OrthoSteps App Privacy Policy

Android · Last Updated: May 19, 2026

This Privacy Policy describes how your information is collected, used, and shared when you use the OrthoSteps mobile application (the "App") on Android.

Your participation in any research study using this App is voluntary and subject to a separate informed consent process conducted by the specific research team. This policy specifically only covers data collected, used and shared by the App.

1. Information We Collect Through the App

  • Participant ID: When you log in, you provide a unique, pseudonymized Participant ID assigned to you by your research team. This ID does not directly identify you personally within the App but allows the research team to link your App data to your study record.
  • Health Connect Data: With your explicit permission granted through Google Health Connect, the App accesses the following health data stored on your device:
    • Step Count: Your daily step count, aggregated from sources you have configured in Health Connect (for example, Google Fit, Samsung Health, Fitbit).
    This data includes the date and the measured step count for that date.
  • Synchronization Timestamp: The App stores a timestamp indicating the last time your step data was successfully synchronized with the secure research database.
  • Surgery Date (Stored Locally): The App asks for your surgery date. This date is stored only locally on your device within the App's private storage and is used solely for displaying progress relative to this date within the App interface. It is not transmitted to or stored on our servers.

2. How We Use Your Information

  • Linking Data: Your Participant ID is used to link the Step Count Data and Synchronization Timestamp collected via the App to your confidential participant record maintained separately by your research team.
  • Research Analysis: The pseudonymized Step Count data linked to your Participant ID will be used by your research team for the purposes outlined in the specific study's informed consent document, such as analyzing recovery patterns after orthopaedic surgery.
  • App Functionality: The locally stored Surgery Date and fetched step data are used to display graphs and statistics within the App to help you track your progress. The Synchronization Timestamp helps the App sync data efficiently.

3. How We Share Your Information

  • Research Team: Pseudonymized data (Participant ID, Step Counts, Sync Timestamp) collected via the App is accessible only to authorized members of the research team conducting your specific study, as described in your informed consent document.
  • Third-Party Sharing: We do not sell or share your Participant ID or collected step data with any third parties for marketing purposes. However, we may share your pseudonymized data with certain third parties, such as Supabase, for data storage to deliver the App services. The pseudonymized data would be in encrypted form in transit and the third parties would not have access to view or use the data.
  • Aggregated/Anonymized Data: Results of research using aggregated or fully anonymized data (which cannot be linked back to you) may be published or presented, as detailed in your study's informed consent.
  • Consent: Pseudonymized data may be shared if you provide us consent.
  • Required by law: Pseudonymized data collected via the App may also be disclosed if required by law to do so.
  • Permitted by your informed consent: The data from the App shared with the research team conducting your specific study may be disclosed as otherwise permitted by your informed consent document.

4. Data Security

We use Supabase as our backend provider. We implement appropriate technical and organizational measures to protect your data, including:

  • Secure transmission of data (HTTPS).
  • Strict server-side access controls (Row Level Security) ensuring data can only be submitted using a valid Participant ID and cannot be read or modified inappropriately.
  • Pseudonymization using the Participant ID.

However, no system is 100% secure. We cannot guarantee the absolute security of your information.

5. Data Retention

Data collected via the App will be retained according to the policies outlined in the main study informed consent document provided by your research team. Local data, including the Surgery Date, is removed if you delete the App.

6. Your Choices

  • Health Connect Access: You can manage the App's access to your step data at any time via the Health Connect settings on your device (Settings → Apps → Health Connect, or the standalone Health Connect app on older devices). Disabling access will prevent the App from collecting and syncing new data.
  • App Usage: You can stop using the App at any time. To withdraw from a study itself, please contact your research team directly using the contact information provided in your informed consent document.

7. Health Connect

We are not responsible for the data collection, use practices, or policies of Health Connect or its source apps (such as Google Fit, Samsung Health, or Fitbit). Please read those privacy policies for their own data collection, use, and privacy practices.

8. Children's Privacy

This App is not intended for individuals under the age of 18 unless specifically permitted by the research study in which you are participating.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy within the App. Your continued use of the App after we make changes is deemed to be acceptance of those changes, so please check the App Privacy Policy periodically for updates.

10. Contact Us

If you have questions about this Privacy Policy or the App's data handling practices, please contact: trapalis@ohsu.edu

Looking for the iOS version? See the OrthoSteps iOS Privacy Policy.