Data Processing Agreement
Many therapy centres want a signed DPA on record — for their CA, legal advisor, or simply for their own files. We make this friction-free: send one email and we send back a DPA to review and sign.
Last reviewed 7 June 2026
Request your DPA
Email founders@theraflow.in with your centre name and registered address. We respond within one business day with the current DPA, ready for your review and e-signature.
Email DPA requestWhat's in our DPA — at a glance
The DPA is structured around DPDP Act 2023 requirements. Here is the substance of each section so you know what you are signing.
You (the therapy centre) are the data fiduciary. TheraFlow is the data processor — we process patient data on your instructions.
Patient PII, sensitive health data (diagnosis, session notes), children's data, parent/guardian contact, and billing records.
Only what is required to operate TheraFlow for you: scheduling, attendance, notes, reports, billing, parent communication.
Listed publicly at theraflow.in/sub-processors. 30-day notice before any new sub-processor touches Customer Data.
AES-256 at rest, TLS 1.3 in transit, per-tenant isolation, RBAC with MFA, audit logging, vulnerability scanning.
Within 72 hours of becoming aware, to the affected centre and India's Data Protection Board, per DPDP Act 2023.
We help you respond to access, correction, and deletion requests from patients or their guardians within statutory timelines.
Customer Data is stored in AWS Mumbai (ap-south-1). No replication outside India.
One audit per year, with reasonable notice and scope, plus immediate audit access in the event of a breach.
60-day export window post-termination, then irreversible deletion from primary storage and backups within a further 60 days.
Negotiable for signed agreements; commercial caps apply per the MSA or Terms of Service.
FAQ
The DPDP Act requires data fiduciaries (you) to have processing arrangements with their processors (us). A DPA is the standard way to record that. Whether you sign one is your call — we offer it to every customer.
Yes. Send your redlines along with the request and we will turn them around quickly. For enterprise centres we are happy to use your template DPA instead.
No. The DPA is part of being a TheraFlow customer.
TheraFlow's primary data is stored in India. Some sub-processors (Clerk, Anthropic, Google) are based outside India. We can add an international transfer addendum based on the model SCCs if your legal team requires it.
For all DPA-related questions, write to founders@theraflow.in.