Privacy Policy

TheraFlow is operated by Taksh Innovation Lab ("TheraFlow", "we", "us"), registered in Bangalore, India. We provide practice management software to therapy centres.

For most personal data we handle, the therapy centre that uses TheraFlow is the data fiduciary (DPDP Act 2023) and TheraFlow is the data processor acting on their instructions.

From therapy centre staff (admins, therapists, receptionists)

• Name, work email, phone number
• Role and the centre you belong to
• Authentication identifiers (Clerk-issued session tokens)
• Usage logs, IP address, browser/device information for security and debugging

From patients and their guardians (entered by the centre)

• Names, dates of birth, contact details, addresses
• Diagnosis, therapy goals, session notes, attendance records
• Optional: medical history, Aadhaar / ABHA ID, photos, intake documents — only when the centre chooses to enter them
• Billing and payment records (invoices, package balances)

From website visitors

• Page views, referrer, basic device info via standard analytics
• Anything you submit through contact or sign-up forms

• To operate and provide the TheraFlow service
• To authenticate users and prevent abuse
• To respond to support requests
• To send service-related communications (billing, security, product updates you have opted into)
• To improve TheraFlow (in aggregate, never by inspecting individual patient records)
• To meet legal and regulatory obligations

While your centre is an active TheraFlow customer, we retain your data as long as is needed to provide the service. On cancellation, you have 60 days to export everything you need. After that, your tenant is irreversibly deleted from primary storage and removed from backups within a further 60 days.

Centres can request earlier deletion of any individual patient record from inside the app or by writing to founders@theraflow.in.

We use a small set of sub-processors to operate the service — cloud hosting, authentication, payments, AI features. The full current list is at theraflow.in/sub-processors. We notify customers before adding any new sub-processor that touches patient data.

We never sell personal data. We never share it for advertising. AI providers we use (Anthropic, Google) do not train on our API calls.

Encryption at rest (AES-256) and in transit (TLS 1.3); per-tenant data isolation; role-based access control with MFA available on every account; audit log of every data access; rate limiting and account lockout on the login flow. Full detail at theraflow.in/security.

If we ever discover a security incident affecting your data, we notify the affected centre and India's Data Protection Board within 72 hours, with the facts as we know them.

Where TheraFlow is the data fiduciary for your data (for example, data you provide directly to us — not through your therapy centre), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of data we no longer need
• Withdraw consent for processing where we relied on it
• Nominate another individual to exercise these rights if you cannot
• Raise a grievance with our Grievance Officer (see contact below)

Where the data was entered into TheraFlow by a therapy centre, please contact the centre first — they are the data fiduciary. We will assist them with any request.

Most patients in TheraFlow are children. Centres collect this data with the consent of a parent or guardian. We do not process children's data for advertising, profiling, or any purpose other than running the centre's clinical operations, as the law requires.

The TheraFlow website uses minimal first-party cookies for authentication and basic analytics. We do not use third-party advertising cookies.

We will update this page if our practices change. Material changes will be notified by email to centre admins at least 30 days before they take effect.

Data Protection contact / Grievance Officer: founders@theraflow.in

Mailing address: Taksh Innovation Lab, Bangalore, Karnataka, India.