Privacy Notice

1. Scope and Overview

This Privacy Notice outlines how personal data is collected, processed, and protected within the Kymu project. It applies to both our public website (https://kymu.ch) and the Kymu digital rehabilitation platform, including the mobile motion tracking application (Kymu Companion), the interactive exercise environment (Kymu Play), the clinical therapist portal (Kymu Collab), and our central backend API services. Kymu is developed as an initiative at the Digital Health Design Living Lab of the Zurich University of the Arts (ZHdK).

2. Controller and Contact Information

The controller responsible for data processing in connection with this website and the Kymu rehabilitation project is:

3. Legal Bases and Core Principles

We process personal data in compliance with applicable Swiss data protection legislation (including the Swiss Federal Act on Data Protection [FADP] and the Cantonal Information and Data Protection Act [IDG], as applicable to the Zurich University of the Arts) and, where applicable to international users, the EU General Data Protection Regulation (GDPR). In doing so, we strictly adhere to the principles of lawful processing, data minimization, transparency, purpose limitation, and privacy-by-design. Depending on your interaction with Kymu, processing is grounded on the following principles:

• Informed Consent: Where you have given explicit consent, such as when volunteering for usability studies, research trials, or submitting voluntary inquiries.
• Provision of Therapy & Services: Where data processing is necessary to administer user accounts, deliver therapy plans, and provide digital rehabilitation exercises.
• Legitimate & Operational Interests: To maintain IT and network security, safeguard infrastructure integrity, prevent service abuse, and measure aggregated usage trends.
• Health & Movement Data Safeguards: Therapeutic movement metrics and clinical progress records are processed with heightened technical safeguards, strictly based on explicit consent, under the professional supervision of attending clinicians, or within authorized clinical research frameworks.

4. Website Hosting and Server Logs

When you visit our website, our hosting and edge infrastructure automatically collects technical connection data transmitted by your browser. This includes your IP address, the date and time of the request, the requested resource or URL, HTTP status codes, data volume transferred, referring URL, and browser and operating system details.

This processing is technically necessary to reliably deliver website content, maintain operational stability, and detect or investigate unauthorized access attempts or cyberattacks. Server log files are stored for a limited operational retention period and are subsequently purged, unless needed for legal proceedings.

5. Privacy-Preserving Web Analytics

To understand aggregate website usage and improve visitor navigation, we operate a self-hosted, privacy-oriented web analytics service on our own managed infrastructure. Our analytics setup is designed with privacy-first standards:

• Cookieless Tracking: The analytics script does not set tracking cookies or local storage identifiers on your device and does not perform browser fingerprinting.
• No Profiling or Third-Party Sharing: We do not track visitors across external websites, do not construct behavioral profiles, and never transmit or sell visitor data to advertising networks, brokers, or external analytics vendors.
• Pseudonymization and Aggregation: IP addresses and request headers are processed ephemerally in memory to determine approximate country-level geography and calculate daily aggregate visitor counts, viewed pages, referral sources, and interaction counts (such as study booking clicks or PDF downloads). URL query strings and hash parameters are stripped before counting.
• Do Not Track & Content Blockers: Our analytics script automatically respects browser 'Do Not Track' (DNT) and Global Privacy Control headers. You can also prevent analytics collection at any time using standard browser ad or content blockers.

6. Cookies and Local Storage

Our website does not use tracking, advertising, or marketing cookies. We only employ strictly necessary functional storage: specifically, a first-party cookie or local storage key (kymu_locale) to remember your chosen language setting (German or English) between page visits. You can disable or delete cookies at any time via your browser settings.

7. Contact and Inquiries

If you contact us by email, we process your email address, sender name, and message content to handle and answer your inquiry. Correspondence is retained for as long as necessary to address your request or fulfill statutory record-keeping obligations. Please do not transmit sensitive health information through unencrypted standard email.

8. The Kymu Digital Therapy Platform and Ecosystem

The Kymu software ecosystem connects patients, caregivers, and clinicians to provide interactive, gamified musculoskeletal rehabilitation. It comprises Kymu Companion (mobile motion capture), Kymu Play (game-based rehabilitation client), Kymu Collab (therapist management portal), and the central Kymu Backend. When utilizing these applications, data is handled under strict privacy safeguards:

9. Data Security and Technical Measures

We implement comprehensive technical and organizational measures (TOMs) aligned with Swiss and international data protection standards to protect personal and clinical data from unauthorized access, loss, or alteration:

• Transport & Channel Encryption: All communications between client applications, web portals, and backend APIs are protected using TLS 1.3 encryption. Local device pairing utilizes encrypted WebSockets with pinned cryptographic certificates.
• Access Control & Tenant Segregation: Access to clinical records is strictly governed by role-based permissions and enforced tenant isolation at the data-access layer. Passwords are protected using modern cryptographic one-way hashing.
• Backup & Disaster Recovery: Databases are safeguarded via automated daily encrypted backups retained for 30 days, continuous write-ahead logging (point-in-time recovery), and routine test-restores in isolated environments.

10. Data Retention and Erasure

We retain personal and therapeutic data only for as long as necessary to fulfill the intended medical, rehabilitation, or research purposes, maintain active user accounts, or comply with statutory documentation and retention obligations under Swiss healthcare and university regulations. Upon account termination or a valid erasure request, records are permanently deleted or irreversibly anonymized, unless statutory retention requirements apply.

11. External Services and Third-Party Links

Our website includes links to external third-party services, such as Google Calendar (used for scheduling usability study appointments or meetings) and professional networking platforms such as LinkedIn. When you click these links, you leave our website and are directed to external platforms governed by their own independent privacy policies. We do not embed third-party tracking scripts, social media widgets, or advertising pixels on our site.

12. Your Statutory Rights

Under applicable data protection laws, you are entitled to the following statutory rights regarding your personal data:

• Right of Access: You may request confirmation and information regarding what personal data is processed about you.
• Right to Rectification: You may request the correction or completion of inaccurate or incomplete personal data.
• Right to Erasure: You may request the deletion of your personal data, subject to statutory retention duties or prevailing legitimate grounds.
• Right to Restriction of Processing: You may request the restriction of data processing under statutory conditions.
• Right to Data Portability: You have the right to receive personal data you provided in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, you may revoke your consent at any time with future effect.

To exercise any of these rights, please contact us by email at the address provided in Section 2. In case of doubt, we may request proof of identity to protect your data from unauthorized access.

You also have the right to lodge a complaint with a competent data protection supervisory authority. In Switzerland, this includes the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) or the Cantonal Data Protection Officer of Zurich (Datenschutzbeauftragte des Kantons Zürich) for cantonal university matters. In the EU, you may address the supervisory authority in your country of habitual residence.