Privacy Policy

Last updated: 9 September 2026 · gaitai.in

This policy explains what gaitai.in collects, why it is processed, the services involved, and how to request help with your data. Product deployment arrangements are described separately below.

This website

You can browse without creating an account. Pages are delivered as static files, with separate services for contact forms, comments, subscriptions and Ask GaitAI. We use aggregate article and assistant counters, described below. The site does not include advertising pixels, a tag manager or session-recording software. Administrator sign-in uses Firebase Authentication; it is separate from public browsing.

Demo and contact requests

The form asks for your area of interest, name, work email, organization and message. It is delivered to us by Formspree, a third-party form service, which processes the submission on our behalf. We use those details to respond to your enquiry. No health or clinical information is requested — please don't include any.

Comments

Where an article or publication page allows comments, your display name, your message, the article/reply reference and a timestamp are stored in Google Firebase (Firestore) and made public. New comments do not request or attach an email address or sign-in identifier. Earlier versions accepted optional email addresses; contact us about removal of an earlier record. Comments appear when submitted and administrators can hide or delete them. Reports about comments are available to administrators and may include the reporting account's email if signed in. When configured, the form loads Cloudflare Turnstile for a verification challenge. Do not post private information.

Blog subscription

What is collected. If you subscribe on the blog, an article page or in the footer, we store the email address you type, which of those three places you typed it, and the times the record was created and last changed. The subscription record contains no name, IP address, device fingerprint or marketing profile. It is held in Google Firebase (Firestore); service-level request information is described below.

Purpose. To subscribe you to GaitAI blog and product updates — research notes, engineering stories and company news. The address is stored for that purpose; it is not published as a subscriber list or sent to an advertising network by this website.

How the record is stored. Each subscription is filed under a hash of the normalized email address to detect duplicates and support unsubscribe requests. The database rules prevent listing all subscribers. This is not encryption or anonymity: a person who already knows an address can look up its subscription record.

Unsubscribing. Use the unsubscribe page at any time — enter the address you subscribed with; no account or sign-in is needed. Your record is then marked as unsubscribed and stops receiving anything.

Retention. An active subscription is kept until you unsubscribe. An unsubscribed record is kept — flagged, and never sent to — so that a later import cannot quietly put you back on the list. If you want the record deleted outright rather than flagged, ask us at the address below and we will remove it.

Browser storage and cookies

Local storage remembers your theme, article like choices, whether you have seen the assistant introduction, and recent comment submissions to reduce duplicates. Session storage keeps a short Ask GaitAI conversation and article/assistant counter markers. You can clear these through your browser's site-data controls; this also clears remembered preferences. We do not set advertising cookies. Third-party embeds, verification and sign-in services may use their own storage under their privacy terms.

Blog article views and likes

Each journal article keeps a running count of views and likes in Google Firebase (Firestore). The stored record is two whole numbers and a timestamp — no IP address, no device or browser fingerprint, and no visitor identifier in the counter record. To avoid counting the same visit repeatedly, your browser keeps a marker in its own session storage saying it has already counted that article; the marker never leaves your device and is cleared when you close the tab. If a like is registered, the same kind of marker is kept in local storage so the button reflects your own choice.

Blog interaction counts

The Blog's interactive articles keep aggregate counts of how they are used: that a story was opened, how far down it was read (in quarters), whether an interactive figure was started and finished, which illustrative state of a figure was chosen, which reading mode was selected, which links out of a story were followed, and the answer to “Did this help you understand the idea?” with its fixed-choice reason. Each count is stored in Google Firebase (Firestore) as one whole number per day, per article and per event; there is no record per visitor, session or device, no IP address, no identifier and no free text of any kind. Nothing you upload, type, or measure in the Movement Lab is part of these counts. Your browser keeps short-lived markers in its own session storage so the same visit is not counted twice; they never leave your device. If your browser sends the Do Not Track signal, no count is recorded at all. Administrator sign-in is required to read these counts.

Ask GaitAI

When a hosted answer is enabled, your question, current page path and title, up to six previous conversation turns and selected public content identifiers are sent to our Cloudflare Worker and Workers AI to prepare an answer. Cookies and uploaded video are not attached. The website can also answer from its public records locally when the hosted service is unavailable or not configured. Do not include patient details, confidential information or sensitive personal data. The short conversation is kept in this tab's session storage; use the assistant's reset control or clear browser site data to remove it. The Worker does not write questions or answers to its application logs. It records operational counts, timing and error categories. Abuse prevention stores request timestamps against a daily hash derived from the connecting IP address; this is a pseudonymous identifier, not a guarantee of anonymity. Its cleanup runs every six hours, removing callers idle for an hour and daily totals older than the previous day. Provider processing is covered by the linked Cloudflare terms below.

Aggregate assistant usage

Firebase stores counts of assistant opens, questions, suggested-prompt selections and answer-link clicks, grouped by page type. Those records contain counters and an update timestamp, with no question, answer, conversation identifier, video or file name. They help us understand which parts of the guide people use. Administrator access is required to read these counts.

Movement Lab video

The Movement Lab analyser reads a clip you choose entirely inside your browser. The file is opened through a local object URL and handed frame by frame to a pose model that runs in the tab; neither the video nor anything derived from it is uploaded, stored or sent to us by the analyser. Model weights are downloaded from this site; the runtime is downloaded from jsDelivr when analysis starts. Those downloads expose ordinary request information to the serving providers, but do not contain your video or pose results. If you record a short clip with your camera instead, that recording is held in the tab's memory. Replacing or clearing the clip releases the local object URL; leaving the page ends the analysis. Built-in demonstrations and illustrative report examples are distinct from measurements of your clip. Sharing an exploration link does not publish a selected private video.

Embedded media

Some articles embed video from YouTube (via its no-cookie domain) or Vimeo. Loading an embedded player or following an external link can send request information to that provider, which applies its own privacy terms. A no-cookie domain does not mean no network processing.

Hosting, logs and service providers

GitHub Pages hosts the public site. GitHub states that visitor IP addresses are logged for security, including visits made without signing in. Formspree, Firebase, Cloudflare, jsDelivr and embedded-media providers receive the requests needed to serve the features you use. Their operational records can include IP addresses, browser information, request times and error details. We do not promise that provider logs are absent or share the retention period of a browser-only feature.

• GitHub Pages data collection
• Formspree privacy policy
• Firebase privacy and security
• Cloudflare privacy policy
• Workers AI data usage

Retention and your choices

Contact correspondence is retained to handle your enquiry and any follow-up. Public comments remain until removed; aggregate counters do not have an automatic expiry. The website does not currently set a fixed automatic deletion period for contact records, comments or subscriptions. Subscription retention is described above. Service-provider logs and backups follow the relevant provider settings and terms. We do not promise an unverified deletion deadline.

You can request access, correction or deletion of information you have supplied, ask to stop receiving updates, or raise a privacy concern at the contact below. Include the relevant page or service and enough information to locate the record; do not send identity documents or medical records with an initial request. We may need to verify a request before changing a record. Available rights and any required exceptions depend on applicable law and the processing involved. Clearing browser storage does not delete records held by the services listed above.

Security

The public site and service requests use HTTPS. Database rules restrict administrative changes and access to private collections. No transmission or storage system is risk-free. Please report a suspected issue through our security contact.

Children and international visitors

The website is intended for professional and general educational exploration, and does not ask children to provide personal information. A parent or guardian can contact us about information a child may have submitted. Do not submit a child's private or health information in forms, comments or Ask GaitAI.

Our service providers operate internationally, so information sent to them may be processed outside your country. Applicable privacy rights, contractual arrangements and safeguards depend on the service and jurisdiction. The use of a provider does not itself establish GaitAI's compliance with a particular law.

GaitAI products

The products analyse how people move, which makes privacy an architectural decision rather than a policy footnote. The pipeline is designed to work on movement features rather than identifiable video: skeleton-only processing, optional face blur applied before analytics, configurable retention, role-based access and logged activity are architectural capabilities, configured per deployment rather than guaranteed everywhere.

Clinical captures are intended to be collected with informed consent and appropriate authorization, and retained only as long as the care workflow requires. In SecureVision, capabilities that do not require identity are the default; identity, re-identification and watchlist capabilities are a separate group that is intended only for lawful, authorized deployments with appropriate governance, access control and auditability.

What we do not claim

GaitAI claims no privacy or security certification and asserts no compliance status — not GDPR, DPDP Act, HIPAA, ISO 27001 or SOC 2. For a product deployment, privacy roles, lawful basis, consent and any required assessments must be established for the actual deployment and the parties involved.

For commercial deployments, contractual privacy terms, retention periods and jurisdiction-specific requirements are defined for the applicable deployment and contracting entity. Movement data, retention and access obligations differ too much between a clinic, a campus and a transport hub for a single blanket policy to be meaningful.

Policy changes and contact

We will update this page when website behaviour or these disclosures change, with the revision date shown above. Check the current policy before sharing information through a new feature.

Questions about this page, or a request relating to your data: contact@gaitai.in. The contact form is the other way through.