Privacy Policy

This Privacy Notice explains how TheraPro LLC (“TheraPro,” “we,” “us,” or “our”) collects, uses, discloses, and stores personal information through our clinic platform and our websites, mobile apps, and web-based resources (collectively, the “Services”).

In this Notice:

• Subscriber means any clinic or practitioner organization that subscribes to and pays for use of the TheraPro platform, including their authorized staff users.
• You / Your refers to any individual user of the Services (e.g., a clinic owner/admin, therapist, staff member, or an individual browsing our sites).
• Patient means any individual who interacts with the platform to book or receive services from a Subscriber clinic.

Notice to Patients

If you are a Patient, your clinic/practitioner (the Subscriber) controls your patient information (e.g., contact details, insurance/billing information, appointment history, charts/notes). TheraPro provides the underlying platform and acts as a service provider/business associate/processor for that Subscriber.

The only information TheraPro directly controls for Patients is any patient login/authentication you create with TheraPro (e.g., email/username and password) if your clinic enables patient access. For questions about your patient record, contact your clinic. For questions about your TheraPro login, contact TheraPro (see Contact Us).

Why TheraPro Collects Personal Information

We collect the minimum personal information needed to:

• Provide, secure, and improve the Services for Subscribers and their authorized users;
• Operate our business (e.g., account creation, subscription management, billing);
• Support usage analytics, performance, accessibility, and product development;
• Communicate about features, service updates, and relevant promotions (you can opt out of marketing at any time).

We do not sell personal information. We share personal information only as described in this Notice.

Information We Collect

1) Contact & Account Information

When you create an account or submit a form, we collect details such as name, email, clinic/organization, and role. We use this to activate and manage your account, provide support, and send service notices. We may also send product or promotional emails—you can unsubscribe at any time.

2) Patient Authentication Information (if enabled)

If you create a patient login to book or access services across one or more clinics on TheraPro, we collect and manage your authentication credentials (email/username and password). These credentials allow you to access clinic experiences you choose to link. TheraPro safeguards this data and does not share your login with a clinic without your consent or a lawful basis.

3) Billing Information (Subscribers)

Subscribers provide payment details to process subscription fees. TheraPro does not store full card data. Payments are handled by a PCI-compliant processor; TheraPro receives a token we can use for future charges.

4) Logs, Device & Usage Information

When you browse or use the Services, we collect technical data (IP address, browser type, device type/OS, timestamps, pages viewed). We use this to maintain security, diagnose issues, and understand feature usage—not to individually profile users for ads.

5) Cookies & Similar Technologies

We use cookies and similar tools (e.g., web beacons) to:

• Keep you signed in and secure;
• Understand traffic patterns and measure feature effectiveness;
• Remember preferences.

You can manage cookies in your browser. Some features require essential cookies to function. See our Cookie Policy for details.

6) Social & Calendar Integrations (optional)

If you sign in via a third-party identity provider or connect external calendars, the respective providers may share limited data with us (e.g., name/email, event metadata such as start/end times). Your use of those providers is governed by their policies.

7) Mobile Apps

When your clinic offers a TheraPro-powered mobile app (for example, an app published under your clinic's name), the app collects only what it needs to work:

• Sign-in details: your email and password, used to sign you in. Your sign-in is kept in your phone's secure storage (iOS Keychain or Android Keystore).
• Your care information: visits, forms you fill in (for example, pain scores and comments), and optional ratings or comments about a visit. This is part of the record your clinic controls (see Notice to Patients).
• Profile photo (optional): if you add one, it is stored securely and shown to you and your care team.
• Notification details: if you allow notifications, a notification token and an app-generated install ID so reminders reach your phone. Signing out removes them.
• Camera and microphone (only when you use them): used for video visits and for taking a profile photo, and only after you give permission. Live video visits are not recorded unless your clinic records or transcribes a visit and tells you before it starts.
• Drafts on your phone: unfinished form answers are saved only on your phone, in secure storage, until you send them or sign out.

The mobile app does not include advertising, does not track you across other companies' apps or websites, and does not use your information for ads. It does not collect your location or contacts.

Legal Bases (GDPR/UK GDPR, where applicable)

Where GDPR or UK GDPR applies, we rely on:

• Consent (e.g., certain marketing, optional integrations);
• Contract (to deliver Services to Subscribers and their users);
• Legitimate Interests (security, service operations, improvements, communications related to the Services).

You may withdraw consent or object to processing where applicable—see Your Rights.

Patient Data (PHI) in the Platform

Subscriber’s Role

Subscribers (your clinic) decide what patient data to collect, how it’s used, who can access it, how long it’s kept, and on what basis it’s shared or deleted, subject to applicable law. Depending on jurisdiction, Subscribers may be “covered entities,” “controllers,” “custodians,” etc., and are responsible for HIPAA or other privacy compliance.

TheraPro’s Role

TheraPro acts as a service provider/business associate/processor. We store PHI securely and make it available to authorized users at the Subscriber’s direction. We access PHI only as authorized by the Subscriber or as necessary to operate/support the Services, address technical/security issues or fraud, or comply with law. We may use de-identified/aggregated information to improve the Services.

Important: For Patient Authentication Information (login credentials for a patient account with TheraPro), TheraPro is the controller/custodian of that specific authentication data. This is not the same as your clinical record controlled by your clinic.

Storage Location

By default, TheraPro hosts production workloads in US-East (N. Virginia) using HIPAA-eligible infrastructure and S3-compatible storage (e.g., Wasabi). Certain optional features or subprocessors may temporarily process limited data in other regions strictly to deliver those features, with appropriate safeguards and contractual controls.

Integrations & Subprocessors

At a Subscriber’s option, TheraPro may integrate with HIPAA-appropriate vendors, for example:

• Telehealth/Video: Amazon Chime SDK on AWS (video sessions; visit audio is captured for transcription and then deleted; video is not recorded);
• Messaging: secure in-app chat within TheraPro’s AWS environment;
• Push notifications: Amazon SNS;
• Email: Amazon SES (app email) and SendGrid (account and product update emails to clinic staff);
• Object Storage: Wasabi (HIPAA-eligible S3-compatible storage).

Each integration is governed by that provider’s terms. TheraPro uses subprocessors to operate the Services subject to written agreements, security reviews, and—where required—BAAs/DPAs. A current list of material subprocessors is available upon request.

Sharing Your Information

We do not sell personal information. We share information only as follows:

• Vendors/Subprocessors: To operate our Services (e.g., hosting, payments, communications). We require appropriate contractual and security safeguards.
• Corporate Transactions: If TheraPro is involved in a merger, acquisition, financing, or asset sale, we may share necessary information under confidentiality. Patient clinical records controlled by Subscribers are not transferred by TheraPro.
• Legal/Compliance: To comply with valid legal process or enforce rights, or where we believe disclosure is necessary to protect safety, security, or integrity. We carefully review requests and, where permitted, notify affected parties.
• Aggregated/De-Identified Data: We may use and share aggregated or de-identified insights that do not identify individuals.

Security

We employ administrative, technical, and physical safeguards designed to protect information, including (as appropriate):

• Encryption in transit and at rest for supported data;
• Role-based access controls and least-privilege;
• Network protection, monitoring, and logging;
• Secure development and vulnerability management;
• PCI-compliant payment processing partners;
• Confidentiality obligations and training for personnel.

No system is perfectly secure. You share responsibility for safeguarding your account (e.g., strong, unique passwords; MFA where available).

Security Incidents

If we determine a security incident led to unauthorized access or disclosure of Subscriber Data, we will notify the affected Subscriber(s) without undue delay and cooperate to mitigate effects. If Patient Authentication Information is affected, TheraPro will notify impacted Patients directly where required.

Retention & Export

• We retain personal information only as long as necessary to provide Services, meet legal obligations, resolve disputes, and enforce agreements.
• Subscribers may export their data at any time and should do so before subscription termination.
• After a subscription ends, accounts are deactivated. We may retain data for a limited period (as permitted by law) to allow potential reactivation; data is isolated from routine processing during this time.

International Transfers

Where personal information is transferred across borders, we use appropriate safeguards (e.g., DPAs with Standard Contractual Clauses, Data Privacy Framework participation by relevant vendors, or other recognized mechanisms). Contractual and technical controls help protect data subject rights.

Your Rights

Depending on your location, you may have rights to:

• Access/Portability: Request a copy of personal information we hold about you (where technically feasible).
• Correction/Deletion: Request corrections or deletion, subject to legal/clinical recordkeeping obligations.
• Withdraw Consent: Where processing relies on consent, withdraw it at any time.
• Object/Restrict: Object to or request restriction of certain processing (e.g., legitimate interests).
• Lodge a Complaint: With your local supervisory/data protection authority.

Patients seeking to exercise rights over clinic records should contact their clinic (the Subscriber). For Patient Authentication Information (your TheraPro login), you can contact TheraPro directly.

Deleting Your Account

You can ask us to delete your TheraPro account at any time. Email privacy@therapro.app from the email you sign in with, with the subject "Delete my account". We confirm your request and delete your TheraPro sign-in and profile (including your profile photo and notification details) within 30 days. Your clinic may be required by law to keep your clinical record, such as visit notes and forms, for a set period. For those records, contact your clinic (the Subscriber).

Children

The Services are not directed to minors, and we do not knowingly collect information from individuals under the age required by applicable law. If we become aware we have collected such information, we will take steps to delete it.

Changes to This Notice

We may update this Notice from time to time. The “Last Updated” date indicates the latest version. Material changes will be communicated as appropriate. Continued use of the Services after changes take effect signifies acceptance.

Contact Us

TheraPro LLC

6650 Rivers Ave, Suite 100

Charleston, SC 29406

Email: privacy@therapro.app (privacy inquiries)

General Support: support@therapro.app

Website: https://www.therapro.app

If you are a Subscriber and require a Business Associate Agreement (BAA) or Data Processing Addendum (DPA), please email privacy@therapro.app.