Phex
Phex is an Italian telerehabilitation web app that turns an anamnestic questionnaire into AI-generated, personalised exercise plans for musculoskeletal patients. Physiotherapists, doctors and kinesiologists assign the plan; the patient opens a link, with no account or app to install.
What is Phex?
Phex is a telerehabilitation web app published by Exphy S.r.l., a company based at Largo Ballhaus 31 in Egna, province of Bolzano, Italy. The home page runs under the line Human touch, virtual experience, and the product it introduces is narrow on purpose: software that helps rehabilitation professionals treat musculoskeletal conditions remotely, in the gap between two in-clinic sessions. The technical data sheet defines it as a platform that supports professionals in managing physiotherapy treatment, using machine learning to extrapolate therapeutic exercise programmes.
The starting point is an anamnestic questionnaire. From the answers, the AI proposes a personalised rehabilitation plan, which the clinician selects through three assisted modes and can always modify: the suggestion never becomes an instruction. Exercises come from a library of more than 500 videos, and the assigned set is updated by the algorithm as the patient progresses and sends feedback.
Phex has two faces. On the professional side there is a user profile, a patient base and rehabilitation records attached to each patient, a dashboard for data collection, analysis and follow-up, and an anamnestic section that cross-analyses patient data. On the patient side there is no software at all: the practitioner sends a link, and that link opens the exercise videos with their descriptions, plus a short feedback form at the end of each session. The patient has no login, nothing to download, and can replay the videos as often as needed. Any device with a browser works, on iOS, Android, Mac or Windows.
The publisher names three target segments, independent professionals (physiotherapists, doctors, kinesiologists), small centres and large facilities, and claims to be the first software dedicated to rehabilitation professionals to use digital tools and AI to speed up their procedures. An organisation licence lets a facility pay for its practitioners, set how many users it can attach, share records between members and put its own logo and colour on the interface. The team shown on the site is small and clinical in origin: Michela Beni (Founder, Orthopedic Manipulative and Sport Physiotherapist), Giacomo Giovannini (Chief Operating Officer & Data Scientist) and Riccardo Luzietti (Founder, Kinesiologist and Sport Performance Coach).
The stack is stated openly: Nuxt, Tailwind CSS and Express, AWS EBS and S3 storage on NixOS, a daily backup to a separate server farm, and 24/7 system maintenance by CodeWorks. The interface is available in Italian, English and German.
What it does
- Build a personalised rehabilitation plan from an anamnestic questionnaire
- Let the AI propose the therapeutic plan through three assisted selection modes
- Draw exercises from a library of more than 500 demonstration videos
- Send the patient a permanent link to the plan, with no account and no app
- Collect immediate patient feedback at the end of each session
- Track progress and let the algorithm update the assigned exercises
- Share patient data with other professionals
When to use Phex / When not to
A quick filter to help you decide if Phex is the right fit.
When to use Phex
- Independent physiotherapy practices that want to keep following patients between in-clinic sessions
- Small and medium rehabilitation centres looking to standardise the home exercise programmes they hand out
- Large clinics and hospitals that need an organisation licence, attachable users and records shared between members
- Physiotherapists, doctors and kinesiologists treating conditions of the musculoskeletal system
- Practitioners who want to spend less time on procedures and more time with their patients
When not to use Phex
- Teams that need rehabilitation data to flow into an existing information system: there is no API and no documented third-party integration
- Buyers who require a published price list, since no amount, tier or currency is disclosed anywhere
- Clinicians working outside the musculoskeletal field, which the publisher states as the whole scope of the tool
- Anyone expecting a native iOS or Android app: Phex runs in the browser only, on both the professional and the patient side
- Users who need the product interface in a language other than Italian, English or German
How to use Phex
A typical end-to-end flow, from setup to results.
- Sign up as a professional on the web application, giving your name, phone number, email, password, qualification and billing regime, and accepting the licence terms
- Wait for the account to be activated: new registrations go through a pending-activation step before access is granted
- Log in to the professional interface once the account is live
- Create a patient from the right-hand menu, under patients or rehabilitation records
- Fill in the anamnestic questionnaire that will feed the plan
- Review the plan the AI proposes through its three assisted selection modes, and adjust it whenever your clinical judgement differs
- Attach one or several rehabilitation records to the same patient, within the limit set by your subscription
- Send the patient the share link: no login, no download, and videos that can be replayed at will
- Read the feedback returned after each session and let the algorithm update the exercises as the patient progresses
- To leave, cancel from the subscription section of the profile settings, then retrieve your data within the 90-day window that follows
Pros & Cons
Pros
- Six legal documents are public and download without an account: terms and conditions, licence agreement, privacy policy, technical data sheet, customer notice and DPA
- The DPA comes as an annex to the terms rather than on request, and its Annex IV names the sub-processor, FlashBeing s.r.l. of Bolzano, for software development processed within the EEA
- The reference privacy policy places the servers inside the European Union and the EEA and announces no transfer to a third country
- Nothing to set up on the patient side: no account, no app, no password, just a link that can be reopened at will
- Encryption of sensitive data in the cloud, two-factor authentication, a daily backup to a separate server farm and declared data breach procedures
- The AI proposes, but the professional keeps the final say on the plan that is assigned
- A published technical data sheet, rare at this size, details the infrastructure, the retention and the technical and organisational measures
Cons
- No public price whatsoever: no amount, no tier and no currency appears on the website, in the six legal PDF documents or in the application bundle
- The subscriptions link opens a registration form rather than a price list, and business profiles are sent to an email exchange
- Two privacy policies coexist and diverge, the PDF linked from every page against a more recent HTML page, on hosting location, contact address and retention periods, and the HTML page gives a Gmail address as the controller's contact
- The cookie policy states that no third-party profiling cookies are installed, while the privacy page describes Google Analytics 4 and a marketing and retargeting section
- No API, no third-party integration, no public technical documentation and no native mobile app: the browser is the only way in
- The technical data sheet states in so many words that there is no ISO certification, for a product whose DPA lists health data among the categories processed
- Payments are non-refundable with no credit for a partially used period, technical support is invoiced separately, and the public website exists in Italian only
Pricing & Plans
Exphy S.r.l. publishes no price for Phex. There is no free plan, and no amount, tier or currency appears anywhere on the website, in the six legal PDF documents or in the application bundle, so no entry price can be quoted. The commercial model is a subscription: a personal licence granted for consideration and renewed automatically at each expiry, with both a monthly and an annual cycle provided for in the application and billing handled through Stripe. Pricing is obtained privately: independent professionals go through the registration path of the web application, while business profiles are asked to write to info@phex.care, which is also the address to request a demo, there being no self-service trial. An organisation may hold an organisation licence, pay for its practitioners and set how many users it can attach. Payments are non-refundable, no credit is granted for a partially used period, and technical support is invoiced separately from the licence.
Data, GDPR & hosting
A consolidated view of how Phex handles your data.
GDPR overview
The GDPR framework is concrete and documented. The notice is given under Regulation (EU) 2016/679 and Italian law, and lists the rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to the Garante per la protezione dei dati personali (Article 77 GDPR, Article 140-bis of the Italian privacy Code). Rights are exercised with the controller at the published contacts, the HTML page announcing a reply within 30 days and effect within 48 hours. A data processing agreement based on the Article 28 standard clauses is published as Annex D to the terms and downloads without an account, and its Annex IV names the sub-processor. No Article 27 EU representative is appointed or required, the publisher being established in Italy. The stated minimum age is 16.
Who owns the data?
For the website and commercial contacts, the data controller is Exphy S.r.l., Largo Ballhaus 31, 39044 Egna (BZ), C.F. and P.IVA 03165130216, R.E.A. BZ-237498, reachable at privacy@phex.care or at the certified email address (PEC) exphy@legalmail.it. For the clinical data that professionals enter about their patients the roles are reversed: the licence terms state that the producer acts as data processor under Article 28 GDPR, so the licensee practice remains controller. The terms also recognise the licensee as owner of the intellectual property rights over the results of its own activity through the software. One caveat: the HTML privacy page names a Gmail address as the controller's contact, where the reference PDF names privacy@phex.care.
Reuse rights
Professional users keep what they produce: the licence terms recognise the licensee as the holder of the intellectual property rights over the results of its own activity carried out through the software, and rehabilitation records can be shared with other professionals, in particular between the members of an organisation licence. On its own side, the reference privacy policy lists the publisher's purposes: answering information and demo requests, pre-contractual and contractual management of the subscription, legal obligations, marketing subject to consent, security and fraud prevention, aggregated or anonymous statistics, and legal defence, on the bases of Article 6(1)(b), 6(1)(c), 6(1)(a) together with Article 130 of the Italian privacy Code, and 6(1)(f). Browsing data is aggregated, not immediately identifying, and deleted once processed. Article 14 of the terms adds that Exphy S.r.l. may process, on an aggregated basis and after anonymisation, information it accesses through the licensee's use of the software, for statistical research including the improvement of its services. Annex II of the DPA lists health data among the categories processed on the customer's behalf. Nothing states whether AI models are trained on customer data, and no opt-out is documented.
Data retention & training
Hosting summary
The reference privacy policy, the PDF linked from every page, states that personal data is collected, archived and kept on secure servers, protected by firewalls and physically located within the European Union, and adds that the host's servers sit in the European Economic Area, so that no transfer to a third country or international organisation takes place. The customer notice repeats that commitment, and Annex IV of the DPA places the processing of the named sub-processor, FlashBeing s.r.l., inside the EEA. The technical data sheet describes the infrastructure itself: AWS storage on EBS and S3, a NixOS operating system, a daily backup to a different server farm and 24/7 system maintenance by CodeWorks. Traffic runs over HTTPS and sensitive data is encrypted in the cloud. One divergence has to be flagged: the more recent HTML privacy page is the only document that names a country, saying the publisher uses data hosting providers in France, while every other document says European Union or EEA without naming one. The site reconciles the two nowhere.
Things to keep in mind
Risks and trade-offs to weigh before adopting Phex.
- The AI suggests, it does not diagnose: accepting the proposed plan without reviewing it hands clinical judgement to an algorithm whose logic is not published, and remote follow-up never replaces a hands-on assessment
- No public price: budgeting is impossible without contacting the publisher or going all the way through registration, and payments are non-refundable with no credit for a partially used period
- Two divergent privacy policies coexist, a PDF linked from every page and a more recent HTML page linked from nowhere, disagreeing on where the data is hosted and on the controller's contact, the HTML version giving a Gmail address
- Three different retention frameworks appear across the documents: seven days in the technical data sheet, 38 months on the HTML page, and six months, ten years or 24 months depending on the purpose in the reference PDF
- The cookie policy states that no third-party profiling cookies are installed, while the privacy page describes Google Analytics 4 and a marketing and retargeting section: check what actually runs before signing
- No ISO certification, written in the publisher's own technical data sheet, for a product whose DPA lists health data among the categories processed
- The privacy policy says the list of sub-processors is available on request while the DPA already publishes a named one, and after cancellation only a 90-day window remains before data and credentials are permanently deleted, so plan the export
Setup & Integrations
Technical difficulty
Low. Phex is a web app, so nothing is installed, and the technical data sheet publishes no hardware requirement, leaving CPU, RAM, disk and supported clients unspecified. The professional creates an account and waits for it to be activated before signing in. On the patient side there is no setup at all, only a link to open. There is no API and no integration to configure; organisations can additionally apply their own logo and colour to the interface. The terms place one duty on the user: ensuring that their own hardware, software and network are adequate.
Deployment
Supported languages
Behind Phex
Social
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
What does Phex do?
Who is it for?
How do professionals and patients get in?
How much does Phex cost?
Is there a trial version?
Which devices are supported?
Where is the data hosted, and how is it protected?
Is there an API?
Can one patient have several rehabilitation records?
What happens if I cancel my subscription?
Should you pick Phex?
Phex is a vertical tool and makes no attempt to be anything else: remote rehabilitation of musculoskeletal conditions, built first for the Italian market by a small publisher, Exphy S.r.l., in Egna. Within that scope the proposition is coherent. The AI drafts the plan from an anamnestic questionnaire, the clinician keeps the last word, the patient receives a link and nothing else to manage, and the feedback collected after each session feeds back into the exercises.
What stands out on inspection is the documentation. Six legal documents are public and download without an account, the data processing agreement is supplied as an annex rather than on request, the sub-processor is named, and a technical data sheet spells out infrastructure, backups and security measures. Very few tools of this size publish that much, and the same candour leads the publisher to write that it holds no ISO certification, a point worth weighing since the DPA lists health data among the categories processed.
The weaknesses sit exactly opposite that strength. Nothing about the price is public: no amount, no tier, no currency, in any document or in the application itself. And the site contradicts itself, two divergent privacy policies disagreeing on hosting location, contact address and retention periods, while the cookie policy and the privacy page disagree about third-party tracking.
The verdict follows from that split. Phex deserves a demo request from any practice working on musculoskeletal rehabilitation, and the documentation it publishes puts it ahead of most tools of its size. But the conversation should open with the two questions the website does not answer: what the licence actually costs, and which of the two privacy policies is the binding one.
- Choosing a selection results in a full page refresh.
- Opens in a new window.