What we collect
Account details, clinical records entered by authorized staff, and files uploaded to a patient record — what’s needed to run care workflows securely.
Policies & Legal
Clear information about privacy, platform use, and data handling.
This page covers TheraLink’s privacy policy and terms of service in plain language.
At a glance
The commitments that matter most.
Key points from the full privacy policy and terms below — a quick scan before the complete legal text.
How records are protected
Access is limited by role and care relationship. Data is encrypted in transit and at rest. Practices do not see each other’s records.
Software, not a provider
TheraLink is practice-management software, not a healthcare provider. Physiotherapists remain responsible for clinical judgment and treatment decisions.
Privacy questions
For access, correction, or deletion requests, email or use the contact form.
Policies on this page
Privacy Policy
Who operates TheraLink
TheraLink is a physiotherapy practice-management platform available to clinics in Lebanon. The team behind TheraLink is responsible for the platform and the data handling described on this page.
Privacy Policy
Privacy policy
This section explains what TheraLink collects, who can access it, how it is protected, how long it is kept, and what choices are available to you.
What data we collect
TheraLink collects the information needed to run accounts, deliver care workflows, and store practice files securely.
- Account information — names, email addresses, phone numbers, credentials, roles, subscription and billing details for admins and physiotherapists, and basic profile details for patients and linked guardians.
- Clinical and health data — patient records entered by authorized staff, including medical history, cases, sessions, assessments, notes, appointments, and generated reports.
- Uploaded files — documents and attachments you upload to a patient record, including file name, type, size, and storage metadata.
Who can see your data
Access is limited by role and care relationship. Your treating physiotherapist can see the patients and records they are authorized to manage. TheraLink admins can access information only when needed for platform support, billing, security, or account administration.
Other patients, other physiotherapists, and unrelated account holders cannot see your clinical data. TheraLink does not expose one practice’s records to another practice’s users.
Patients and linked guardians see clinical reports through the patient portal only after the patient or guardian approves a report-access request from their therapist. A request that is not answered is automatically declined after 7 days, and the therapist can send a new request later.
How your data is protected
Application data and uploaded files are stored on secure, encrypted cloud infrastructure.
Data is encrypted in transit and at rest as part of TheraLink’s platform controls, including password hashing, role checks, and authorized download links for files.
How long we keep data
TheraLink keeps data only as long as it is needed for care records, account administration, and legal obligations. Every period below is a proposed default and must be confirmed before this policy is final.
- Account records — kept while the account is active. After an account is closed, identity and account records are deleted or anonymized within a limited period, as confirmed in the final policy.
- Clinical records — kept while the treating practice’s subscription is active. Clinical records belong to the practice, and professional recordkeeping rules may require the practice to keep them for longer minimum periods.
- When a practice ends its subscription — the practice can export its records for a limited window after termination. After the export window closes, records are deleted from live systems within a limited period, as confirmed in the final policy.
- Audit logs — records of who accessed or changed data are kept for a limited period to support security and accountability.
- Operational logs — technical logs are kept for a limited period, as confirmed in the final policy.
- Contact form messages — delivered by email and kept in the support mailbox for a limited period, as confirmed in the final policy.
Third parties we use
TheraLink uses a small number of service providers to operate the platform:
- Twilio — WhatsApp messages and one-time codes for account activation and security notices.
- Cloudflare Turnstile — bot protection on the sign-in, account-activation, and password-recovery forms.
- Mailtrap [PROPOSED — confirm email provider] — outbound email for contact enquiries, account messages, and recovery flows where email is used.
These providers process data only to deliver the service. TheraLink does not sell personal information to advertisers and does not use your clinical data for advertising.
Security incidents
If we identify a security incident affecting personal or clinical data, we contain and investigate it, then notify the affected practices and account holders without undue delay — our target is within [PROPOSED — confirm: 72 hours] of confirming the incident — including what happened, what data was involved, and what we are doing about it. Where notification to an authority is legally required, we make it within the required timeframe.
Guardian and minor accounts
Where a patient is a minor, a linked guardian may manage portal access and supported account actions for that child’s relationship with their physiotherapist.
A guardian can only see and act for the child relationships linked to their account. Guardians cannot view other guardians’ children or unrelated patient records.
Access, deletion, and contact
You may request access to personal information we hold about you, ask us to correct inaccurate details, or request deletion where applicable law and your care record allow it. Some clinical records may need to be handled through your physiotherapist or clinic because they manage the care relationship.
- General support
- TheraLink contact form
Terms of Service
Rules for using TheraLink
Accounts and acceptance
TheraLink accounts are created by invitation — there is no public sign-up. Admins create therapist accounts; therapists or admins create patient and guardian accounts linked to a practice. By activating your account, or by signing in and using the platform, you accept these terms — for guardian accounts, on behalf of the patient you are authorized to represent. [PROPOSED — confirm acceptance mechanics]
Clinical record ownership
Clinical records entered in TheraLink belong to the physiotherapist and clinic responsible for the patient’s care. TheraLink provides the software to store and manage those records but does not claim ownership of patient clinical content.
Subscriptions and billing
Therapist access is provided through a subscription plan managed by TheraLink admins, including plan limits, renewal periods, and payment status. If a subscription is unpaid or expires, access may be restricted until billing is resolved. Plan details and pricing are confirmed when your account is set up.
Cancellation and refunds
[PROPOSED — confirm] Subscriptions run for the agreed billing period (for example 1 or 12 months). Cancelling stops the next renewal; access continues until the end of the period already paid. Amounts already paid are not refunded for partial or unused periods, except where a billing error occurred or applicable law requires a refund. Exporting your records after termination is described in How long we keep data.
Protect your account
Do not share your login credentials. Use TheraLink only for authorized care, practice, or administrative purposes. Do not attempt to access another user’s account, patient record, or file without permission, and do not misuse, disrupt, or interfere with the platform.
Suspension
TheraLink may suspend or deactivate accounts for abuse, non-payment, security risk, or violations of these terms. We may also revoke active sessions when needed to protect the service or its users.
Medical decisions
TheraLink is practice-management software, not a healthcare provider. Physiotherapists remain responsible for clinical judgment, treatment decisions, and the accuracy of records they create. TheraLink is not liable for medical decisions made using the platform.
Governing law and courts
These terms are governed by the laws of Lebanon, and the courts of [PLACEHOLDER — city, e.g. Beirut], Lebanon have jurisdiction over any dispute. [PROPOSED — confirm]
Changes to this document
We announce updates to this page by changing the “Last updated” date above. Material changes are announced to account holders in advance through the platform or by message, with at least [PROPOSED — confirm: 30 days] notice before they take effect.
Contact
For support or questions about these terms, contact us at or through the TheraLink contact form.
Contact
Questions about these policies?
Contact the TheraLink team with questions about privacy, platform use, or your account.