Privacy notice

For your own account details, TAALO is the data controller. For the records a professional creates about a client, the professional is the controller and TAALO processes that information on their instructions.

• Account details: name, email address, account type, and profile information you add.
• Verification details for professionals: profession, credential type, issuing body, reference number, expiry, and the proof document you upload.
• Records you create in the product: assessments, readiness answers, measurements, movement observations, plans, session logs and notes.
• Photos or camera captures you choose to save. Camera-derived figures are prototype estimates stored alongside your own recorded values.
• Technical information needed to run the service securely, such as sign-in times and error reports.

If you sign in with Google or Apple we receive your name and email address so we can create and identify your account. We never receive your password and request nothing else.

To run the product for you (performance of our contract), to keep accounts and records secure and to verify professional credentials (legitimate interests and, where relevant, legal obligation), and to send service messages such as invitations and sign-in emails. We do not sell personal information and we do not use client records for advertising.

Draft observations and plan suggestions are generated with the help of an AI model provider. Only the information needed for that request is sent, it is not used to train third-party models, and nothing reaches a client until a professional approves it.

Records are private to the professional who created them and to the client they belong to, once that client has accepted the invitation and agreed to what is shared. Access is enforced per record in the database, not just in the interface. Our service providers — hosting, database, email and payments — process data only to deliver the service.

• Account, client records and uploads: while the account exists, then deleted within 30 days of a deletion request.
• Credential documents: six years after the credential expires.
• Security and verification audit records: six years, without health details.
• Billing records: seven years, as tax rules require.

You can view and edit your profile at any time, withdraw sharing consent as a client, and ask for a copy, correction, export or deletion of your data by writing to privacy@taalo.app. We acknowledge within five working days and respond within 30 days. If you are in the UK or EU and are unhappy with our response, you may complain to your local data protection authority.

Our providers may process data outside your country; where they do, transfers rely on standard contractual clauses. Our security controls are described on the security page, and our honest compliance position on the compliance page.

Privacy questions: privacy@taalo.app. Security reports: security@taalo.app.