Privacy Policy — MuscleGuide
Last updated: 24 June 2026
This Privacy Policy explains how the MuscleGuide app ("the App", "we", "us") handles information. MuscleGuide is a clinical assessment and treatment-planning tool for qualified massage and manual therapists.
We have designed the App to keep data on your device by default. We do not operate user accounts, and we do not maintain a central database of your sessions or your clients.
If you have any questions, contact us at ebjarne@gmail.com.
1. Who is responsible for the data (important for therapists)
MuscleGuide is used by a therapist to record assessments of their clients. The clinical information you enter about a client is your professional record.
- For the client information you enter, you (the therapist) are the data controller. You are responsible for having a lawful basis to record your clients' health information and for informing your clients about how you keep their records — the same as for any paper or digital case notes you maintain.
- When you use the optional AI evaluation feature, we and our processing providers act on your behalf to process that information (see Section 4). We do not decide to process it — you do, by tapping "evaluate".
We are the controller only for the limited operational data described in Sections 5–7 (subscription, abuse-prevention, and app settings data).
2. Information stored on your device
Most of what the App handles never leaves your device. Stored locally (in the app's database and settings) are:
- Client records you create: client name, gender, age, history/anamnesis notes, medical-history flags, pain reports, posture findings, movement (ROM) and strength test results, palpation findings, treatment plans, exercise plans, and session notes.
- Your therapist profile: your name and an optional practice logo (used only to brand exported PDF handouts).
- App settings and preferences.
This information is stored on your device and is included in your device's normal iCloud backup if you have iCloud Backup enabled (this is controlled by your iOS settings, not by us). We cannot access your device or your iCloud backup.
You can delete individual clients and sessions in the App at any time, or remove all of it by deleting the App.
3. Camera and photos
The App uses the camera to measure posture and joint range of motion. Camera images are processed on your device to derive measurements and findings. Images are not uploaded to us or to any third party. Any data the App keeps from a capture is the resulting measurements/findings, stored locally as part of the session as described in Section 2.
4. AI evaluation feature (optional)
If you choose to run an AI evaluation of a session, the App sends a text summary of that session to our processing service for analysis and returns a written evaluation and treatment suggestions.
What is sent: a clinical summary containing the client's gender and age, the history/notes you typed, and the assessment findings (pain, posture, movement, strength, palpation, red-flag screening, and the current treatment plan).
What is not sent: the client's name is not included in the summary. Note, however, that free-text fields (such as history notes) are sent as written — please avoid typing directly identifying details (names, contact details) into free-text fields if you wish to minimise the personal data transmitted.
How it is processed:
- The summary is sent over an encrypted connection to our processing endpoint hosted on Cloudflare Workers, which forwards it to Anthropic (the AI provider) to generate the evaluation.
- Under Anthropic's commercial API terms, submitted data is not used to train its models and is retained only briefly for safety and abuse-prevention purposes. See Anthropic's privacy terms for details.
- The evaluation result is returned to your device and stored locally with the session. We do not keep a copy of the summary or the result.
This feature is only active when you tap to use it. If you never use it, no session data is transmitted.
5. Subscriptions
Subscriptions (MuscleGuide Pro) are sold and billed through your Apple App Store account. Purchases are managed with the help of RevenueCat, which we use to verify subscription status. For this purpose a random, app-generated identifier and your purchase/transaction status are processed. We do not receive your name, email, or payment card details — those stay with Apple. See Apple's and RevenueCat's privacy policies for how they handle purchase data.
6. Abuse-prevention and usage limits
To keep the optional AI feature available and to prevent abuse, our Cloudflare endpoint records, for a short period, a random installation identifier generated by the App and your IP address, together with a count of evaluations, in order to enforce fair-use limits. These records expire automatically (within roughly two days for daily limits and about a month for monthly limits) and are not used to identify you or build a profile.
7. Exercise images
When you browse the exercise catalogue, illustrative images are loaded from a public content source (the open-source free-exercise-db on GitHub's CDN). Loading an image involves a standard web request, which exposes your device's IP address to that provider, as with any image on the internet.
8. Data retention
- On-device data (Sections 2–3) is kept until you delete it in the App or uninstall the App.
- AI evaluation data (Section 4) is not retained by us; the AI provider retains it only briefly as described above.
- Abuse-prevention data (Section 6) expires automatically as described.
9. International transfers
The AI evaluation and abuse-prevention processing involves providers (Cloudflare, Anthropic) that may process data outside your country, including in the United States. These providers offer data-transfer safeguards (such as Standard Contractual Clauses) in their data-processing terms. If you are in the EU/EEA or UK and act as a controller for your clients' data, you should review those providers' terms to satisfy your own transfer obligations.
10. Your rights
Because your client records are stored on your device and under your control, you can access, correct, export, or delete them directly in the App. For the limited data we process (Sections 5–7), and to exercise any rights you have under applicable law (including the GDPR — access, rectification, erasure, restriction, objection, and portability), contact us at ebjarne@gmail.com. You may also lodge a complaint with your local data protection authority.
11. Security
Data on your device is protected by your device's operating-system security (passcode/biometrics and storage encryption). Data sent for AI evaluation is transmitted over encrypted (HTTPS) connections. No method of storage or transmission is completely secure, but we take reasonable measures to protect the limited data we handle.
12. Children
MuscleGuide is intended for use by qualified professionals and is not directed to children. We do not knowingly collect data from children through the App.
13. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, through the App or our website.
14. Contact
Björn Eriksson
Sweden
Email: ebjarne@gmail.com