Get the app

Privacy

Privacy policy

Short version: these websites don't track you. No ads, and no analytics unless you allow it. If you write to us, we use your message to reply — and nothing else.

Last updated: 4 November 2026

Who we are

Andama is operated by App Andama Technology Ltd, a company registered in the Republic of Cyprus, with its registered office at Savva Rotsidi 8, Agios Dometios, 2364 Nicosia, Cyprus. We are the controller for the personal data described on this page. Our registration number will be added here shortly.

Contact for anything about your data: [email protected].

What this policy covers

This policy covers our websites: andama.app (for patients) and andama.io (for physiotherapists).

It does not cover the Andama app, which has its own app privacy notice. When you join the app with your physiotherapist's code, you'll also see their privacy notice before you share anything. Your health information in the app belongs to your care with your physiotherapist, who is responsible for it; App Andama Technology Ltd runs the app on their behalf.

What we collect on these websites

  • No advertising or tracking tools, and no analytics unless you allow it. We don't build a profile of you. On andama.app your browser keeps only your cookie choice — and, if you open a link from your physio, that link (your code and the plan in it) for 14 days. If you allow analytics, we count page views with Cloudflare Web Analytics, which sets no cookies, doesn't identify you and doesn't keep your IP address; we see only totals (your consent, GDPR Art 6(1)(a) — you can withdraw it any time under Cookie settings). Details: Cookie Policy.
  • No accounts or forms that send data to us. A link from your physio — your code, and the plan and price in it — is shown on the "Get the app" page and kept in your browser for 14 days, so you can come back to it. It isn't sent anywhere, and you can forget it on that page.
  • The physiotherapist access request on andama.io doesn't send anything by itself: it opens your own email app with a message to us. We only receive it if you press send.

Data we do receive

Technical data needed to deliver the site. Like any website, our hosting provider, Cloudflare, receives your IP address, browser type and the page requested, so it can show you the page and protect the site from abuse. We use this only to run and secure the websites (our legitimate interest, GDPR Art 6(1)(f)), and Cloudflare keeps it only for as long as it needs it for those purposes.

Emails you send us. If you write to [email protected] — including the access request from andama.io — we receive your name, email address and whatever you include. We use it only to reply and, if you're a physiotherapist asking to join, to talk with you about that and to check your name against the physiotherapists' register (steps you asked for before a contract, Art 6(1)(b), or our legitimate interest in answering you, Art 6(1)(f)). We keep the conversation for up to 12 months after it ends, then delete it.

Please don't send us health information by email. Questions about your care belong with your physiotherapist.

Physiotherapist profiles and ratings

Our websites show public profiles of physiotherapists who use Andama: details they give us about themselves and their practice and, once the Andama app opens to patients, ratings from their patients. Until then, no ratings are shown. A rating shows the score, the words the patient wrote, the type of plan and the month (for example "Knee plan · Jun 2026"), and — only if the patient chose to sign it — their first name, last initial and the month they joined Andama ("on Andama since Apr 2026"). Patients can delete their rating at any time; we then keep only the date it was first posted, so a plan can't be re-rated to get around the 14-day edit window (our legitimate interest in fair ratings), until the patient deletes their account. A physiotherapist's clinic website may show a small ratings badge that loads from andama.app; it sets no cookies and we receive only the technical data described above.

Who else sees it

We don't sell personal data or share it for advertising. The only other parties are the providers that run our websites and our email — Cloudflare (hosting and, if you allow it, visit statistics) and Google Workspace (email) — acting on our instructions. Both are international companies, so your data may be handled outside the European Economic Area; when it is, the transfer is protected by the EU–US Data Privacy Framework or the EU's Standard Contractual Clauses.

If you use a share button (WhatsApp, Telegram, X, email), you leave our site and that service's own privacy policy applies.

Your rights

Under the GDPR you can ask us to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable form. Write to [email protected] — we'll answer within one month.

Where we rely on our legitimate interest, you can object at any time, and we'll stop unless we have compelling grounds that the law recognises.

You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus.

Changes

If this policy changes, we'll update it here and change the date at the top.