1. Overview
TheraLink PH is a therapy management platform that connects therapists, clinic administrators, and parents of children receiving pediatric occupational therapy. This Privacy Policy explains what information we collect and how we use it.
For a detailed breakdown of all data types collected, please see our comprehensive Data Privacy Policy.
2. Information We Collect
Account Information
- Name, email, username, and phone number for login and communication
- Password — stored as a bcrypt hash; we never see your plain-text password
- Optional profile picture
Child / Client Information
- Name, date of birth, gender, diagnosis, and therapy focus area
- Status (active, evaluation, paused, discharged)
- Clinical notes and parent/guardian linkage
Therapy Activity Data
- Activity modules, lessons, and completion status
- Photo/video proof uploaded by parents
- Stars, progress scores, and therapist feedback
Schedule & Session Data
- Session dates, times, types (in-person, virtual), and meeting links
3. How We Use Your Information
- Authenticate users and manage secure sessions
- Display child profiles and therapy programs to authorized users
- Track home-based learning activities and progress
- Schedule and manage therapy sessions
- Generate progress reports for parents and therapists
- Send password reset emails when requested
We do not sell your data to third parties, use it for advertising, or share it outside your clinic.
4. Data Sharing & Access Control
Each clinic operates in its own isolated workspace (multi-tenant architecture). Data is visible only to:
- Parents — their own children's data only
- Therapists — clients assigned to them only
- Clinic Administrators — staff and clients within their clinic
- Super Administrators — platform-level management
Role-based access control ensures no user sees data outside their authorized scope.
5. Data Security
- Password hashing — bcrypt encryption (cost factor 12)
- CSRF protection — all forms protected with anti-forgery tokens
- Multi-tenant isolation — each clinic's data scoped by tenant ID
- Role-based authorization — every page checks user role before granting access
- File upload validation — media validated by type and size
6. Your Rights
- Access — view your profile and your children's data through the app
- Correction — update your name, email, phone, and password
- Deletion — request account and data deletion through your clinic administrator
- Withdrawal of proof media — undo activity completions to remove proof references
7. Children's Privacy
Children do not create accounts directly. Their data is entered and managed by authorized therapists and clinic staff, and is visible only to the linked parent account. Parents control submission of photo/video proof.
8. Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be communicated through the Platform or via email.