Privacy policy

Kinezy (kinezy.ma) is responsible for the personal data collected on the platform. We process it in line with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data.

For any question, write to us (see “Contact us” at the bottom of this page).

• For every account: your name, your email address or WhatsApp number, your language, and your password, stored in an encrypted form that nobody at Kinezy can read.
• For a booking: the physiotherapist chosen, the slot if you picked one, and who the visit is for (you, a parent, your spouse or your child). If you came through a Kinezy ad, that ad’s code is saved with the request. We ask nothing about the health of the person being treated.
• For a « Find me a physio » request: the city or neighbourhood, the care sheet if you need one, who the visit is for (gender and age) and the physiotherapist’s gender you prefer.
• For a physiotherapist: the profile details (photo, description, diploma and institution, specialties, languages, cities and neighbourhoods covered, rates, hours), their phone number and the subscription payments the team records.
• Reviews and favourites: the rating and comment you leave, and the physiotherapists you save.
• Site statistics: the pages viewed and their speed, without identifying you (see « Cookies and browser storage »).
• Technical data: the IP address an account is opened from and each request is sent from (booking, « Notify me », « Find me a physio »), and encrypted traces of sign-in and code attempts, used to block abuse.

Kinezy asks nothing about your health: no prescription, no medical file, no test results, no description of the problem. What the person being treated needs, you explain to the physiotherapist directly on WhatsApp, outside Kinezy.

A booking says that a visit is asked of a physiotherapist and who it is for, with nothing about that person’s health. The request is only sent to the physiotherapist you chose (in their space and by email or WhatsApp), and only once you have ticked the box that allows it. Who the visit is for and the ad’s code are not sent to them: only the Kinezy team sees them. A « Find me a physio » request is only read by the Kinezy team, which writes to you on WhatsApp and tells the physiotherapists it contacts about it.

• To open and secure your account, and confirm your email or WhatsApp number.
• To show physiotherapists’ public profiles and let patients find them.
• To pass a booking request to the physiotherapist and put you in touch.
• To verify physiotherapists before their profile is published.
• To manage physiotherapists’ subscriptions and remind them of renewal dates.
• To send you service messages by email or WhatsApp: codes, confirmations, password resets, news about your appointments.
• To measure the site’s visits and speed, so we can improve it.
• To count the requests that came from each Kinezy ad, and who they are for, so we can choose our ads.
• To prevent fraud, fake accounts and automated submissions.

We do not sell your data and we do not pass it to any advertising network. The site shows no ads and contains no advertising tools.

• Anyone can see a physiotherapist’s public profile: name, photo, description, diploma, specialties, areas, rates if they choose to show them, and reviews.
• A physiotherapist’s number is never public. It is given only to a patient who has booked a slot with them, inside the WhatsApp link that lets the patient contact them.
• For each request, the physiotherapist sees the name and number of the person booking and, if they were given, the gender and age of the person being treated.
• A review is shown with its author’s first name only.

The conversation that follows on WhatsApp takes place between the patient and the physiotherapist, outside Kinezy, under WhatsApp’s own rules.

Some technical operations are handled by service providers, who use your data only to provide that service to us and are bound to protect it:

• hosting the site (Vercel) and the database (Supabase);
• measuring the site’s visits and speed (Vercel Web Analytics, Speed Insights);
• storing photos (UploadThing);
• sending emails (Google Gmail, Resend) and signing physiotherapists in with Google;
• sending codes and notifications on WhatsApp (WasenderAPI);
• protection against automated submissions (Vercel BotID).

These providers are based, or process data, outside Morocco: in the European Union (the site and the database are hosted in Frankfurt) and in the United States. We only choose them if they commit to protecting your data, and we transfer nothing without following the rules of Law No. 09-08.

• Account, profile, appointments, reviews and favourites: for as long as your account is open. They are deleted with it.
• A physiotherapist’s subscription payments: kept after the account is deleted, without name or contact details, for as long as the law requires for accounting.
• WhatsApp codes: valid for 10 minutes, erased the next day.
• Sign-in session: 30 days at most without coming back to the site, then erased.
• IP addresses: erased 12 months after the account is opened or the request is sent.
• Anti-abuse traces: deleted automatically after 24 hours.
• Visit measurement: the visit marker is erased after 24 hours, and we only see overall statistics.
• Log of the team’s actions (approvals, recorded payments): 2 years.

Kinezy uses no advertising cookies. This is what is stored in your browser:

• session cookies that keep you signed in (a few minutes, renewed while you are active, and 30 days at most without coming back to the site);
• for a physiotherapist signing in with Google, temporary cookies that link the steps of the sign-in (15 minutes at most);
• a cookie that remembers the language you chose;
• a cookie, kept for 30 days, that orders the list of physiotherapists you see. It is tied to no account;
• if you came through a Kinezy ad, that ad’s code, kept in the tab rather than in a cookie and erased when the tab closes (it stays with your request if you send one);
• a few display settings, not linked to your account: the light or dark theme and, for as long as the tab is open, what you have already chosen or seen (the intro, the patient or physiotherapist side of the homepage, a search, a profile);
• on a physiotherapist’s device, the draft of the profile being filled in, so it is not lost.

To measure the site’s visits and speed, we use Vercel Web Analytics and Speed Insights, without cookies. They record the page viewed, the site you came from, your approximate location (country, region, city), your browser, your type of device, the network speed and the loading time. We only see overall statistics, which don’t say who you are and don’t follow you from one site to another. The visit marker worked out from the request is erased after 24 hours.

On the sign-in, sign-up and booking forms, a bot check looks at technical signals from the browser to block automated submissions.

We protect your data with appropriate technical and organisational measures: passwords and codes stored in an encrypted form, secured traffic and protection against repeated attempts. No system is infallible: if you notice anything unusual on your account, tell us.

Under Law No. 09-08, you can access your data, have it corrected and, on legitimate grounds, object to its processing. You can also have your account and the data linked to it deleted.

Much of this can be done directly from your account: profile, appointments, favourites, and “Delete my account” (at the bottom of your patient space, or in a physiotherapist’s settings). For the rest, write to us: we answer within 10 days, after checking that the request really comes from you.

If you believe your rights are not respected, you can refer the matter to Morocco’s National Commission for the Protection of Personal Data (CNDP).

We will update this policy if our practices or the law change. The date at the top of the page shows the latest update, and we will let you know of any important change.