Privacy Policy

1. Who we are and what this Policy covers

Therapatic is provided by EDURA COMPUTER SYSTEM TRADING L.L.C (in Arabic: ايدورا لتجارة نظم الحاسب ش.ذ.م.م), a limited liability company established in Dubai, United Arab Emirates, and licensed by the Department of Economy and Tourism in Dubai. Commercial Licence No. 1468109 Commercial Register No. 2524669 Dubai Chamber membership No. 592998 Registered address: Office No. 195, owned by Mohammed Hashim Alawi Al Safi, Al Murar, Dubai, United Arab Emirates.

In this Policy, "Edura", "we", "us" and "our" mean that company. Edura is the data controller responsible for the personal data described in this Policy, except the clinical records that Organisations keep in the Service, which Edura processes on their behalf. Section 4 explains who is responsible for what.

This Policy explains how we handle personal data when people use Therapatic: the therapatic.com website, the Therapatic web application, the Therapatic Parent, Therapist and Organisation mobile apps, the Therapatic sign-in and account service, and the related services we provide (together, the "Service"). It covers: - account holders: parents and guardians, therapists and other professionals, and the owners, administrators and staff of organisations; - children whose information is recorded in the Service (children never have accounts); - people who appear in session recordings; - people who pay for subscriptions; and - people who contact us or send us a report, for example through the contact form on our website.

This is one Policy for every country where we offer the Service. Section 33 adds what applies in particular countries and regions.

Our Privacy Lead oversees this Policy and handles requests about personal data. You can reach the Privacy Lead, Edura, at privacy@therapatic.com.

2. The short version

- Therapatic is a clinical documentation and care-coordination tool for professionals and families. It is not medical advice and it does not diagnose. - We store data with Amazon Web Services in the United States, for every country where we offer the Service. - We do not sell personal data, we do not show advertising, and we do not use analytics, advertising or tracking tools. Our mobile apps send crash reports that have names, email addresses, health information and IP addresses removed (see section 21). - Children do not have accounts. Their information is managed by their parents or guardians and by the organisations that care for them. - Organisations keep the clinical records they make, under their own legal record-keeping duties, even after a family leaves or deletes an account. - A parent or guardian can share a child's records from one organisation, including a former one, with another organisation that cares for the child: read-only, for the dates they choose, and they can stop sharing at any time. - Organisations can record sessions only with a parent's or guardian's consent for that child, and no recording reaches a family before the organisation has reviewed it. A recording is part of the organisation's clinical record. We never use AI on recordings. - We use the records of requests made to Hieka, our AI assistant, and of its responses, after names and identifiers have been filtered out, to improve Hieka, including to train AI models, only where a workspace's owner or an administrator has switched this use on. It is off by default for every workspace, in every country, and it can be switched off again at any time (see section 19). We do not use children's records to train AI models. Our mobile apps send nothing to an AI service without your permission in the app. - You can download a copy of your data from your account settings, and you can ask us to correct or erase it by emailing privacy@therapatic.com. When you delete your account, we erase your own personal data automatically after 30 days (see section 24). - Some of the protections described in this Policy are not in place yet. Where that is so, we say what happens today.

3. Key terms

"Personal data" means information about an identified or identifiable person. "Health information" is used here for information that the law protects more strictly, such as information about a person's health, disability, development, behaviour, therapy or education. "Organisation" means a clinic, centre, practice, school or other organisation that has a workspace in the Service. "Workspace" means the area of the Service that an Organisation uses to keep its records and manage its team. Each account holder also has a personal space, which holds their own information, such as a parent's family details or a therapist's professional passport, and My Cloud, their own file storage. "Parent or Guardian" means a person who has confirmed to us that they are a child's parent or legal guardian and is linked to that child in the Service. "Child" means a child, or another person receiving services, whose information is recorded in the Service. "Child Record" means the Child's shared profile together with the records each Organisation makes about the Child. "Session Recording" means a video clip, with or without sound, that an Organisation's staff record during a session with a Child through our mobile apps.

4. Who is responsible for what

Edura is the data controller responsible for the personal data described in this Policy, with one exception: the clinical records that an Organisation keeps in the Service, including Session Recordings. The Organisation is responsible for those records, and Edura stores and processes them on the Organisation's behalf, as its data processor.

Edura provides software. It is not a health service provider: it does not provide care and it holds no health-care licence. Each Organisation provides its own care and holds the licences that care requires.

Organisations that use Therapatic to keep records about the children and families they serve also have their own responsibilities for those records. Each Organisation decides what to record, who in its team may see it, and how long it must keep it under its professional and legal duties, and it is responsible for having the authority and consents it needs to record that information.

A Parent or Guardian who adds information about their own Child, for example in the Child's shared profile, is responsible for having the authority to do so.

Where an Organisation signs a data processing agreement with us, that agreement sets out our respective responsibilities for the Organisation's records in more detail.

5. What we collect

The data we hold depends on how you use the Service and on what you and others put into it.

Everyone with an account: - name, in Latin letters and, if you add it, in Arabic letters; email address, preferred language, and account settings; - your password, which we store only as a salted one-way hash, and your two-factor sign-in and passkey settings; - the Workspaces you belong to, your roles, the invitations you send and receive, and changes to your access; - sign-in and security events: sign-ins, failed attempts, the IP address and browser or device used, and your active sessions; - if you connect an external calendar: its address and the user name and password you give us for it, which we store encrypted (see section 17); - your permission settings in our mobile apps, such as whether you allow notifications or AI features.

Parents and guardians: - your relationship to the Child (for example mother, father or guardian) and whether you are the Child's primary guardian; - the information you add about your Child, the requests and messages you send, and the consents you give or withdraw; - files you keep in My Cloud, and the Organisations you choose to share each file with.

Therapists and other professionals: - your professional profile: legal and preferred names, date of birth, nationality, sex, city and country, disciplines, professional title, years of experience, languages, licence number, a biography, a contact phone number and email address if you add them, credentials, education and experience, and a profile photo if you add one; - compliance information you add: the status, provider and date of a background check and its report; your malpractice-insurance provider, policy number, expiry date and policy document; and your trainings. Background-check information can reveal criminal-record information, which the law treats as sensitive. You can set who can see each of these items, and we will make background checks private until you choose to share them; - the professional passport number and public passport page we issue to you (see section 18); - files you keep in My Cloud, and the Organisations you choose to share each file with; - where an Organisation uses the Service to manage its team, the staff information it records about you, such as your role and employment details; - if you record sessions or appear in a Session Recording: the recording itself and your agreement to being recorded.

Children (always provided by Parents or Guardians and by Organisations, never by the Child): - identity details: legal names and preferred name, in Latin letters and, if a Parent or Guardian adds them, in Arabic letters; date of birth, gender and a reference code; - the care-profile sections of the Child's shared profile, which can include medical information, medication, allergies, family and household details, family health history (health conditions of the Child's relatives), answers to a developmental questionnaire, contacts, communication, sensory and social needs, routines, education, assistive technology, therapy and other support services, insurance or funding, and behaviour-safety information; - the records each Organisation makes: goals and targets, assessments and results, session and attendance records, data collected during sessions, behaviour plans and behaviour-incident records, clinical notes and reports; - files, photos and videos uploaded to the Child's folder; - Session Recordings: the video and, unless sound is switched off, the sound of a session, with the session, the therapist, the Child, and the goal or assessment it relates to.

Organisations: - the Organisation's name and type, its branches or teams, its settings and its list of members.

Payers: - the payer's name or the Organisation's legal name, email address and country, the billing address and any tax registration number given on the secure payment page, the plan bought, and records of payments, invoices and refunds. Our payment provider collects card details directly. We do not receive or store full card numbers. We do store the messages our payment provider sends us about payments. Today these can include the cardholder's name, billing address and email address, and card details such as the card brand and last four digits (see section 23). - for a purchase in the Apple App Store or Google Play: the store's record of the purchase, its status and its renewals. The store does not give us your card details. - if a refund cannot be returned to the original payment method, the bank account it is paid back to, given through a secure form in the Service: the account holder's name, the account's IBAN, the bank's country (taken from the IBAN if it is not given) and, if given, the bank's name and its BIC (SWIFT) code. The form accepts only accounts that have an IBAN. We use these details only to pay that refund. They are stored encrypted, only our finance staff and Edura's administrator accounts can read them, each time with a second person's approval, and we delete them once the transfer is recorded. Each time an account is given or changed, the paying workspace's owner and administrators are sent a notice that shows only the account's last four characters; that notice is kept after the details are deleted.

Communications: - requests and messages sent through the Service's Requests inbox, in-app notifications, push notifications, and the emails we send you.

Reports: - the reports you send through the Service: what you report, what you write, and what happens to the report.

Hieka, our AI assistant: - the requests you make and the responses Hieka gives (see section 13).

Website contact form: - your name, email address, organisation, message, language and the page you sent it from.

Technical information: - IP address, browser and device type, the time of each request, and error and performance records in our server logs; - cookies and data stored in your browser or phone (see section 31); - device identifier: a random identifier for each installation of our mobile apps, which we use to manage your sign-ins, notifications and uploads, and never to track you; - a push-notification token from our mobile apps, if you allow notifications; - crash reports from our mobile apps: the device model, operating system and app version, and what went wrong (see section 21).

6. Health, disability and children's information

Therapatic is designed for services to children and others with developmental, behavioural, communication, educational or health needs. Much of the information in a Child Record is therefore sensitive health information about a child. Session Recordings show a Child's face, body and voice, and we treat them as health information. They are not biometric data: we never use them to identify or recognise anyone, by face, voice or any other means, and we never use AI on them.

We protect it with access controls based on each person's role and relationship to the Child, extra encryption of the most sensitive fields, and audit records (see section 25). We do not use it for marketing, profiling or advertising. The Service does not diagnose, and it does not infer a diagnosis from behaviour records, from Session Recordings or from AI output. We never use Session Recordings for face recognition, emotion recognition or behaviour detection.

7. Where the data comes from

- From you: when you register, set up your profile, add information, use Hieka, send a report or contact us. - From Organisations and their staff: when they record their work with a Child, including Session Recordings. - From Parents and Guardians: when they add information about their Child or give or withdraw consent. - From the person who invites you: your name and email address, so that the invitation reaches you. - From other users: when they send a report that concerns you. - From your use of the Service: logs, security events, crash reports and records of actions taken. - From Stripe: the status of payments and subscriptions, and the billing address and any tax registration number given on its secure payment page. - From Apple and Google: the status of subscriptions bought in their stores.

We do not obtain personal data from data brokers or public sources, and we do not use analytics services to collect information about you.

8. How we use personal data

We use personal data to: - create and run accounts and Workspaces, and check who can see and do what; - provide the Service's features: records, goals, assessments, behaviour plans, sessions, Session Recordings, scheduling, reports, requests and messages, consents and sharing; - send the emails the Service needs: email-address verification, invitations, password resets, sign-in alerts and account-deletion messages; - tell you about activity that concerns you, by in-app notification, email and push notification (see section 14); - provide support, answer requests and deal with reports; - keep the Service secure: detect and prevent misuse, investigate faults, crashes and incidents, and keep audit records; - manage subscriptions, payments, invoices and refunds; - meet our legal obligations, and establish or defend legal claims; - provide Hieka when you choose to use it; and - improve Hieka, including by training and evaluating AI models with the records of Hieka requests and responses (see section 19).

We do not use personal data for unrelated purposes such as advertising.

9. Our legal bases

For a Child's information, we rely on the consent that a Parent or Guardian gives for an Organisation to care for the Child and record that care in the Service (the "Clinical data sharing" consent). Each of the other purposes listed in section 28, including Session Recordings, needs its own separate opt-in. Section 28 also explains how these consents work today.

For other personal data, the legal basis that applies depends on the purpose and on the law of your country. We provide accounts, the Service and subscriptions under our Terms of Use, and we keep some records, such as invoices, because the law requires it. Section 33 adds what the law of particular countries requires.

Organisations may also rely on their own legal bases, such as their duties as healthcare or education providers, for the records they keep.

10. Accounts, sign-in and access records

Sign-in is handled by our own sign-in service. There is no sign-in through social networks. - You must verify your email address before you can sign in. - Passwords must be at least 8 characters long and are checked against common and easily guessed passwords. - You can add two-factor sign-in with an authenticator app (with backup codes) and passkeys. - Sign-in sessions end after at most 30 days, and the web app signs you out after one hour without activity, after a 2-minute warning. It does not sign you out while you are working on a live session screen; the hour starts again when you leave that screen. - After 10 failed sign-in attempts, the account is locked for 15 minutes. After repeated failed attempts, we email the account holder an alert that includes the IP address used. - If an account is suspended, locked or disabled, all its sign-ins end at once, on the web and in our mobile apps, and its phones stop receiving push notifications. - You can see and end your sessions, and review your recent security activity, in your account settings.

We keep records of invitations, role changes, consents, sharing and other important actions, so that access can be checked and explained. Organisations are responsible for giving access only to the right people and for removing it promptly when someone's role changes or they leave.

11. Children, parents and guardians

- Therapatic is for adults. Account holders must be 18 or older, or the age of majority in their country if that is higher. Children do not have accounts and cannot sign in. - We do not check guardianship documents. A person who adds a Child, or links to a Child, confirms that they are the Child's parent or legal guardian. Organisations check guardianship where their own procedures or the law require it. - A Child's primary Parent or Guardian can invite another parent or guardian by email. - A Parent or Guardian can see, read-only, what each Organisation that enrols the Child records about the Child in the Service, except drafts and notes the Organisation keeps for its staff. Records from an Organisation whose work with the Child has ended or is paused stay visible as history. - We will allow a licensed clinician to withhold a specific record from a Parent or Guardian only where showing it is likely to cause serious harm, with the reason recorded and the decision reviewed by a second clinician. - When a Child reaches adulthood, the Child's Parents and Guardians currently keep their access. We will introduce a process that lets the young adult take control of their own record, and we will tell Parents and Guardians 90 days before it applies to them. - When the last Parent or Guardian linked to a Child deletes their account, section 24 explains what happens to the Child's shared profile.

12. Clinical and professional records

Organisations and their professionals are responsible for the accuracy, relevance and lawful retention of the records they create. The Service keeps drafts separate from finalised records, and does not show drafts to Parents or Guardians.

When a record is signed or finalised, the signer's name is kept as it was at the time of signing, so it does not change later. If the signer later leaves or deletes their account, the record keeps their name.

SOAP notes are an optional setting that each Organisation's owner or administrators switch on or off. While they are off, SOAP notes are hidden everywhere in that Workspace, including from Parents and Guardians; they are kept, not deleted, and they reappear if the setting is switched on again.

Records an Organisation creates stay with that Organisation, under its record-keeping duties, after a subscription ends or an account is deleted (see section 24).

13. Hieka and AI-assisted features

Hieka is the AI assistant in the Service. It is switched on for every Workspace unless we switch it off for that Workspace, and each of its features works only once we have put it live. In an Organisation's Workspace, every member can use the help chat. Goal review, coaching drafts and the summaries for professionals need permission to use Hieka: by default the Organisation's owner, administrators, managers, supervisors and therapists have that permission, and the owner or an administrator can give that permission to, or take it away from, any other member. Hieka can: - review a goal, on a goal library's goal form or on a Child's goal form: it receives what the goal is and how it is taught and measured (its name and description, its teaching and measurement methods, its phases and criteria, and which parts of its plan are set, such as its error correction and reinforcement schedule), the problems the form has found in it, each message you type in the conversation (up to 1,200 characters) and the earlier messages of that conversation; - draft the steps of a family coaching clip, only where we have switched on video in the Service and the Organisation has switched these drafts on: it receives the teaching text of the Child's goal that the clip is about, the steps and the home task you have written, how many days a week the family will practise, the language and, where it is given, the Child's age range (for example, 6 to 8 years), and you confirm before each request that this may be sent; - answer questions about using the Service: it receives your question, a general label for where you are in the Service and the list of guided tours it can suggest; - summarise a Child's progress on their goals over a period, for a report, for a professional who can read that Child's goals; - draft a summary of an ended session from the data collected in it, for the session's therapist to check before using it in the session note; - tell a Parent or Guardian, in simple words, how their Child is doing on the goals they can see at an Organisation; - explain an Organisation's dashboard in words, for its owner or administrators; and - write a report's results in words, for the person who ran the report.

Each summary is written from a fact sheet that the Service builds from what the person asking can read, never from anything typed into the request. A fact sheet holds only numbers, yes or no answers and fixed codes, such as how many sessions a goal was worked on in the period, the share of correct responses, whether a goal was mastered and how many behaviour incidents were recorded; a dashboard's fact sheet holds the dashboard's own totals, rates and trends. The Child, each goal and each behaviour appear in it as placeholders, never by name, and dates appear as a number of days. A report's fact sheet holds the numbers in the report's headline tiles and in its first table, the rows of the table appearing as placeholders, never by name, and the report's period as a number of days; a value the report hides or shows only as a range is left out. It is built for each request from the finished report, and only while the person who ran the report can still open it and the consent it relied on still holds. A fact sheet holds no notes and no other free text, and nothing that a Parent or Guardian's consent does not let the Organisation see. You confirm before each request that it may be sent, and the names are put back only in the answer shown to you.

Goal review on a Child's goal form and coaching drafts read a Child's goal, and the summaries of a Child and a report's narrative read numbers from Children's records. Before the request leaves the Service, the filter described below removes the names and other identifying details it recognises, and nothing else from the Child's record is sent: no notes or other free text, no recordings and no names of the people who work with the Child. Hieka is not used to diagnose. Nothing Hieka writes is saved, shared or sent by itself: a professional reviews every suggestion and every draft, and nothing is saved until that person saves it; a summary written for a Parent or Guardian is shown only to the person who asked for it. We never use requests about a Child to train AI models. A report's narrative is never used to train any AI model, and Hieka never remembers it; it is kept on the report only once the person who ran the report accepts it as written or edits it, and from then on it is shown as part of the report. What you type is sent too, so do not type a Child's name or other identifying details into Hieka.

A report has a narrative only where its layout has a narrative section, as the built-in reports do, and Hieka drafts it only when the person who ran the report asks for it. An Organisation can stop report narratives: its owner or an administrator can take the permission to use Hieka away from any other member, and we switch Hieka, or any one of its features, off for a Workspace when the Organisation asks us to.

Each request can also carry, after the same filter, what Hieka remembers for you and for your Workspace, and the earlier messages of the same conversation. Hieka can remember a short summary of an answer you accept or change, unless the answer is about a Child.

Our mobile apps send nothing to Hieka or to any other AI service until you have given your explicit permission in the app. The app tells you what would be sent and to whom before it asks, and you can withdraw the permission in the app's settings at any time.

For every feature, before a request leaves the Service we keep only the fields that feature needs and run an automatic filter. It removes the names of the Children, Parents or Guardians and staff recorded in your Workspace, written in English or Arabic; names written in English as two or more capitalised words; and dates (including dates of birth), phone numbers, email addresses, Emirates ID numbers, US Social Security numbers and the Service's reference codes. If something that looks like one of these remains, the request is stopped. The filter has limits: it recognises a recorded name only in the alphabet it is recorded in, so a name recorded in Arabic and typed in English letters, or the other way round, is not removed; it cannot recognise a name that is not recorded in your Workspace, such as a relative's name or a nickname, unless it is written in English as two or more capitalised words; it does not recognise every way of writing a date or a phone number; and it recognises Emirates ID and US Social Security numbers but no other identity numbers.

Hieka uses Claude models provided by Anthropic, and sends requests to no other AI provider: when Anthropic is unavailable, Hieka is unavailable too. We run Hieka only under a data processing agreement with Anthropic that provides zero data retention, which means that Anthropic does not keep the requests we send or use them to train its models, and that it processes them in the United States.

We keep a record of each Hieka request in our systems: the filtered request, the response and any review of it. We delete each record automatically 30 days after the request was made, unless it has been chosen for a set used to train or evaluate Hieka (see section 19) or a legal hold applies (see section 23). Before then, you can ask us to delete it (see section 29). Your conversations with Hieka are deleted the same way, 30 days after each message. What Hieka remembers for you is kept until you delete it.

Hieka's output is a suggestion or a draft for a qualified person to review; a summary for a Parent or Guardian puts what the Organisation has recorded into simple words, and the Child's professionals can answer questions about it. It is never a diagnosis or a decision. We will label AI output as AI-assisted. Section 19 explains when data may be used for AI training.

We never use AI on Session Recordings: they are never transcribed, summarised, analysed or used for training, by us or by any provider.

14. Requests, messages and notifications

The Service has no chat feature. Its Requests inbox lets members of a Workspace, including parents and therapists, send each other requests and messages. Members with view-only access cannot send them. The text of a message is removed one year after its request is closed. The Requests inbox is not an emergency service.

In-app notifications expire after a set time. The records showing which notifications were delivered are deleted after a set period, which is 6 years unless a shorter period applies to that type of notification.

We send emails through Amazon Simple Email Service. Account emails, such as email-address verification, invitations, password resets, sign-in alerts and account-deletion messages, are always sent. We also send activity emails about things in your Workspaces that concern you, such as a request waiting for your answer. Activity emails tell you what is waiting and link to the Service, where you see the details after signing in; they do not contain clinical details, such as notes, scores or diagnoses. You can choose which activity emails you receive in your notification settings.

Our mobile apps can send push notifications. We send them through Apple Push Notification service to iPhones and iPads and through Firebase Cloud Messaging, a Google service, to Android phones. A push notification only says that something is waiting for you and opens the right place in the app. It never includes a Child's name or any clinical detail, and we never use push notifications for marketing. We store your device's push-notification token, encrypted. The apps work without notifications, and you can switch them off at any time in your phone's settings.

15. Sharing inside an Organisation

Inside an Organisation, what each person can see depends on their role and on their relationship to each Child. Staff generally see the Children they work with. Owners and administrators can see all Children in the Organisation, and in some parts of the Service supervisors and managers can too. We will limit supervisors and managers to the Children they supervise or work with, and will allow organisation-wide clinical access only for people whom the owner specifically names.

Files that a Parent or Guardian shares with an Organisation from My Cloud can be listed and opened only by that Organisation's owner and administrators.

The Organisation is responsible for giving each person the right role, reviewing access, limiting downloads, and removing access promptly.

16. Sharing between Organisations

Each Child has one shared profile in the Service (the identity details and care-profile sections listed in section 5). Every Organisation where the Child is enrolled can see the identity details and the safety sections: allergies, medications, emergency contacts, the behaviour and safety plan, and guardian roles. It can see the other care-profile sections only while the Parent or Guardian's consent lets it view the clinical file (see section 28). The family's own account in the behaviour and safety section (the Child's behaviours, what may lie behind them, triggers, safety risks and the family's safety measures) is the exception: an Organisation sees it only while a Parent or Guardian has agreed to share it with that Organisation. A Parent or Guardian always sees it. The Child's Parents or Guardians and authorised staff of those Organisations can update the shared profile.

The records each Organisation makes about the Child stay with that Organisation, and another Organisation cannot open them unless a Parent or Guardian shares them, as described below.

A Parent or Guardian can share the records that one Organisation keeps about the Child, including an Organisation the Child no longer attends, with another Organisation where the Child is enrolled, so that the Child's history is not lost and can be followed up by other Organisations. They choose which of these kinds of record to share: assessments; goals and targets; data collected in sessions; behaviour plans; behaviour tracking, such as ABC and incident records; signed session notes; progress reports; and documents in the clinical file. They also choose the first and last day of the share, and they can change what is shared or the dates, pause the share or stop it at any time. Session Recordings cannot be shared between Organisations.

A share is read-only. The receiving Organisation can read the shared records in the Service but cannot change them, and the Service does not copy them into its Workspace: documents are opened from where the other Organisation keeps them. While the Child's enrolment with the receiving Organisation is paused, the share gives it no access. A share ends when its last day has passed, when the Parent or Guardian stops it, or when the Child's enrolment with the receiving Organisation ends. The Organisation whose records are shared is not told about the share. We log each time the receiving Organisation opens the shared records, and the Parent or Guardian can see that log in the Service; it names the Organisation, not the staff member who opened them.

To help avoid booking a Child into two places at once, the Service may show the times of the Child's sessions at other Organisations, as busy blocks, to people at an Organisation where the Child also has, or has had, sessions, and may count those times as busy when they look for a free time for the Child. A busy block shows only when the session starts and when it ends. It shows nothing else about the session: not the other Organisation's name, the session's title, service, kind (for example an assessment or an intake) or status, whether it is one-to-one or in a group, where it takes place or its video-call link, who takes part or how many, or any notes. Sessions that do not take up the Child's time, such as cancelled sessions, are not shown.

The Service does not transfer a Child's records from one Organisation to another. An Organisation that gives a copy of its records to a family or to another provider outside the Service does so under its own responsibility.

When an Organisation's work with a Child ends, it loses access to the live shared profile, and keeps only its own records and a read-only view of the shared profile as it stood on the date its work ended, with these exceptions, which are shown as they are now: the Child's identity details, such as names and date of birth; and, for each Parent or Guardian who was linked to the Child when that work ended, their name (or, if they have not recorded a name, their parent code), their relationship to the Child and whether they are the Child's primary guardian. A Parent or Guardian whose link to the Child has been removed since then is no longer shown. The view shows no photo of the Child or of any Parent or Guardian.

We will also make a further change: a Parent or Guardian will be able to choose, for each Organisation, which of the other care-profile sections it can see, one section at a time. The safety sections (allergies, medications, emergency contacts, the behaviour and safety plan, and guardian roles) will always be visible to every Organisation caring for the Child.

17. Downloads, files, calendars, dictation and session recordings

Downloads. Some parts of the Service let authorised users download data, such as reports, data tables and calendar files. Once data is downloaded, it is outside our control. Whoever downloads it is responsible for protecting it.

Files. Files, photos and videos uploaded about a Child are kept in that Child's folder in private, encrypted storage. Every uploaded file is checked for malware before it can be opened. Opening or downloading a file is recorded in an append-only audit log that is protected against editing.

Calendar feeds. You can subscribe to your Therapatic calendar from another calendar app using a private feed link. The feed contains the events you can see in Therapatic, and each event carries only its time, its room and a neutral title such as "Session". It never includes names, birthdays, notes or links. Your calendar provider then holds a copy under its own terms. Anyone who has the link can see the feed, so keep it private; you can revoke a link in your calendar settings.

Calendar connections. You can connect an external calendar that uses the CalDAV standard, such as iCloud or Fastmail, by giving us its address and your user name and password for it, which we store encrypted. Each time you choose to sync, we copy the sessions and events in your Therapatic calendar to that calendar, with each event's title and room, its time, its notes or subtitle, and its location or video-call link. Titles and notes can include names and clinical details. Your calendar provider then holds a copy under its own terms. You can remove a connection at any time; this stops future copies but does not delete the events already copied.

Dictation. Dictation is switched on by default. Each Organisation's owner or administrators can switch it off for its Workspace in Settings. The Service shows a notice whenever it is listening, and nobody is heard until they press the microphone. In the web app, dictation uses the speech recognition built into your web browser. Some browsers transcribe speech on your device. Others, such as Google Chrome, send the audio to the browser maker's speech service, which processes it under that company's own terms. In our mobile apps, dictation uses your phone's own speech recognition on the device. We do not receive the audio, only the text that appears in your note. If you do not want this, do not use dictation and type instead. We will change the web app so that dictation is offered only where your browser transcribes on your device.

Session recordings. Where an Organisation has switched session recording on, its staff can record clips during one-to-one and assessment sessions with our mobile apps. Before a Child is recorded, a Parent or Guardian who has the authority to decide must consent to recording for that Child at that Organisation (see section 28). Every member of staff who records or appears in a clip must have agreed to it. The app shows clearly while it is recording. A clip is part of the clinical record that the Organisation keeps about the Child. - On the phone: a clip is kept only inside the app's own storage, never in the phone's photo library or in iCloud, and is deleted from the phone once our servers have confirmed that it arrived intact. - Storage: clips are stored in the United States, whatever country the Organisation or the family is in, encrypted with keys held for their owners: a clip that only the Organisation owns is encrypted with that Organisation's own key, and a clip that a Parent or Guardian also owns is encrypted with a key that is not the Organisation's alone, so that it stays readable for them after the Organisation leaves. We keep a second copy in a second US region, encrypted in the same way, to protect against loss. Each clip is converted by our own systems before anyone can play it. The converted clip is the record; we keep the original upload as a safeguard, and never for longer than the clip itself. - Who can watch: the Child's care team at that Organisation, the supervisors of those staff, and staff to whom the Organisation has given organisation-wide oversight. Administrator rights alone do not let someone watch, and staff with view-only access cannot watch. Staff cannot download clips, and the player shows the viewer's name on the picture. - Reaching the family: no clip reaches a Parent or Guardian until a person at the Organisation other than the one who recorded it has reviewed it, and the owner or another person the Organisation has authorised has released it. A released clip can be recalled for 7 days. - Another child in the clip: a clip in which another child can be identified is not released; the family sees only how many such clips were withheld. If a Parent or Guardian asks for such a clip, the Organisation gives them, within 30 days, a copy in which the other child is blurred or cropped out. - Downloads: once the 7 days in which a released clip can be recalled have passed, a Parent or Guardian can download it to their own device or storage. Before each download we warn them that the copy leaves the Service and that they become responsible for protecting it, and every download is recorded. - One copy, two owners: a clip released to a Parent or Guardian who keeps it in their own storage, under a plan of theirs that includes storage, is kept once and belongs both to the Organisation's storage and to the Parent's or Guardian's own storage. It counts toward each one's storage plan. If one of them deletes it or stops keeping it, it still belongs to the other, and it is erased only when neither keeps it. A Parent or Guardian without such a plan can watch a released clip for as long as the Organisation keeps it. - Every time a clip is played, released, recalled, downloaded or deleted is recorded in an append-only log. - Session Recordings are never shared with another Organisation, and we never use AI on them.

18. Public professional passport (therapists)

Each therapist has a Therapatic professional passport, with a passport number that we issue, and a public passport page.

Public lookup is off until you switch it on in your passport settings. While it is off, the public page says only that the passport exists. When you switch it on, the public page shows your name, your photo, your disciplines, your sex and your nationality, and that the details are self-declared. It never shows your date of birth or the passport's machine-readable code line.

Whether or not public lookup is on, an Organisation that you give your passport number to can find your active passport, in order to invite you or hire you. Parents and Guardians see the members of their Child's care team by name, photo and discipline. Your profile photo is always shown in these places; you can change it, but not hide it.

19. Research, AI training and product improvement

We do not sell personal data.

AI training. We use the records of requests made to Hieka and of its responses (see section 13), including whether and how a suggestion was used or changed, to improve Hieka, including to train and evaluate the AI models behind it. This use is off by default for every Workspace, in every country: we use a Workspace's records in this way only after its owner or an administrator has switched it on, and we keep a record of who switched it on and when. Before a record is used, it is checked and filtered again. Each use needs the approval of two people at Edura, one of whom is always our Privacy Lead, and is logged (see section 26). To switch this use off for a Workspace, its owner or an administrator can email privacy@therapatic.com at any time; our Privacy Lead then switches it off. From then on we do not use any of that Workspace's records, including the records we already hold, to train or evaluate the AI models behind Hieka, although this cannot undo training already done. If the Workspace later switches the use on again, only records made after that are used. We do not use Child Records, Session Recordings or any other data from the Service to train AI models. Our contract with our AI provider does not allow it to train its models on our data.

Research. We will not use personal data, or data about a Child, for research, unless: - it has been anonymised under our written anonymisation standard, which removes names, dates, places and identifiers, including from free text, and the result has been independently checked; and - both the Organisation and the Child's Parent or Guardian have opted in.

Neither opt-in exists yet, so today we do not use any data from the Service for research, and we do not give it to anyone else for research. When the opt-ins exist, both will be off unless they are given, and each can be withdrawn at any time. Session Recordings are never used for research.

We use technical logs and crash reports to find and fix faults and to keep the Service reliable and secure.

20. Marketing

We do not send marketing unless you opt in to receive it, and you can opt out at any time. Opting out does not stop the service, security, billing or legal messages we need to send. We never send marketing by push notification. We never use Children's information or health information for marketing, profiling or advertising.

21. Service providers and other recipients

We use these service providers to run the Service: - Amazon Web Services (AWS): hosting, databases, file and video storage, video delivery, encryption keys, logs, security monitoring, malware scanning of uploaded files, and sending email (Amazon Simple Email Service). Location: United States. - Vercel: hosting and delivery of our web application. Vercel handles the requests your browser makes, including your IP address. Our web application's server functions run in the United States. - Stripe: payment processing for purchases on the web, and calculating the VAT on them. Stripe collects your card details directly, and the billing address and any tax registration number you give on its secure payment page. We share with Stripe only a billing account reference, the payer's email address, the paying Organisation's legal name and the country, and, to calculate the VAT on an invoice, the billing address and tax registration numbers we hold. We never share a Child's information, a professional's clinical information, or any diagnosis with Stripe. - Anthropic: the AI models behind Hieka, where Hieka is switched on (see section 13). Location: United States. - Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): delivering push notifications to our mobile apps. They receive your device's push token and a notification that contains no names and no clinical details (see section 14). - Sentry: crash reports from our mobile apps. Before a report leaves your phone, the app removes on-screen text, the content of what you searched for or typed, names, email addresses and health information, and Sentry does not store IP addresses. Location: United States.

Other recipients: - other users of the Service, according to their role and the permissions described in this Policy; - Apple and Google, if you buy a subscription through the App Store or Google Play. They process that payment under their own terms; - your browser's maker, if you use dictation in a browser that sends audio to its speech service (see section 17); - your calendar provider, if you subscribe to a calendar feed or connect an external calendar (see section 17); - the Organisation concerned, when you send a report about something in its Workspace and the kind of report calls for it; we do not give it your name unless you choose to share it; - our professional advisers and auditors, under confidentiality duties; - courts, regulators, law enforcement or other authorities, where the law requires it; - the US National Center for Missing & Exploited Children (NCMEC) and the competent authorities of the United Arab Emirates: when a report shows material that depicts the sexual abuse or exploitation of a child, we report it to both and keep the evidence under a legal hold (see section 23); and - a company that takes over the Therapatic business, which would have to protect personal data as this Policy describes.

Each service provider that holds customer data does so under a contract with Edura that includes data processing terms and requires it to protect the data at least as this Policy does. We publish a list of our service providers at therapatic.com/processors, and we will give Organisations 30 days' notice before a new provider starts to handle their data. We do not give personal data to advertisers or data brokers.

22. Where data is stored and international transfers

Our servers are in the United States: our main systems run in the AWS US East (Northern Virginia) region. Our web application's server functions run in the United States, and Hieka requests are processed in the United States. Session Recordings are stored in the United States, for every country where we offer the Service, with a second copy in a second US region (see section 17). We will also keep backup copies of our databases in a second AWS region once our legal advisers have approved it, and we will name that region in this Policy.

This means your data is transferred from the country where you live to the United States. We do not currently offer the Service in the European Union, the European Economic Area or the United Kingdom. Section 33 describes the safeguards for transfers from particular countries.

When you or your Organisation download data or send it outside the Service, you are responsible for that transfer.

23. How long we keep data

We keep personal data only as long as we need it for the purposes in this Policy, or as long as the law or an Organisation's record-keeping duties require. Where a period depends on the law of a particular country, that law applies.

These periods are applied automatically today: - message text in the Requests inbox: removed one year after the request is closed; - in-app notifications: expire after a set time; delivery records are deleted after 6 years unless a shorter period applies; - deleted files: kept in a recoverable trash for 90 days, then removed; a removed or replaced file is purged from storage 90 days after that. This applies to an Organisation's files, a Child's files and department documents alike. When a file is removed because an account is erased, or when the trash is emptied, every stored version of it is removed at once; - documents an Organisation has withdrawn or filed against the wrong Child: kept for the Organisation's clinical retention period, then deleted; - bank account details given for a refund: deleted once the refund's transfer is recorded; the notices sent when they were given, which show only the account's last four characters, are kept like other notifications; - records of ended sign-in sessions: deleted after 90 days; one-time sign-in codes after 7 days; email-verification and password-reset links after 30 days; - Hieka requests and responses, and your conversations with Hieka: deleted 30 days after they were made, unless chosen for a set used to train or evaluate Hieka (see section 19) or under a legal hold; - the personal data of a deleted account: erased 30 days after the deletion request (see section 24); backups that still hold it are overwritten within a further 35 days.

We will apply this schedule to the other data we hold: - clinical records, including the Session Recordings that are part of them: kept for the period the law of the Organisation's country requires the Organisation to keep them, counted from the Child's last treatment (at least 25 years in the United Arab Emirates), then deleted. Keeping them for that period is the Organisation's duty. We keep them, Session Recordings included, for as long as the Organisation keeps its records in the Service, and hand them back when it leaves; - original uploads of Session Recordings: kept as a safeguard, and never for longer than the clip they were converted into; - Session Recordings of an Organisation whose recording plan is cancelled or stays unpaid: the Organisation's copy is deleted after 30 days' notice, during which the Organisation can export its Session Recordings under its plan's export terms; a clip that a Parent or Guardian keeps in their own storage stays theirs until they no longer keep it (see section 17); - consent receipts: kept for as long as the records they authorised; - records of your acceptance of our Terms and this Policy: kept for 7 years after your account closes, without your contact details; - audit logs: 7 years; - operational and access logs, including IP addresses: 90 days, with security events copied to our 7-year audit archive; - database logs: 30 days; - database backups: 35 days, on a rolling basis; - crash reports: 90 days; - reports sent through the Service: 12 months for the text of product feedback, 24 months for most reports, 36 months for reports about someone's conduct, and 6 years for legal requests and reports about a child's safety, or longer while an authority to which such a report was referred requires it; - messages from our payment provider about payments: 90 days, with the cardholder's name, address, email address and card details removed before storage; - invoices and accounting records: the longest period that tax law requires in the countries where we operate, currently 7 years; - contact-form messages: 12 months after our last reply; - registrations that are never completed: deleted 90 days after registration, with a reminder first.

Until automatic deletion is in place for a category above, we keep that data, and you can ask us to delete it (see section 29). We will do so unless we, or the Organisation, must keep it.

Information that you manage yourself, such as your profile, your professional and compliance information, the files in My Cloud and your calendar connections, is kept until you delete it or delete your account (see section 24).

We may pause a deletion when a legal hold applies, for example because of a dispute, an investigation or a request from an authority. A legal hold can apply to a file, a Child's record or an account. It needs the approval of two people at Edura, a stated reason and a review date, and every hold and release is recorded in a log that cannot be changed. We place such a hold on the evidence whenever we report material that depicts the sexual abuse or exploitation of a child (see section 21).

At the end of a retention period, we delete the data. We keep anonymised copies only where the conditions in section 19 are met.

24. Deleting your account

You can delete your account from your account settings ("Delete account"), from our mobile apps, or by following the steps on our public page at therapatic.com/delete-account. You must confirm with your password. Before you confirm, we tell you about anything that needs your attention first, such as a store subscription that will keep renewing. If you are the only owner of an Organisation, you must first hand the ownership to someone else or archive the Organisation; until then the deletion is not accepted. When you delete your account: - you are signed out everywhere, and we send you an email, in English or Arabic, confirming the request; - you have 30 days to change your mind: sign in before then and you can cancel the deletion. We email you a reminder about 7 days before the end; - after 30 days, your account is closed for good and cannot be restored, and we erase your personal data automatically, as listed below. We email you when it is done; - records an Organisation made about your care or your child's care, including anything you wrote for that Organisation, stay with that Organisation under its record-keeping duties, and you will no longer be able to see them through the Service.

What we erase after 30 days: - your sign-in details: your email address (so that it can be used to register again), your password, your two-factor sign-in and passkeys, and your sessions and sign-in tokens; - your own profile: your photo, phone number, date of birth, nationality and settings, and your name unless you held a staff role in an Organisation (see below); - if you are a therapist or other professional: your professional profile, credentials and compliance documents; your passport is closed and its public page switched off; - the files in My Cloud, including the files you kept there for your Child, and every share of them with an Organisation; files you gave to an Organisation stay in that Organisation's records; - your calendar connections, with the passwords and tokens you gave us for them, and your calendar feed links; - your phones' push registrations and your notifications.

What is kept, and why: - the records Organisations made, for as long as the law that applies to them requires; - if you held a staff role in an Organisation: your name, so that the records you made or signed there still show who made them, and that Organisation's own staff records about you; - for now, what Hieka remembers for you: it is not yet erased automatically, and you can ask us to erase it by writing to privacy@therapatic.com; your conversations with Hieka are deleted 30 days after each message in any case (see section 13); - the audit logs, including the sealed record of the steps you took to set up your account, consent receipts, records of your acceptance of our Terms and this Policy, and invoices that the law requires us to keep (see section 23).

If you are the last Parent or Guardian linked to a Child: - if no Organisation, current or former, holds any record about the Child, we erase the Child's shared profile, photo and files together with your account; - if an Organisation does hold records about the Child, the Child's shared profile is kept as one sealed, read-only record that only those Organisations can see, and we erase it when the last of them no longer needs to keep it; - in both cases, every Organisation's work with the Child ends, and any enrolment request still open for the Child is cancelled; the Organisation that sent it is told.

If another Parent or Guardian is still linked to the Child, none of this applies: the Child's profile stays as it is, and if you were the Child's primary guardian, the one linked longest becomes the primary guardian and is told.

Before you delete your account, you can download a copy of your data with Download my data in your account settings (see section 29).

Deleting your account does not cancel a subscription you bought through the Apple App Store or Google Play. Cancel it in the store.

Deleting your own account is different from asking for your Child's information to be erased. Section 29 explains how to ask for that.

25. Security

We use technical and organisational measures suited to the sensitivity of the data, including: - encryption in transit: connections to the Service use TLS 1.2 or 1.3, browsers are told to connect only over HTTPS, and our databases and file storage refuse unencrypted connections; - encryption at rest: databases, file storage, backups and logs are encrypted with keys we manage in AWS Key Management Service, which rotates them automatically; - for Session Recordings, encryption keys held for the clips' owners: each Organisation's clips under that Organisation's own key, and a clip that a Parent or Guardian also owns under a key that is not the Organisation's alone; - extra encryption of the most sensitive fields, such as Children's names and dates of birth, inside the application; - private file storage that blocks public access, and a malware check of every uploaded file; - sign-in protections: hashed passwords, optional two-factor sign-in and passkeys, session limits, automatic sign-out after inactivity, lockout after repeated failed attempts, and alerts about failed sign-ins; - access controls based on each person's role and relationship to each Child; - audit records of access decisions, consents, file access, Session Recording access and enrolment requests, kept in append-only logs that the database protects against editing and deletion, and checked every night for any break; consent receipts are also linked in a chain that shows whether any receipt has been altered; - a web application firewall that limits abusive traffic; and - automated scanning of our code for security weaknesses and exposed secrets.

We will also run our databases across separate data centres, and keep backup copies in a second region (see section 22).

No system can be made completely secure. Protect your password, your devices and anything you download, and tell us at once at security@therapatic.com if you suspect a problem.

26. Staff access to customer data

We do not let Edura staff access the records in a Workspace as part of their routine work.

Edura staff can open the records of Hieka requests and responses (see section 13), or prepare a training or evaluation set from them (see section 19), only through emergency ("break-glass") access. Each use needs a stated reason and the approval of two people, one of whom is always our Privacy Lead, and it is limited in time and to the Workspaces named in the request. Edura logs each use and what was opened, and our Privacy Lead oversees that log. We do not notify the Organisation when this access is used.

Edura's administrator accounts can also reach an export of the data collected in sessions, the assessment answers and the behaviour-plan records about a Child, which is meant for answering privacy requests and requires a stated reason. This export is logged, but it does not yet need a second person's approval and is not limited in time. We will bring it under the same rules as emergency access.

When a report is sent to Edura, the Edura staff who deal with reports can read the report and its details, such as the kind of item it points to and the Workspace it is in. If dealing with a report needs a look at reported content that holds health information, that content is opened only through emergency access: two people must approve it, one of whom is always our Privacy Lead, it lasts at most 60 minutes, it is limited to the reported items, and every read is recorded. We tell the Organisation afterwards, in summary, unless the report concerns safety, privacy or misconduct. Edura staff never watch Session Recordings unless the law or a report about a recording requires it, and then only through emergency access.

We will keep a log of who opened or exported each Child's clinical record. The Organisation and our Privacy Lead will be able to review it, and a Parent or Guardian can ask to see it.

27. Accuracy and correction

Please keep your account information up to date; you can change most of it in your account settings. Organisations are responsible for the accuracy of the records they make.

In clinical and professional records, a correction is added in a way that keeps the history, rather than silently replacing the original. A disagreement about a professional opinion may be handled differently from correcting a factual detail. To ask for a correction to a record an Organisation made, contact that Organisation, or email privacy@therapatic.com and we will pass your request on.

28. Consent: giving, pausing and withdrawing it

When a Parent or Guardian accepts a Child's enrolment with an Organisation, that acceptance is their consent to the Child's clinical care being recorded and coordinated in Therapatic (the "Clinical data sharing" consent). It lets the Organisation view and add to all eight kinds of care record: assessments; goals and targets; data collected in sessions; behaviour plans; behaviour tracking; session notes; progress reports; and the clinical file. The clinical file also covers the sections of the Child's shared profile other than the identity details and the safety sections (see section 16), so switching off viewing the clinical file also hides those sections from that Organisation. Exporting, which means downloading, printing or sharing records outside the Service, stays off for each kind until the Parent or Guardian switches it on. The Parent or Guardian can switch off any part of this consent at any time on the Consent & Privacy page, and the Organisation can ask them to change a setting. They can also pause, resume and withdraw the consent as a whole. A consent can also have an end date, after which it expires automatically. Sharing the family's own behaviour and safety account with an Organisation is a separate choice, made for each Organisation and off until the Parent or Guardian switches it on (see section 16); switching it off hides that account from the Organisation at once.

An Organisation's administrator can record or withdraw a consent on a Parent or Guardian's behalf only with a stated reason and the signed consent form attached. This is recorded, and the Parent or Guardian is told.

Every grant, pause, withdrawal and expiry is recorded as a dated receipt in a tamper-evident, append-only log that is protected against editing. When a Parent or Guardian grants consent at enrolment, we also record the IP address and the browser or device used.

These choices take effect at once. When a part of the consent is switched off, the Organisation can no longer do what that part covered. Pausing the consent pauses the Child's enrolment with that Organisation, and withdrawing it ends the enrolment: the Organisation can then add nothing new and export nothing, and keeps only a read-only view of what it had already recorded. Withdrawal does not delete records the Organisation has already made and must keep, and it does not undo information already seen.

Session recording. Session Recordings are not covered by the "Clinical data sharing" consent. Before a Child is recorded at an Organisation, a Parent or Guardian who has custody of the Child or full authority to decide for the Child must switch session recording on for that Organisation, and can choose whether sound is recorded. The choice is made in the Service by the signed-in Parent or Guardian and is recorded with its date and time and the version of the wording shown. That record is the written consent to recording; no paper form is needed. A member of staff agrees to record or to appear in recordings in the same way, in the app. If the Child's Parents or Guardians disagree, recording stays off: any one of them who has that authority can switch it off. Switching it off stops new recording at once; clips already kept stay part of the Child's record, are used only for the Child's care, and stay visible to the Parent or Guardian. Turning sound off applies to new clips only. Therapy never depends on agreeing to be recorded.

We will ask separately for each of these, and each can be withdrawn at any time without affecting the Child's care: - photos and videos of the Child, other than Session Recordings; - marketing; - AI processing of the Child's information beyond what section 13 describes; and - the use of anonymised data about the Child for research.

A consent that has been withdrawn can be given again. Each change will be recorded as a new dated receipt.

An Organisation can also ask you to record other consents in the Service, for example about research participation or sharing files outside the Workspace. The Service records your answer, but does not by itself enforce those consents. The Organisation is responsible for acting on them.

29. Your rights and how to use them

Depending on the law of your country, you may have the right to: - know how we use your personal data; - get a copy of it; - have it corrected; - have it erased; - restrict or object to some uses of it; - withdraw consent; - receive it in a portable format; and - complain to a data protection authority.

You can get a copy of your data yourself: choose Download my data in your account settings. A Parent or Guardian can also download a copy of their Child's record. Each copy is in a portable format and lists anything it does not include yet; you can ask us for the rest.

To use any of these rights, or for anything a copy leaves out, email privacy@therapatic.com. We will verify your identity, and your authority where you act for a Child or for someone else, and we will respond within one month, or sooner where the law of your country requires it (see section 33).

Where your request is about records an Organisation keeps, we will pass it to that Organisation, or ask you to contact it, because the Organisation decides what it must keep under its professional and legal duties.

Erasing a Child's information is a separate request from deleting your own account. Email privacy@therapatic.com. We will send your request to each Organisation that holds records about the Child, ask it to answer within 30 days, and tell you each Organisation's answer. Each Organisation decides, under its legal duties, whether it can erase its records now or must keep them until a later date. A Parent or Guardian can ask an Organisation to erase records, but cannot force it to.

Some rights have limits: for example, where erasing information would break an Organisation's legal duty to keep records, affect other people's rights, or prevent a legal claim from being established or defended.

If we refuse your request, we will tell you why and how you can ask us to look at it again. You can also complain to the data protection authority in your country.

30. Security incidents

We monitor the Service with automated alarms, and we investigate, contain and fix security incidents. If an incident affects personal data, we will notify the Organisations concerned, the affected people and the relevant authorities where the law requires it, within the time that law sets, and we will work with the Organisations concerned. To report a suspected incident, email security@therapatic.com.

31. Cookies and data stored on your device

We use only the cookies the Service needs to work. We use no analytics, advertising or third-party cookies, so we do not show a cookie banner.

The web app sets these cookies: - _therapatic.session: keeps you signed in; it lasts as long as your current sign-in token; - _therapatic.refresh: renews your sign-in; 30 days; - _therapatic.id: helps sign you out correctly; 30 days; - a short-lived cookie that protects each sign-in; 15 minutes; - tp_refresh_retry: helps recover from an interrupted sign-in renewal; - NEXT_LOCALE: remembers your language.

Our sign-in service sets a session cookie, which lasts up to 2 weeks, and a security cookie that protects forms against forgery.

The web app also stores data in your browser: - data you have collected but not yet submitted, such as session and trial data and drafts, so you can keep working if your connection drops. This data is not encrypted in your browser. We remove it when you sign out using the sign-out button, when you switch account, and when the web app signs you out after one hour without activity. Use a device you control, and sign out when you finish; - display preferences, such as theme and panel widths, and which notifications you have read.

Our mobile apps store on your phone: - what they need to keep you signed in, and the app's device identifier (see section 5); - records you have opened, so that you can keep working without a connection, and session data you have collected but not yet sent. This data is kept in the app's own storage, which your phone's operating system encrypts, and it is removed when you sign out; - Session Recordings waiting to be uploaded (see section 17).

32. Changes, contact, complaints and language

Each version of this Policy shows its version number and effective date. If we make a material change, we will tell you at least 30 days before it takes effect and ask you to acknowledge it. For a minor change, such as a clarification, we will give you notice. We will not start using personal data for a new purpose without telling you first and, where the law requires it, asking for your consent.

This Policy is published in English and Arabic. If the two versions differ, the English version prevails.

For privacy matters, we can be reached by email only: - privacy@therapatic.com: the Privacy Lead, Edura, for privacy questions, requests about personal data and privacy complaints; - support@therapatic.com: general help, and billing and account questions; - security@therapatic.com: to report a security problem.

A complaint about the professional service an Organisation provides should go to that Organisation. You can also complain to the data protection authority in your country.

33. Information for particular countries and regions

This section adds to the rest of this Policy for people in the countries and regions named below. Where it gives you more rights than the rest of this Policy, you have those rights. To use any right described here, email privacy@therapatic.com.

United States. We do not offer the Service to Organisations established in the United States for now. The Service is not used to keep health information that the US Health Insurance Portability and Accountability Act (HIPAA) protects, and we are not a business associate under HIPAA. Families and professionals in the United States can use the Service with an Organisation established in another country. We do not sell personal data, we do not share it for targeted or cross-context behavioural advertising, and we do not use it for profiling that produces legal or similarly significant effects. We use sensitive personal data, such as health information, only to provide the Service you or your Organisation asked for and for the other purposes this Policy describes. Children do not use the Service; information about a Child is provided by the Child's Parent or Guardian or by an Organisation. If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Oregon, Texas, Utah or Virginia, you may have the right to know what personal data we hold about you and how we use it, to get a copy of it, to have it corrected or deleted, and to opt out of its sale, of targeted advertising and of such profiling, which we do not do. We will not treat you differently for using these rights. You can use them yourself or through an authorised agent, and we will verify the request. If we decline your request, you can appeal by replying to our answer; we will answer the appeal in writing and tell you how to contact your state's attorney general if you disagree.

California. This Policy is our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Section 5 lists the categories of personal data we collect, section 7 where they come from, section 8 why we use them, section 21 who receives them, and section 23 how long we keep them. In the last 12 months we have not sold or shared personal data, and we do not knowingly sell or share the personal data of anyone under 16. We answer requests within 45 days.

Washington. For people in Washington State, this paragraph and the sections it points to are our Consumer Health Data Privacy Policy under the Washington My Health My Data Act. The consumer health data we collect is the health information listed in sections 5 and 6, for example a Child's care profile and an Organisation's clinical records. It comes from the sources in section 7. We collect and use it to provide the Service that you or your Organisation asked for (sections 8 and 13). In addition, only where the Workspace's owner or an administrator has switched this use on, we use the records of requests made to Hieka and of its responses, which can contain health information, to improve Hieka, including to train and evaluate the AI models behind it (section 19); this use is off by default, and it can be switched off again at any time. We share it only as described in sections 15, 16 and 21, and we never sell it. You have the right to know whether we collect, share or sell your consumer health data, to see it and the list of everyone we have shared it with, to withdraw consent, and to have it deleted, including from our service providers' systems and our backups. We answer within 45 days, and you can appeal a refusal as described above.

Canada and Quebec. We handle personal information of people in Canada under the Personal Information Protection and Electronic Documents Act and, for people in Quebec, under the Act respecting the protection of personal information in the private sector. Our Privacy Lead is the person in charge of the protection of personal information, at privacy@therapatic.com. Your information is stored and processed in the United States (section 22), where the authorities may be able to access it under US law; before we transfer it, we assess whether it will be adequately protected. You can ask to see and correct your information, withdraw your consent, and, in Quebec, ask for a copy in a structured, commonly used technological format. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

Brazil. Under the Lei Geral de Proteção de Dados Pessoais (LGPD), Edura is the controller of the personal data described in this Policy, except as section 4 explains, and our Privacy Lead acts as our data protection officer (encarregado), at privacy@therapatic.com. We process sensitive personal data, such as health information, on the bases the LGPD allows for it, in particular specific consent and the protection of health by health professionals and services. We process a Child's personal data in the Child's best interest and with the specific consent of a Parent or Guardian. You have the right to confirmation that we process your data, to access it, to have it corrected, anonymised, blocked or deleted, to have it moved to another provider, to know whom we have shared it with, to be told what happens if you do not consent, to withdraw consent, and to ask for a review of decisions made only by automated processing. We transfer data to the United States under safeguards the LGPD recognises, such as standard contractual clauses. You can complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Australia. We handle personal information of people in Australia under the Australian Privacy Principles in the Privacy Act 1988. Your information is stored in the United States, and we take reasonable steps to make sure that the providers listed in section 21 handle it in line with those principles. You can ask to see and correct the personal information we hold about you. If you are not satisfied with how we handle a complaint, you can complain to the Office of the Australian Information Commissioner. We will notify you and the Commissioner of an eligible data breach as the law requires.

India. Under the Digital Personal Data Protection Act, 2023, Edura is the data fiduciary for the personal data described in this Policy, except as section 4 explains. We process it on the basis of your consent, which you can withdraw at any time as easily as you gave it, and for the other uses the Act allows. We process a Child's personal data only with the verifiable consent of the Child's Parent or Guardian, and never for tracking, behavioural monitoring or targeted advertising directed at children. You have the right to a summary of the personal data we process and of whom we have shared it with, to have it corrected, completed, updated or erased, to nominate someone to use your rights if you die or cannot act, and to have your grievances addressed. Our Privacy Lead handles grievances at privacy@therapatic.com. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Saudi Arabia. Under the Personal Data Protection Law, you have the right to be told how we collect and use your personal data, to see it, to get a copy of it in a clear and readable format, free of charge, to have it corrected, completed or updated, and to have it destroyed when we no longer need it, unless the law requires us to keep it. We treat health information as sensitive data. We transfer personal data outside the Kingdom only as the Law and its regulations allow. We answer requests within 30 days. You can complain to the Saudi Data and AI Authority (SDAIA).

United Arab Emirates. We handle personal data under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Health information is governed by its own law, Federal Law No. 2 of 2019 on the Use of Information and Communications Technology in Health Fields, and by the rules of the health authority of the emirate concerned. You have the right to receive information about the personal data we hold about you, to get it in a portable format, to have it corrected or erased, to restrict or stop some uses of it, and to object to decisions made only by automated processing. For Organisations in the United Arab Emirates, Edura is a software provider and a data processor, not a health service provider (section 4). Their data, including Session Recordings, is stored in the United States (section 22). The law sets minimum periods for keeping health records, at least 25 years from the last treatment, and keeping its records for that period is each Organisation's duty (section 23). You can complain to the UAE Data Office.

European Union, European Economic Area and United Kingdom. We do not currently offer the Service in these countries. We will add a section for them before we do.