What we collect
Account details, clinical records entered by authorized staff, and files uploaded to a patient record — what’s needed to run care workflows securely.
Policies & Legal
At a glance
The commitments that matter most.
How TheraLink handles your data, access, and platform use.
How records are protected
Access is limited by role and care relationship. Data is encrypted in transit and at rest. Practices do not see each other’s records.
Software, not a provider
TheraLink is practice-management software, not a healthcare provider. Physiotherapists remain responsible for clinical judgment and treatment decisions.
Privacy questions
For access, correction, or deletion requests, email info@theralink.cloud or use the contact form.
Security & privacy
Security and privacy, in plain words
No jargon, and no badges we haven't earned. Here is what is true for your patients' records, and what happens when something goes wrong.
How your data is protected
Isolation
Every record is scoped to the therapist who created it. There's no shared pool, no cross-clinic search, no shared analytics that exposes one practice's patients to another.
Encryption everywhere it matters
Diagnoses, notes, medical and surgical history, and medications are encrypted at rest. Every patient, case, and session link uses an encrypted identifier, not a guessable number. Daily backups are encrypted end-to-end before they're stored.
Access and logging, not surveillance
Sensitive actions are recorded in an audit trail — who viewed, exported, or changed what — but that log tracks what happened, not the clinical text itself. Even our own debugging tools have that content stripped out before it reaches them.
Private, access-controlled storage
Documents and attachments live in access-controlled cloud storage, never a public folder.
Patient consent on linked records
When a therapist links an existing patient rather than creating them directly, that patient has to approve access before anything is visible to them, and can decline.
Full portability, any time
Therapists can request a full export of their clinical data. Patients can download their own case and session reports as PDFs whenever they want. Nothing is locked in.
Common situations, straight answers
Lost or stolen device
Nothing is stored on the device. TheraLink runs in the browser, so a lost device exposes nothing on its own. Log in from another machine and, if you're worried, reset your password — that automatically signs out every other active session.
Forgotten password
Reset via a one-time code sent to your phone or email. Once you set a new password, every other session is signed out automatically.
A lapsed subscription
Your data isn't touched. Access narrows to your subscription and settings pages until you renew, and you can still request a full export at any time. Nothing is deleted for non-payment.
Leaving TheraLink
You can request a full data export before closing your account. We'll confirm the right next steps with you so your records are handled clearly and nothing important is lost.
What we won't do
- We don't sell or share patient data, not to advertisers, not to data brokers, not to anyone.
- We don't let one clinic see into another's, with no shared analytics or cross-clinic benchmarking that exposes another practice's patients.
- We don't put clinical content in front of support or engineering by default, because debugging tools are built to redact it first.
- We don't skip encryption "for now", with sensitive fields encrypted from day one for every practice, not as an optional upgrade.
Contact
Questions about these policies?
Contact the TheraLink team with questions about privacy, platform use, or your account.