys from working correctly.

7. How we share information

We do not sell your personal information.

We may share personal information with service providers and processors who help us operate PhysioKeys, including:

• Hosting and deployment providers.
• Database, authentication, and file storage providers.
• Analytics and performance monitoring providers.
• AI model and infrastructure providers.
• Payment, subscription, tax, and billing providers.
• Email, newsletter, transactional email, support, and communication providers.
• Workspace and automation tools used for internal operations.
• Security, logging, debugging, and abuse prevention tools.
• Public research databases and publication services when needed to retrieve article metadata, PubMed records, full text links, abstracts, or source information.
• External AI assistants and MCP clients that you authorize to connect to your PhysioKeys account.
• Professional advisers, accountants, lawyers, auditors, and insurers where needed.

We may also disclose information if required to comply with law, enforce our terms, protect rights and safety, investigate misuse, respond to legal process, or as part of a merger, acquisition, financing, restructuring, or sale of assets.

8. Third-party services we use

PhysioKeys may use third-party services including:

• Supabase for authentication, database, storage, and backend infrastructure.
• Vercel for hosting, deployment, analytics, and serverless infrastructure.
• OpenAI for AI-powered search, rewriting, summarization, answer generation, and related AI features.
• Google for Google sign-in and Google Analytics on the WordPress/public website.
• Sender.net for newsletter management and transactional emails.
• Lemon Squeezy for subscriptions, payments, billing, invoices, customer portal, tax handling, and related payment operations.
• PubMed, NCBI, PubMed Central, journal websites, and publication metadata providers for research discovery and article information.
• Notion or similar workspace tools for internal newsletter and editorial workflows.
• ChatGPT, Claude, and other MCP-compatible clients when you choose to connect them to PhysioKeys.

These providers may process information according to their own privacy policies and data processing terms.

9. International transfers

We may process and store information in countries other than your own. Our providers may operate globally.

Where required by law, we use appropriate safeguards for international transfers, such as data processing agreements, standard contractual clauses, or other lawful transfer mechanisms.

10. Data retention

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required by law, accounting rules, tax rules, dispute resolution, security, or legitimate business needs.

How long we keep your data. Your account information and content (saved articles, notebooks, answer history, uploaded PDFs) are kept while your account is active. You can delete your account at any time in Account → Security in the app. Your account is deactivated immediately, connected apps are disconnected, and any subscription is cancelled so you will not be charged again. For 14 days you can restore your account by signing back in; after that, your account and all content are permanently deleted. Payment and transaction records are kept for up to 7 years for tax, accounting, and fraud-prevention purposes, with your name and email removed at deletion; our payment provider Lemon Squeezy is the merchant of record and keeps its own legally required tax records. We keep a minimal deletion log (a one-way hashed identifier and timestamps, no readable personal data) for 3 years to prove we honored your request. Encrypted backups may retain deleted data for up to 8 days before being overwritten; backups are used only for disaster recovery, and deletions are re-applied if a backup is ever restored. To request expedited deletion, email hello@physiokeys.com.

Data	Retention
Account and user content	While active; 14-day restoration window after deletion request, then permanent purge
MCP authorization codes	Expire after 10 minutes
MCP access tokens	Valid for 30 days
MCP refresh tokens	Valid for 180 days
MCP connection records	Until disconnected or account deletion is requested
Billing records	Pseudonymized and retained for up to 7 years
Deletion audit record	Hashed record retained for 3 years
Encrypted backups	8 Days
OpenAI API processing	Default abuse-monitoring retention may be up to 30 days; API data is not used for training unless explicitly opted in
Newsletter information	Until unsubscribed or deletion is requested, subject to any legally required suppression record
Support messages and security logs	30 Days

Newsletter subscriptions are managed separately through Sender.net. Users can unsubscribe using the link in any marketing email. A user may also email hello@physiokeys.com to request deletion of newsletter information, subject to any minimal suppression record needed to honor the opt-out.

11. Security

We use technical and organizational measures designed to protect personal information, including authentication controls, server-side access controls, database row-level security, file ownership checks, request validation, rate limiting, restricted service-role access, token hashing for connector authorization records, logging, and secure infrastructure providers.

No online service can guarantee absolute security. You are responsible for keeping your account credentials secure and for only connecting trusted external tools or MCP clients.

12. Your privacy rights

Depending on where you live, you may have rights to:

• Access personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information.
• Request restriction of processing.
• Object to certain processing.
• Request data portability.
• Withdraw consent where processing is based on consent.
• Opt out of marketing communications.
• Revoke connected tools or MCP access where available.
• Complain to a data protection authority.

To exercise your rights, contact us using the contact details below. We may need to verify your identity before responding.

Some information may be retained where required for legal, tax, security, fraud prevention, billing, dispute, or legitimate business reasons.

13. California privacy notice

If California privacy laws apply to you, you may have rights to:

• Know what categories of personal information we collect, use, disclose, or share.
• Know the specific pieces of personal information we hold about you.
• Delete personal information, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information.
• Limit the use and disclosure of sensitive personal information, where applicable.
• Not be discriminated against for exercising privacy rights.

Based on our current service design, we do not sell personal information and do not knowingly share personal information for cross-context behavioral advertising. We use analytics tools, including Google Analytics on the WordPress/public website and Vercel Analytics on the web app. If we add advertising pixels, targeted advertising, or similar marketing technologies, we will update this policy and provide any required choices.

14. Children’s privacy

PhysioKeys is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

PhysioKeys is designed for students, clinicians, researchers, and adults using a professional or educational research tool. If you believe a child has provided us personal information, contact us so we can take appropriate action.

15. Marketing, newsletters, and transactional emails

If you subscribe to a newsletter or marketing communication, we may use your email address and preferences to send research updates, product updates, or related content through Sender.net.

You can unsubscribe from marketing emails using the unsubscribe link in the email or by contacting us. We may still send non-marketing messages, such as account, login, password reset, billing, security, or service notices.

16. MCP and connected AI assistants

If you connect PhysioKeys to ChatGPT, Claude, or another MCP-compatible assistant, you authorize that assistant to request information from your PhysioKeys account through the connector.

Through the MCP connector, PhysioKeys receives only the explicit tool inputs sent for the current request, such as a de-identified research query, article identifier, saved-title filter, article-save request, or account-status request. PhysioKeys does not receive the user’s complete ChatGPT conversation.

The connector may return article citation metadata, abstracts, available rights-verified cached full text, saved-article citation metadata and library status, and account allowance information. It does not return private saved notes, user-created classifications or tags, PDF-upload status, saved timestamps, raw authentication secrets, or internal saved-row IDs. The connector’s save tool does not accept free-form notes.

PhysioKeys and its ChatGPT/MCP connector are intended only for de-identified research and educational use. Do not upload, enter, store, or transmit protected health information or patient-identifiable information, including names, dates of birth, medical-record numbers, contact details, government identifiers, patient images, or confidential clinical records. Remove all identifiers before submitting a general research question. The connector rejects common explicit identifiers and may refuse requests that appear to contain restricted information.

You may revoke or stop using connected tools where supported. Some records may remain for security, billing, abuse prevention, audit, or legal reasons.

17. External links and third-party content

PhysioKeys may link to PubMed, journal websites, publisher pages, full-text sources, university access systems, payment portals, AI assistants, and other third-party services.

We are not responsible for the privacy practices, content, access rules, or security of third-party websites or services. Review their privacy policies before using them.

18. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and may provide additional notice where required.

Your continued use of PhysioKeys after a policy update means the updated policy applies to your use from that point forward.

19. Contact us

For privacy questions, requests, or complaints, contact us through the PhysioKeys contact page or at:

Privacy contact: hello@physiokeys.com
Legal/operator name: Physiokeys

Please include enough information for us to understand and respond to your request.