Data Processing Addendum

Effective January 1 2025 · Last updated October 16, 2026

This Data Processing Addendum (“DPA”) applies whenever TheraPro LLC (“TheraPro,” “we,” “us,” or “our”) processes personal data subject to the General Data Protection Regulation (GDPR) on behalf of a subscribing clinic, organization, or individual (“Subscriber”) who has purchased and is actively using TheraPro’s clinic management platform and services (the “Services”).

This DPA is incorporated into, and forms part of, the TheraPro Terms of Use, and applies for the duration of any valid paid subscription to the Services.

1. Terminology

“GDPR” refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.
“Personal Data” means any information relating to an identified or identifiable natural person, including but not limited to name, address, email address, username, billing information, health insurance information, or medical data.
“Process” or “Processing” means any operation performed on Personal Data, whether automated or manual, including collection, use, storage, disclosure, alteration, restriction, erasure, or destruction.
“Controller” means the Subscriber, who determines the purpose and means of Processing.
“Processor” means TheraPro, who Processes Personal Data on behalf of the Subscriber.

2. Roles

The Subscriber acts as the Controller, responsible for deciding what Personal Data is collected, how it is used, and which individuals have access.
TheraPro acts as the Processor, responsible for securely storing, transmitting, and Processing that Personal Data only under the Subscriber’s instructions.
Each party will comply with its respective obligations under the GDPR and any other applicable data protection laws.

3. Purpose & Duration of Processing

TheraPro will Process Personal Data solely for the purpose of delivering the Services (e.g., patient scheduling, charting, secure messaging, telehealth, billing, reporting).
Processing will continue for the duration of the Subscriber’s active paid subscription.
Upon cancellation or termination, TheraPro will retain or delete data only in accordance with Subscriber instructions and applicable laws.

4. Categories of Personal Data

The categories of Personal Data processed may include, but are not limited to:

Identity Data: full name, date of birth, demographic details.
Contact Data: address, email, phone number.
Health Data: appointment history, treatment notes, diagnoses, therapy plans, insurance details.
Financial Data: billing and payment information (via secure third-party processors).
System Data: access logs, user account activity.

Data subjects may include:

Patients of the Subscriber
Therapists and staff employed by the Subscriber
Contractors authorized to act on behalf of the Subscriber

5. TheraPro Obligations

TheraPro agrees to:

This DPA and the Terms of Use serve as written instructions.
Additional written instructions will be honored if compliant with GDPR.

Maintain Data Location Restrictions

An adequacy decision exists, or
Safeguards are in place (Standard Contractual Clauses, EU–US Data Privacy Framework, Binding Corporate Rules).

Confidentiality

All personnel authorized to Process Personal Data are bound by confidentiality agreements or legal obligations.

Security Measures

TheraPro implements technical and organizational safeguards, including encryption (AES-256 at rest, TLS 1.2+ in transit), access controls, audit logging, backup retention, and incident management.

Use of Sub-Processors

TheraPro may engage carefully selected sub-processors (e.g., Wasabi, AWS (including the Amazon Chime SDK for telehealth), SendGrid).
Sub-processors are bound by written agreements requiring GDPR-level safeguards.
TheraPro remains fully liable for their performance.

Breach Notification

TheraPro will notify the Subscriber without undue delay upon becoming aware of a data breach.
TheraPro will assist in mitigation, remediation, and required regulatory reporting.

Support Subscriber Compliance

Respond to data subject rights requests.
Complete Data Protection Impact Assessments (DPIAs).
Cooperate with supervisory authorities.

Data Return or Deletion

Upon termination of Services, and at the Subscriber’s written instruction, TheraPro will either delete or return Personal Data (subject to legal/regulatory retention obligations).

Demonstrating Compliance

TheraPro will provide reasonable information to demonstrate GDPR compliance.
Subscriber may conduct one audit per year, with reasonable notice, and subject to TheraPro’s security requirements.
TheraPro may charge for audit time at prevailing rates.

6. Subscriber Obligations

The Subscriber agrees to:

Collect and use Personal Data lawfully, ensuring proper patient consent is obtained where required.
Provide accurate, lawful instructions for Processing.
Maintain its own compliance with GDPR as Controller, including appointment of a Data Protection Officer (DPO) if required.

7. Governing Law

This DPA is governed by the laws of the European Union and the United Kingdom, with enforcement subject to GDPR provisions.