Data Privacy Policy

1. Overview

TheraLink PH is a therapy management platform that connects therapists, clinic administrators, and parents of children receiving therapy services. This Data Privacy Policy explains what information our app collects, how it is used, and the choices you have regarding your data.

By creating an account and using TheraLink PH, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Account Information

When you register for a TheraLink PH account, we collect:

• First and last name — to personalize your account and display
• Email address — for login, notifications, and password resets
• Username — as an alternative login identifier
• Phone number — for contact and scheduling purposes
• Password — stored as a bcrypt hash (one-way encryption); we never see your plain-text password
• Profile picture — optional avatar image you upload

2.2 Child / Client Information

Therapists and clinic staff create profiles for children receiving therapy. This includes:

• First and last name of the child
• Date of birth — to calculate age
• Gender
• Diagnosis — therapy-related diagnosis information
• Specialty / therapy focus area
• Status — active, evaluation, paused, or discharged
• Clinical notes — therapist observations and treatment notes
• Parent/guardian linkage — which parent account is connected to the child

2.3 Therapy Activity Data

As part of the home-based learning program, the app records:

• Activity modules and lessons — assigned by the therapist (worksheets, videos, readings, links)
• Completion status — whether an activity was done, skipped, or in progress
• Proof media — photos and videos uploaded by parents to show activity completion
• Skip reasons — notes from parents when an activity could not be completed
• Stars and progress scores — therapist-assigned ratings and focus scores
• Completion counts — for repeat and continuous activities

2.4 Schedule & Session Data

• Session title, date, time, and duration
• Session type — in-person, online, assessment, etc.
• Meeting links — for online therapy sessions

2.5 Usage & Technical Data

• Session cookies — to keep you logged in securely
• CSRF tokens — to protect forms from cross-site request forgery
• Login timestamps — last login time for audit purposes
• Server logs — standard web server access and error logs

Summary of Data Types

Data Category	Examples	Purpose
Personal identifiers	Name, email, username, phone	Account management, login, communication
Health information	Diagnosis, therapy notes, progress scores	Treatment planning and tracking
Media files	Profile pictures, activity proof photos/videos	Personalization, activity verification
Scheduling data	Session dates, times, meeting links	Appointment management
Usage data	Login times, session cookies	Security and authentication

3. How We Use Your Information

We use the collected data to:

• Authenticate users and manage sessions securely
• Display child profiles and therapy programs to authorized parents and therapists
• Assign and track home-based learning activities
• Allow parents to submit photo/video proof of completed activities
• Enable therapists to review progress, assign stars, and provide feedback
• Schedule and manage therapy sessions (in-person and online)
• Send password reset emails when requested
• Generate progress reports and activity history for parents and therapists
• Maintain audit logs for security and accountability

We do not:

• Sell your personal data to third parties
• Use your data for advertising or marketing profiling
• Share data outside of the clinic/organization you belong to

4. Data Sharing & Disclosure

TheraLink PH uses a multi-tenant architecture, meaning each clinic operates in its own isolated workspace. Data is only visible to:

• The parent — can see their own children's profiles, activities, progress, and schedules
• The assigned therapist — can see clients assigned to them, activity programs, and proof submissions
• Clinic administrators — can manage staff accounts and clinic settings within their tenant
• Super administrators — platform-level management (clinic onboarding, system configuration)

Role-based access control ensures that each user only sees information relevant to their role. A parent cannot see another parent's children. A therapist cannot see clients assigned to a different therapist.

We do not share data with third-party services, analytics platforms, or advertising networks.

5. Data Security

Encryption Role-Based Access

We protect your data through the following measures:

• Password hashing — all passwords are encrypted using bcrypt (cost factor 12); plain-text passwords are never stored
• CSRF protection — all forms are protected with anti-forgery tokens
• Session-based authentication — login state is managed via secure server-side sessions
• Multi-tenant isolation — each clinic's data is scoped by tenant ID, preventing cross-clinic data leakage
• Role-based authorization — every page and action checks the user's role before granting access
• File upload validation — uploaded media is validated by type and size before storage

While we strive to protect your data, no method of transmission or storage is 100% secure. If a data breach occurs, affected users will be notified.

6. Data Retention

Retention

• Active accounts — data is retained as long as the account is active
• Discharged clients — child profiles remain accessible to the clinic for historical reference unless explicitly deleted
• Deleted accounts — when a user or client is deleted, their database records are removed; uploaded files (avatars, proof media) may remain on the server until manually purged
• Session data — login sessions expire automatically and do not persist after logout

To request deletion of your data, contact your clinic administrator or our support team.

7. Your Rights

You have the following rights regarding your personal data:

• Access — you can view your profile and your children's data through the app
• Correction — you can update your name, email, phone, and profile picture from the Profile page; therapists can update child profiles
• Deletion — you can request deletion of your account and associated data through your clinic administrator
• Password change — you can change your password at any time from the Profile page
• Withdrawal of proof media — you can undo an activity completion, which removes the associated proof reference

8. Children's Privacy

TheraLink PH is designed for parents managing therapy for their children. The app does not create accounts for children directly. Children's data (name, date of birth, diagnosis, progress) is entered and managed by authorized therapists and clinic staff, and is visible only to the linked parent account.

Parents control the submission of photo/video proof of activities. Children do not interact with the platform directly.

9. Mobile App Considerations

TheraLink PH may be offered as a mobile application (Android/iOS) in the future. When the mobile app is available:

• Camera and microphone access — requested only when uploading proof photos/videos or joining online therapy sessions
• Photo library access — requested only when selecting a profile picture or activity proof media
• Local storage — the app may cache session data locally for offline login state; no therapy data is stored on the device
• Push notifications — may be used for session reminders and activity updates (optional, can be disabled)
• No background tracking — the app does not track location or collect data in the background
• No third-party SDKs — we do not integrate advertising or analytics SDKs that collect personal data

All data practices described in this policy apply equally to the mobile application.

10. Changes to This Policy

We may update this Data Privacy Policy from time to time. When we do, we will revise the "last updated" date at the bottom of this page. For significant changes, we will notify users through the app or via email.

We encourage you to review this page periodically to stay informed about how we protect your data.