Protecting Patient Data

At TheraPro, protecting your privacy and ensuring the security of your health information are central to everything we do. Our platform was built from the ground up with HIPAA compliance, data protection best practices, and security-first engineering as guiding principles. We recognize that as patients, therapists, and clinic administrators, you may have important questions about how your information is handled, stored, and secured.

This document provides a detailed overview of the safeguards we’ve implemented, the processes we follow, and the responsibilities we share with clinics to protect your data. We’ve broken it down into the most frequently asked-about areas, with added detail to help you understand not only what we do, but why it matters.

1. Privacy Policy & Terms of Service

Every clinic that uses TheraPro is bound by our Privacy Policy and Terms of Service, which are formal agreements outlining how we handle sensitive data. Under HIPAA and related privacy regulations, the Account Owner (usually the clinic or practice) is the designated custodian of patient data.

• The clinic agrees to collect, use, and store data in accordance with TheraPro’s policies and all applicable laws.
• TheraPro functions as a HIPAA Business Associate, providing secure hosting, processing, and storage.
• Clinics are responsible for obtaining patient consent where legally required, while TheraPro ensures the platform meets security standards for lawful processing.

This shared model means your therapist and clinic retain direct control over your records, while TheraPro ensures the infrastructure supporting those records is safe, encrypted, and compliant.

2. Encryption & Secure Data Transfer

We apply the same level of encryption used by leading banks and hospitals:

• In Transit: Whenever data moves from your device to TheraPro, it is encrypted using TLS (Transport Layer Security) protocols. This prevents third parties from intercepting your information.
• At Rest: All data stored on TheraPro’s servers is encrypted with AES-256, one of the strongest encryption standards available. Even if someone gained access to the physical storage drives, the data would remain unreadable.
• Backups: Encrypted backups are created across multiple availability zones within AWS, ensuring both resilience and security.

In short: your records are protected end-to-end, from the moment you log in to the platform to the moment your therapist accesses your chart.

3. Data Retention & Removal

Patients often ask: “Can my records be deleted?” The answer depends on legal requirements.

• Clinics and practitioners are bound by state, federal, and professional regulations requiring medical records to be kept for a number of years — often 7 to 10 years or more.
• If you request deletion of your records, the clinic must first evaluate their legal obligations. If permitted, they provide TheraPro with official instructions.
• TheraPro will then follow NIST 800-88 guidelines for data destruction, ensuring that once records are deleted, they cannot be reconstructed.

This approach ensures that clinics meet their legal responsibilities while patients can trust that, when deletion is allowed, it is performed with the highest level of security.

4. Credit Card & Billing Security

Unlike some platforms, TheraPro never stores plain credit card numbers.

• When a card is entered, the information is securely transmitted to our PCI-DSS compliant payment processors (e.g., Stripe).
• The processor stores the card and returns a token — a secure placeholder — to TheraPro.
• TheraPro keeps only the last 4 digits and expiration date so clinics and patients know which card is on file.

This means:

• Even if TheraPro’s database was compromised, no raw credit card data would ever be exposed.
• Refunds and repeat charges are possible only through secure tokens, not card details.

5. Account Ownership & Access Controls

The Account Owner — typically the clinic director or administrator — determines:

• What patient data is stored (charts, billing, demographics, history, etc.)
• Which staff members can view, edit, or export specific data
• How long records are retained

TheraPro permissions are granular, meaning access can be tailored to roles:

• Front desk staff may only see names and appointments.
• Therapists can view patient records but not necessarily billing details.
• Admins can configure overall system access.

This ensures that each user sees only what they need to perform their role.

6. Authentication & Passwords

Security starts with user accounts:

• Each therapist, admin, and patient has a unique ID and password.
• Passwords are stored using salting and hashing techniques, never in plain text.
• Optional two-factor authentication (2FA) provides additional protection.

Patients can also review their own sessions, see which devices are logged in, and log out remotely for extra peace of mind.

7. Activity Tracking

Transparency is critical.

• TheraPro provides an Activity Log to Account Owners, showing exactly who accessed what, when, and why.
• Logs can be filtered by date, user, and activity type — for example, “Show me every time a patient chart was opened in the last 30 days.”
• These logs support both internal auditing and regulatory compliance checks.

8. Session Management & Password Reset

Patients and staff can easily protect their accounts:

• Logout All Sessions: If a patient suspects unauthorized access, they can log out from all devices with one click.
• Password Reset: A secure reset link is sent by email. Once reset, all previous sessions are automatically logged out.
• Admin Override: Account Owners can reset staff access when needed (e.g., if an employee leaves the clinic).

9. Privacy-Enhancing Features

We’ve built features that support clinics in minimizing unnecessary exposure:

• Blur Patient Names: Front desk staff can view appointment lists without full identifying details.
• Chart Access Restrictions: Access can be limited to assigned therapists only.
• Audit-Ready Reports: Activity reports are exportable for compliance audits.

These small but important details ensure that privacy is embedded in everyday workflows.

10. Culture of Security

At TheraPro, security isn’t just technology — it’s part of our culture:

• All employees undergo background checks before being hired.
• Staff sign confidentiality agreements and complete ongoing HIPAA & security training.
• Access to patient records by TheraPro staff is strictly limited, logged, and performed only when a clinic requests support.

This human-first approach ensures that everyone who touches the system understands their responsibility to protect sensitive data.

Conclusion

Privacy and security at TheraPro are more than compliance checkboxes — they are foundational commitments to clinics, therapists, and patients alike.

• Data is encrypted, segmented, and monitored.
• Clinics remain owners and custodians of patient records.
• Patients have clear rights, visibility, and controls over their information.

By combining regulatory compliance, technical safeguards, and cultural accountability, TheraPro delivers a platform where clinics can grow confidently and patients can trust that their most sensitive information remains safe.

For more information, visit our Security & Trust Center or email us at privacy@therapro.app.