Skip to content Skip to footer
Menu Close
Close
Facebook Linkedin
Get Started

Get Started

Data Handling Notices

Last Updated: June 2, 2026
Effective Date: June 2, 2026

This Data Handling Notice explains how AcuFlex handles patient, clinician, device, measurement-session, and research data. It is intended to help patients, clinicians, research participants, institutional review boards, study teams, and customer organizations understand what information is collected, who can access it, how it is protected, and what happens to it during and after use of AcuFlex.

This notice applies to the AcuFlex mobile applications, AcuFlex measurement device, AcuFlex cloud services, clinician and administrator web interfaces, reports, exports, and related workflows.

This notice should be read together with the AcuFlex Privacy Policy, AcuFlex Product Cybersecurity and Security Information page, any applicable study consent form, any institutional review board materials, and any privacy notices provided by the patient’s healthcare organization or study site.

  1. Purpose of data collection

AcuFlex collects and processes information to support objective musculoskeletal assessment, ankle dorsiflexion measurement, rehabilitation monitoring, clinical documentation, device operation, quality review, and authorized research.

AcuFlex data may be used to:

  • Create and manage patient profiles.
  • Associate measurement sessions with the correct patient.
  • Conduct AcuFlex measurement sessions.
  • Calculate and display ankle dorsiflexion and related measurement results.
  • Generate clinical reports and session histories.
  • Allow authorized clinicians to monitor patient progress.
  • Support clinical, rehabilitation, sports medicine, or performance workflows.
  • Support authorized research, validation, and analytics using de-identified or anonymized datasets.
  • Maintain security, auditability, device performance, and system reliability.

AcuFlex does not use patient health information or measurement-session data for third-party advertising.

AcuFlex does not sell patient health information, measurement-session data, or protected health information.

  1. Information collected

The information collected may depend on the user’s role, the clinical or study workflow, and which AcuFlex features are enabled.

Patient profile information

AcuFlex may collect patient profile information such as:

  • Patient name
  • Patient email address
  • Date of birth or age-related information
  • Sex at birth
  • Height
  • Weight
  • Foot arch length
  • Distance to the back of the knee
  • Clinic, hospital, study site, or organization association
  • Medical-record number, hospital identifier, study identifier, or other organization-specific identifier, if used
  • Consent-confirmation status, when supported by the workflow
  • Consent-confirmation timestamp, when supported by the workflow

This information is used to identify the patient within the authorized clinical or study workflow, perform measurement calculations, associate sessions with the correct person, and generate reports.

Measurement-session information

During an AcuFlex session, the system may collect information such as:

  • Session date and time
  • Session duration
  • Local time zone
  • Device identifier
  • Clinician or user associated with the session
  • Patient associated with the session
  • Left and right ankle dorsiflexion values
  • Left and right knee flexion values, when supported
  • Heel lag and knee lag measurements
  • Slant-board angle
  • Motion-sensor information, including pitch, roll, acceleration, gyroscope, or related IMU values
  • Bluetooth connection status
  • Sensor status
  • Session events
  • Upload status
  • Error conditions
  • Generated session summaries, histories, and reports

These data are used to support measurement, clinical review, progress tracking, quality review, troubleshooting, and authorized de-identified or anonymized research.

User and clinician information

AcuFlex may collect information about clinicians, administrators, research users, and other authorized users, including:

  • Name
  • Email address
  • Phone number
  • Role or permission level
  • Organization or study-site affiliation
  • Login and authentication information
  • Account status
  • User activity and audit-log events
  • Support requests or communication history

This information is used to manage accounts, assign permissions, maintain auditability, support users, and protect the security of the system.

Device, app, and technical information

AcuFlex may collect technical information such as:

  • App version
  • Firmware version, when applicable
  • Operating system version
  • Mobile device model
  • Device pairing and connection status
  • Device configuration or calibration information
  • IP address and network-related metadata
  • Operational logs
  • Security-relevant events
  • Error, diagnostic, or crash information

This information is used to operate the system, troubleshoot issues, maintain security, and improve reliability.

  1. Patient email addresses

AcuFlex may require or support use of a patient email address when creating or managing a patient profile, inviting a patient to access the system, linking a patient profile to an account, or supporting patient-related communication workflows.

Patient email addresses are treated as patient-identifying information.

Patient email addresses are not intended to be included in de-identified or anonymized research exports provided to scientist or research users.

When AcuFlex is used in a clinical study, the study consent form or study-specific materials should explain why the patient email address is collected, who can see it, how it will be used, whether it will remain in the AcuFlex system after the study, and how long it will be retained.

  1. Consent and authorization

Patient information should be entered, stored, or used in AcuFlex only when the responsible clinician, healthcare organization, study sponsor, or research team has obtained any required consent, authorization, or institutional approval.

AcuFlex may record consent-confirmation status when supported by the workflow. However, AcuFlex does not replace the responsibility of the clinician, healthcare organization, study sponsor, or research team to obtain, maintain, and manage required consent forms, authorization forms, institutional review board documents, or other legal documentation.

If AcuFlex is used in a clinical study, participants should review the study-specific consent form and ask the study team any questions before participating.

  1. Who can access identifiable data

Access to identifiable patient information is controlled by user role, organization, authorization, and workflow.

Patients

Patients may access their own permitted profile information, session history, or reports when patient access is enabled and authorized.

Clinicians

Clinicians may access identifiable patient information, measurement sessions, reports, and histories for patients associated with their clinic, hospital, study site, or authorized workflow.

Administrators

Administrators may manage users, devices, organization settings, and operational records within their assigned organization and permission level.

AcuFlex support and operations personnel

Authorized AcuFlex personnel or approved service providers may access information only as needed to provide support, maintain the system, troubleshoot issues, investigate security or privacy concerns, comply with legal or regulatory obligations, or perform authorized operational functions.

Scientist or research users

Scientist and research users are intended to receive de-identified or anonymized research datasets rather than direct patient identifiers. Research exports are intended to exclude direct identifiers such as patient name and patient email address.

  1. De-identified and anonymized research data

AcuFlex may support authorized research, analytics, validation, or scientific review through de-identified or anonymized datasets.

Research datasets may include information such as:

  • Measurement-session data
  • Session timing information
  • Device or session metadata
  • Age or age-related information
  • Sex at birth
  • Height
  • Weight
  • Measurement values
  • Hospital, study-site, or geographic attributes, if authorized
  • Encoded or study-specific identifiers

Research datasets are intended to exclude direct patient identifiers such as:

  • Patient name
  • Patient email address
  • Phone number
  • Direct contact information
  • Medical-record number, unless specifically authorized and coded under a study protocol
  • Other direct identifiers not needed for the approved research purpose

Even when direct identifiers are removed, research datasets should still be treated as sensitive. Small sample sizes, unusual clinical characteristics, rare combinations of demographic information, or site-specific information may increase the risk that a person could be indirectly identified. Authorized research users are responsible for protecting research exports according to applicable agreements, study protocols, institutional policies, and law.

  1. Where data are stored

AcuFlex data are stored in secure AcuFlex cloud services.

The AcuFlex mobile app is designed to minimize long-term local storage. The mobile app may temporarily hold information during an active session or pending upload, but long-term clinical records are intended to be stored in AcuFlex backend services rather than on the mobile device.

AcuFlex cloud services are designed to store patient profiles, user accounts, device assignments, measurement sessions, reports, export records, audit logs, and operational records.

  1. How data are protected

AcuFlex uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, loss, or misuse.

Safeguards include:

  • Individual user accounts
  • Role-based access controls
  • Multi-factor authentication support, when enabled
  • Encrypted communication with backend services
  • Encryption at rest for cloud-stored sensitive information
  • Bluetooth security controls for device communication
  • Audit logging
  • Access monitoring
  • Least-privilege access for personnel and system components
  • Secure report and export workflows
  • Security monitoring
  • Vulnerability management
  • Incident-response processes

More information is available in the AcuFlex Product Cybersecurity and Security Information page.

No connected system can guarantee absolute security. Users and organizations also play an important role in protecting accounts, passwords, mobile devices, exported files, and clinical records.

  1. Reports and exports

AcuFlex may generate reports and exports for clinical, administrative, study, or research purposes.

Clinical reports

Clinical reports may contain identifiable patient information and health-related information. These reports may be used by clinicians, patients, healthcare organizations, or study teams for documentation, review, care coordination, or study purposes.

Once a report is downloaded, printed, saved, uploaded to another system, or shared outside AcuFlex, that copy is controlled by the user, healthcare organization, study team, receiving system, or other recipient. Users and organizations are responsible for protecting exported reports according to applicable privacy, security, clinical, and retention requirements.

Research exports

Research exports are intended to provide de-identified or anonymized information for authorized research or analysis. These exports are intended to exclude direct patient identifiers such as patient name and patient email address.

Research exports may be provided in CSV or other structured formats. Export files should be stored securely, shared only with authorized personnel, and used only for approved purposes.

  1. What happens after a study ends

When AcuFlex is used in a clinical study, pilot, validation project, or research protocol, data handling after the study should follow the study protocol, consent form, institutional review board requirements, customer agreement, and applicable law.

After a study ends, AcuFlex data may be handled in one or more of the following ways, depending on the approved study plan:

  • Identifiable clinical records may remain available to the responsible healthcare organization or study site.
  • Patient access may continue, change, or be disabled depending on the study or clinical workflow.
  • Clinician access may continue, change, or be disabled depending on the study or customer agreement.
  • Research users may retain approved de-identified or anonymized datasets according to the study protocol.
  • Temporary export files may be deleted after the export period ends.
  • AcuFlex may retain audit logs, security records, and system records as needed for legal, regulatory, quality, security, and operational purposes.
  • Data may be archived, de-identified, anonymized, deleted, or transferred according to the study protocol, customer agreement, and applicable law.

Study-specific documents should explain which of these options applies.

  1. Data transfer after a study

If AcuFlex is used in a study, identifiable data are not automatically transferred to outside parties unless authorized by the study protocol, patient consent or authorization, healthcare organization, study sponsor, customer agreement, or applicable law.

Depending on the study design, data may be transferred to:

  • The healthcare organization or study site responsible for the participant.
  • The study sponsor.
  • Authorized research team members.
  • An approved data repository.
  • A clinical record system, if configured and authorized.
  • AcuFlex-controlled storage for continued retention, support, quality, or regulatory purposes.

When data are transferred for research purposes, AcuFlex is intended to provide de-identified or anonymized data unless identifiable transfer is specifically authorized by the applicable consent, protocol, agreement, or law.

  1. Retention

AcuFlex retains information only as long as needed for clinical, operational, legal, regulatory, quality-system, security, contractual, and authorized research purposes.

Retention periods may vary depending on the type of data, the clinical setting, study protocol, customer agreement, institutional policy, and applicable law.

General retention principles include:

  • Patient and session data are retained according to applicable clinical, study, contractual, regulatory, and organizational requirements.
  • Temporary export files are retained only for limited periods and are intended to be removed after the export workflow is complete.
  • Audit logs are retained as needed for security, compliance, quality, regulatory, and operational purposes.
  • Account information may be retained while an account remains active and for a reasonable period afterward as required for security, legal, audit, or operational purposes.
  • De-identified, anonymized, or aggregated information may be retained for research, validation, analytics, product improvement, quality assurance, or regulatory-support purposes when permitted.
  1. Data correction, access, and deletion requests

Patients and users may have rights to request access, correction, deletion, restriction, or additional information about their data, depending on the applicable law, healthcare organization, study protocol, and customer agreement.

Patients who use AcuFlex through a healthcare provider, study site, or clinical organization should usually direct requests about clinical records, study records, amendments, or deletion to that organization or study team.

AcuFlex may assist with requests when appropriate, but some information may need to be retained for legal, regulatory, clinical, contractual, audit, safety, quality-system, or security reasons.

  1. Responsibilities of users and organizations

Users and organizations are responsible for using AcuFlex in a secure and appropriate manner.

Clinicians, administrators, study teams, and research users should:

  • Use individual accounts and not share logins.
  • Protect passwords and authentication methods.
  • Use only authorized devices and approved workflows.
  • Keep mobile devices and operating systems updated.
  • Protect downloaded reports and exported files.
  • Share identifiable patient information only with authorized recipients.
  • Store research exports securely.
  • Follow applicable study protocols, institutional policies, privacy rules, and security requirements.
  • Promptly report suspected privacy or security incidents.
  1. Relationship to the Privacy Policy and Cybersecurity page

This Data Handling Notice provides a plain-language explanation of how AcuFlex handles data in clinical, study, and research workflows.

The AcuFlex Privacy Policy explains broader privacy practices, including collection, use, sharing, retention, rights, and service-provider relationships.

The AcuFlex Product Cybersecurity and Security Information page explains how AcuFlex protects the system, accounts, devices, cloud services, and data.

If AcuFlex is used in a clinical study, the study-specific consent form, data handling materials, institutional review board documents, and customer agreements may provide additional details.

  1. Questions and contact information

Questions about clinical care, study participation, consent, or medical records should be directed to the responsible clinician, healthcare organization, study site, or study team.

Questions about AcuFlex privacy, data handling, cybersecurity, or support may be directed to:

Privacy contact: [privacy@acuflex.io]
Security contact: [security@acuflex.io]
Support contact: [support@acuflex.io]
Company legal name: [AcuFlex™]
Mailing address: [402 Plaza Dr #1, Carterville, IL 62918]

Please do not send sensitive patient information by unsecured email unless instructed to do so through an approved secure channel.