Privacy Policy | Pacer Rehab

1. Who is responsible

Pacer Rehab is run by Teis Søgaard Kalsbøl, a physiotherapist authorised in Denmark, who is the data controller for the personal data described here.

Email: tsk@pacerrehab.com

Website: pacerrehab.com

Address: Nørholm Bygade 11, 9240 Nibe, Nordjylland, Denmark

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Danish law.

2. What we collect

We only collect the information we need to provide our services and stay in contact with you. This may include:

Name, address, phone number and email
What you write in the contact form
Payment information (processed by Stripe)
Health and training information you give us during a rehabilitation or coaching programme, including your answers to questionnaires and the pain scores you log
Training data from a watch or training platform you choose to connect, such as Garmin through intervals.icu
Messages you send us in the Pacer app
Login and usage data from the Pacer app

3. Purpose of processing

Your personal data is used to:

Answer your enquiry
Deliver the services and products you have purchased
Communicate with you about bookings, programmes and payments
Manage memberships, subscriptions and access to the Pacer app
Keep a clinical record of your rehabilitation, as Danish law requires
Comply with legal obligations, including bookkeeping and tax requirements

4. Legal basis

Contract (Article 6(1)(b)): to deliver the services you have asked for
Legal obligation (Article 6(1)(c)): bookkeeping and the duty to keep a clinical record
Health care (Article 9(2)(h)): your health information is processed by a physiotherapist bound by professional confidentiality, to assess and treat you. This is also why your clinical record can't be deleted on request before the retention period in section 5 has passed
Consent (Article 6(1)(a)): connecting your intervals.icu account and turning on notifications. You can withdraw this consent at any time
Legitimate interest (Article 6(1)(f)): answering enquiries, running the business and keeping the website and app secure

5. How long we keep it

An enquiry through the contact form that doesn't lead to a programme is deleted within 12 months.
Your clinical record is kept for 5 years after the last entry, as the Danish rules on patient records require, and is then deleted.
The record of your acceptance of these terms is kept with your clinical record, for the same period.
Your account and data in the Pacer app are deleted when your programme ends. Copies in our backups disappear within 7 days after that.
Accounting records are kept for 5 years, as Danish bookkeeping law requires.

6. Who processes data for us

Your personal data is only shared with providers who process it on our behalf:

Payments: Stripe
Email, online consultations and appointments: Google Workspace (Gmail, Google Meet, Google Calendar)
The contact form: Google Apps Script, which delivers your message to our inbox
The Pacer app: Google Cloud and Firebase, with the data stored in the EU
Sign-in protection in the app: Google reCAPTCHA Enterprise
Hosting of this website: Cloudflare
Training plans and training data: intervals.icu
Accounting: Dinero

Each of them processes your data under a data processing agreement. A few of these services can work outside the EU, such as reCAPTCHA, Cloudflare's network and the push services described below. Where that happens, the transfer is covered by the provider's data protection terms, such as the EU Standard Contractual Clauses.

We do not sell your data or share it with anyone for marketing.

7. The Pacer app

Signing in. You can sign in with a 6-digit PIN or with Face ID or your fingerprint on your own device. We never see your face or fingerprint: your phone checks it and tells us only that it was you. We store a scrambled version of your PIN that can't be turned back into the PIN, and for Face ID only a public key. A PIN or Face ID you haven't used for 90 days stops working.

Login protection. To stop automated attacks on sign-in, the app uses Google reCAPTCHA Enterprise. When you open an invitation link or ask for a sign-in code, reCAPTCHA looks at your IP address and signals from your device and browser to judge whether the request comes from a real person using our app. reCAPTCHA never sees your health data, your messages or your training. We do not store your IP address ourselves.

Notifications. If you turn on notifications, your device gets a push token, which we store so we can reach that device. Notifications are delivered through the push service of your browser or phone (Apple, Google or Mozilla), which may be outside the EU. A notification only ever says something general, like "You have a new message from Pacer Rehab". It never contains your name, the content of a message or anything about your health. The token is deleted when you sign out on that device or when your programme ends.

Payments. We give Stripe your name, your email address and an internal id. Stripe never receives anything about your health or your training. Your card details go straight to Stripe; we never see them.

Training data. With your permission, we read your training from intervals.icu: completed and planned sessions, and weekly averages of sleep, resting heart rate and HRV when your watch records them. We use it to follow your rehabilitation. We store weekly totals and averages, not your raw day by day values for heart rate, HRV and sleep.

Backups. We make a backup of the app's data every day and keep each backup for 7 days.

8. Security

We use appropriate technical and organisational measures to protect your information from unauthorised access, alteration, loss or misuse. Every client's data in the app is kept separate, and only you and your physio can read it.

9. Your rights

You have the right to:

See the personal data we hold about you and get a copy of it
Have incorrect data corrected
Have your data deleted, except what the law requires us to keep, such as your clinical record
Have processing restricted, or object to it, in certain cases
Receive the data you gave us in a format you can take elsewhere
Withdraw your consent at any time, for processing based on consent
Complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk)

Requests can be sent to: tsk@pacerrehab.com

10. Cookies and local storage

This website sets no cookies and uses no advertising, analytics or tracking of any kind. Nothing on the site is loaded from another company's servers. The fonts, images and code are served from our own domain through Cloudflare, so visiting a page sends your IP address to Cloudflare, which delivers the page and protects the site against attacks, and to nobody else.

The only thing stored in your browser is the currency you pick on the price pages, so the site remembers it on your next visit. It stays on your device, it is never sent to us, and clearing your browser data removes it.

The Pacer app sets one cookie, _GRECAPTCHA, which reCAPTCHA needs for the sign-in protection described in section 7. The app also keeps you signed in by storing your sign-in session in your browser. Both are needed for the app to work and to keep your account safe.

11. Changes to this policy

We may update this policy. Significant changes will be sent to you by email or shown in the app.

Effective date in dd-mm-yyyy format: 15.10.2026