Privacy Policy

1. Scope and our role

This Privacy Policy explains how DataInn ("TherapyCRM", "we", "us") handles personal information in connection with the TherapyCRM web application, parent portal, mobile apps (TherapyCRM Kiosk and TherapyCRM Family), AI assistant, and related support (the "Services"). It applies to the practices that subscribe to the Services ("Customers"), their staff, and — through the parent portal and the TherapyCRM Family app — the families the practice serves.

We act in two different roles. For account, billing, and usage information about our Customers and their staff, we decide how the information is used and are accountable for it. For the client and family information a practice records in the Services ("Client Information"), the practice is the custodian or accountable organisation; we process that information only on the practice's instructions as its service provider or agent.

If you are a client or parent, your practice is your first point of contact for access, correction, and consent questions, and this Policy describes what we do on the practice's behalf.

2. Where the Services are offered

The Services are offered to practices located in Canada, outside the Province of Quebec. We have not designed the Services for Quebec's specific privacy and language requirements and make no representation that they are suitable for use there, or in any other country. Practices are responsible for confirming suitability for their jurisdiction before placing personal information in the Services.

3. Information we handle

Account and practice information (we are accountable):

• names, email addresses, phone numbers, roles, and credentials of practice owners and staff;
• practice name, address, province, time zone, and billing details (payment card details are collected and stored by our payment processor, not by us);
• records of acceptance of our Terms and this Policy, including the version, the person accepting, the time, and the network address used.

Client Information (the practice is accountable; we process on its instructions):

• client and family demographic and contact details, guardian and custody information, and consents;
• appointments, attendance, schedules, and waitlists;
• treatment plans, goals, session data, progress notes, assessments, and uploaded documents;
• insurance, funding, and invoicing details;
• messages sent to families through the Services and portal activity.

Technical information (we are accountable):

• device, browser, and network details; device push tokens for notifications a user turns on; sign-in events; security and audit logs; and usage and performance measurements needed to operate and secure the Services.

Website demo requests (we are accountable):

If you request a demo or contact us on our website, we collect what you enter: your name, work email address, organization, province or territory, disciplines, team size, the reason for contacting us and an optional message. We also record the campaign labels and landing page of the link that brought you to the form and, if you allowed ad measurement, its ad-click identifier. Please do not include client names or health information.

We use this only to respond to your request and to follow up about TherapyCRM. Your request is stored in the TherapyCRM application database in Canada, where our team handles it as a support ticket. Using the email provider listed on our Subprocessors page, we email you a confirmation with a private link to follow your request, and we notify our support team by email; these emails do not contain your message.

We keep a request for as long as we need it to respond to you and to keep a record of the enquiry, and then delete or de-identify it. You can ask our Privacy Officer to erase it sooner.

3A. Optional calendar connections

Calendar connections are optional features for authorised practice staff. When a practice enables calendar synchronisation, a staff member may connect Google Calendar or Microsoft Outlook / Microsoft 365 and choose which calendars to synchronise. Authorised practice administrators can configure a connection for a branch or the whole practice. Connecting a calendar does not give TherapyCRM access to your email messages, contacts, or files.

Microsoft Outlook / Microsoft 365 connections are not yet enabled; this section will apply to them once they are.

Information accessed and stored

With your permission, TherapyCRM accesses your provider account identifier and email address to identify the connected account; calendar identifiers, names, time zones and access permissions so you can choose calendars; and events in the calendars you select. We use event identifiers, start and end times, all-day status, busy/free status, privacy status, recurrence information and provider links to synchronise events and determine availability.

Provider responses may include other event fields, but TherapyCRM discards descriptions, attendees, locations and attachments instead of retaining or displaying them.

Personal calendar events are labelled Busy in TherapyCRM, and their original titles are not retained in the event cache. An authorised administrator may choose to show titles for a shared calendar; private or confidential events remain labelled Busy. Retained event titles and provider links, and the access and refresh tokens needed for background synchronisation, are encrypted. Scheduling metadata, including event times and busy status, is stored under the Services' normal storage and access safeguards.

How calendar information is used and shared

We use connected-calendar information to display external events, synchronise appointment copies, check availability and prevent conflicting bookings when blocking is enabled. External events remain read-only in TherapyCRM and are edited or deleted in their original calendar service. TherapyCRM appointments are edited or cancelled in TherapyCRM; their external copies follow those changes. Editing an external copy does not edit its TherapyCRM appointment, and synchronisation may restore that copy.

TherapyCRM exports generic Appointment or Group appointment labels, start and end times, and private/busy status to the calendars you select. It does not export patient names, clinical notes, appointment descriptions, locations, attendees or reminders. The integration does not send invitations or change calendar-sharing permissions. Calendar providers and people who already have access to the selected calendar may see the exported copies under that provider's permissions and privacy terms.

Personal or shared external events imported from one provider are not automatically copied to another provider.

Within TherapyCRM, external events and availability are shown to people whose practice role and calendar access permit them to see the relevant staff, branch or practice schedule. Personal event details are hidden as described above; busy times may still affect scheduling for that staff member. Shared-calendar blocking, if enabled, treats imported busy times as unavailable for the selected branch or practice. Our contracted infrastructure providers process stored calendar information to operate the Services as described in this Policy.

Your chosen calendar provider processes information under its own terms, settings and storage locations; TherapyCRM's storage-region commitments do not control copies held in your external calendar account.

Your choices, retention and removal

You choose the calendars, synchronisation direction and availability-blocking settings. Synchronisation normally covers the previous 30 days and the next 365 days. Cached events outside that period are removed during successful reconciliation; this is a rolling display window, not a retention promise for provider copies or audit records.

Removing a selected calendar immediately stops its imported display and availability blocking. Its local event cache and synchronisation mappings are deleted when removal cleanup completes. You can request removal of the TherapyCRM-created copies in that external calendar; cleanup may require reconnecting if provider access has expired or been revoked. Removing a connection without that cleanup leaves external copies in the provider until you delete them there. Removing a calendar does not delete unrelated provider events or TherapyCRM appointments.

After removing the account's selected calendars, you can disconnect the account to clear its stored calendar access credentials. You may also revoke access in your Google Account's third-party connections settings or your Microsoft account's application-permission settings. Revoking access at the provider stops authorised API access but does not itself remove previously stored TherapyCRM cache entries or external copies; use TherapyCRM's removal controls or contact support@therapycrm.io for assistance.

Connection identity may remain to support reconnection; audit and acceptance records and backup copies follow the retention provisions in Section 11. Privacy and deletion inquiries may also be directed to our Privacy Officer in Section 16.

Google API Services Limited Use

TherapyCRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide or improve the calendar and scheduling features visible to users. We do not sell Google user data, use it for advertising or credit decisions, or use it to train general-purpose AI models.

We transfer Google user data only as needed to provide or improve these user-facing features with your consent, for security purposes, to comply with applicable law, or as part of a business transfer after obtaining your explicit prior consent. Our personnel and contractors may access that data only with your affirmative agreement to view specific data, where necessary for security or legal obligations, or as permitted for aggregated internal operations under Google's policy.

These Google-specific limits also apply to data derived from Google APIs and take precedence over broader use or sharing provisions elsewhere in this Policy.

3B. Mobile apps

TherapyCRM offers two apps for iPhone and iPad through the Apple App Store: TherapyCRM Kiosk and TherapyCRM Family. Clinicians and other practice staff use the TherapyCRM web application for their schedules, sessions, notes and family updates. A separate staff app is coming soon and is not yet available; we will update this Policy before it is released.

The apps work only with accounts and devices that a practice has set up, and they apply the same practice isolation, role-based access and audit logging as the web application. Information the apps send to TherapyCRM is stored and processed as described in Section 7.

What each app handles

• TherapyCRM Kiosk runs on a front-desk iPad that practice staff enrol with a TherapyCRM sign-in. Children and families use it to check in and out, and staff use it to clock in and out. It handles clients' first names, last initials and the character each child chooses; a client's date of birth where the practice uses birthday look-up or confirmation, which is never displayed; check-in, check-out and pickup times and the authorised adult who collected a child; the assigned therapist's first name and room shown after check-in; an optional client photo that staff choose; requests for staff help sent from the front desk; and staff clock-in and clock-out events recorded with a PIN or a single-use code.
• TherapyCRM Family is for parents and guardians whom a practice has invited to its portal. It handles the family member's account details and the information the practice shares with them: upcoming and past visits, attendance updates, visit requests and dates the family reports as unavailable, messages with the care team and their attachments, care updates, published progress, home-practice logs, documents, forms, invoices and payments. Where a practice offers online payment, the app opens a payment page hosted by our payment processor; card details are entered there and are not collected or stored by the app or by us.

Notifications

Notifications are optional. A user turns them on in the Family app, and iOS then asks for permission. When notifications are on, the app registers a device push token with TherapyCRM, and we store that token with the user's account to deliver notifications to that device. Notifications are delivered through Expo's push notification service and the Apple Push Notification service.

Notification text is generic, for example "You have a new secure message from your care team". It does not contain client names or clinical details, because it can appear on the Lock Screen and is processed by those delivery services. Details are shown only inside the app to a signed-in user.

We stop using a device's push token when the user turns notifications off or signs out, when Apple or Expo reports that the token is no longer valid, or after a long period in which the device has not re-registered.

Device permissions

Each app asks for a device permission only when a feature needs it. Every permission is optional: declining one affects only the feature that needs it, and permissions can be changed at any time in the iPhone or iPad Settings app.

Neither app uses the device's location.

On the device

• Kiosk reads names and greetings aloud with voices generated by iOS on the iPad. No audio is recorded or sent to TherapyCRM or any other service, and the Kiosk app does not use the camera or microphone.
• To keep check-in working through short network outages, Kiosk keeps the day's roster and any check-ins not yet sent encrypted on the iPad, and sends them when the connection returns.
• The apps keep sign-in credentials in the iOS Keychain.

App updates

The apps can receive app-code updates through Expo's update service. When an app checks for an update, Expo receives technical information such as the app version, the device platform, a random installation identifier and the network address. Updates contain app code, not personal information.

No advertising, tracking or third-party analytics

The apps contain no advertising, do not track users across other companies' apps or websites, and do not include third-party analytics or advertising software. If a device owner has chosen in iOS to share analytics with app developers, Apple may give us aggregated crash and usage statistics under Apple's terms.

Accounts and deletion

Practices create and remove the staff accounts used in the web application and the Kiosk app. A family member can delete their portal sign-in in the TherapyCRM Family app (More → Account → Delete account) or ask their practice to remove it. Deleting a sign-in ends that family member's access and stops notifications to their devices.

It does not delete the client's records, which the practice keeps as health-records retention law and its professional obligations require (see Sections 11 and 12).

4. Why we use information

• to provide, secure, support, and improve the Services;
• to carry out a practice's instructions, including sending appointment reminders and other communications the practice configures;
• to manage subscriptions, billing, and account security;
• to produce audit trails and security records required of a health-information service provider;
• to meet legal obligations and respond to lawful requests.

We do not sell personal information, use Client Information for marketing, or use it to train artificial-intelligence models. Improvement work uses aggregated or de-identified measurements wherever possible.

5. Consent

Customers consent to our handling of account and technical information by accepting our Terms. Each practice is responsible for obtaining every consent needed for the Client Information it places in the Services — including consent from a parent or legal guardian for minors and consent for communications sent on its behalf — and for confirming a guardian's authority before granting portal access.

Where the Services ask for a consent to be recorded, the recording is a convenience for the practice, not a substitute for the practice's own consent practices.

6. AI-assisted features

Some features use third-party artificial-intelligence models to draft, summarise, extract, or answer questions. Before text is sent to a model provider, the identifiers of people already in the practice's records, and identifier fields in record data, are replaced with placeholders, and the original values are restored only inside the Services. Other details that a user types, including names, dates of birth, addresses, or email addresses that do not match a practice record, are sent to the provider as typed.

A phone number or email address that a user types for the assistant to set or check, and the name and contact details of a new lead that a user asks the assistant to create, are also sent as typed, even when they match a known record, because the task needs them. Images, such as scanned pages and photos uploaded to import records, cannot be redacted and are sent to the model as they are.

Only model providers hosted in North America are used, under terms that prohibit them from using content to train their models and that limit any retention to the short period needed to operate and secure their service. AI output is assistive only and must be reviewed by a qualified person. A practice owner can disable AI features for the whole practice in Practice Settings.

7. Where information is stored and processed

TherapyCRM data is stored in Canada. The following storage and processing locations apply:

The providers in the last two rows receive only the information they need to deliver their service, as described in Sections 3B, 6 and 8. Our Subprocessors page names each provider, its purpose and its location. A calendar or other service that a practice chooses to connect, such as Google Calendar (Section 3A), keeps its copies under that provider's own terms and locations. Microsoft Outlook / Microsoft 365 calendar connections are not yet enabled.

Production moved to Canada on October 2, 2026. Copies made before that move are being retired: a frozen copy of the database is kept in the United States as a rollback source until about November 1, 2026, and backup copies made in Germany are deleted under a 30-day deletion rule about November 1, 2026 and cannot be recovered after about November 8, 2026. Our testing and pre-release environments run in the United States and Germany and can contain copies of account, practice and Client Information.

These copies are protected by the safeguards in this Policy.

While information is outside Canada it is subject to the laws of that jurisdiction, including lawful access by authorities there. We require every service provider to protect information to a standard comparable to our own and to use it only to provide their service to us.

We may change or replace the providers and facilities we use, and move information between them within Canada, provided the safeguards in this Policy are maintained. We will update this Policy and give practices at least 30 days' notice before storing Client Information outside Canada in any way not described in this section.

8. Who we share information with

We share information only with:

• service providers that host infrastructure, store files, deliver email, text messages, app notifications, and app updates, process payments, and supply artificial-intelligence models — each bound by contract to safeguard information and use it only for the service they provide to us;
• Google, for bot protection on public forms (and on sign-in where it is turned on), for the video on our offer page when a visitor presses play and, only with a visitor's consent, measurement of our public website, under Google's own terms as described on our Security page;
• Apple, as the platform provider, when the apps are downloaded from the App Store and when notifications are delivered through the Apple Push Notification service, under Apple's own terms and privacy policy;
• the practice that is accountable for the information, and the people it authorises;
• professional advisers and successors in connection with a financing, merger, or sale of the business, subject to this Policy;
• authorities where required by law, a court order, or to protect the safety of a person.

Our Subprocessors page at therapycrm.io/subprocessors lists the service providers we use, what each one does and the countries where it processes information. The Privacy Officer can answer questions about it.

9. Safeguards

We apply safeguards appropriate to health information, including multi-factor authentication, role-based access control, tenant isolation between practices, automatic session time-outs, audit logging of access to and changes in client records, encryption in transit, encryption at rest provided by our hosting providers, private storage for clinical documents, rate limiting, and security monitoring. Staff access to Client Information is limited to what operating and supporting the Services requires.

Practices are responsible for their own devices, networks, staff training, the access rights they grant, and the credentials their users keep. No safeguard is perfect, and we do not guarantee that information can never be accessed without authorisation.

10. Privacy incidents

If we confirm that Client Information has been accessed, used, or disclosed without authorisation, or lost, we will notify the affected practice's designated contact without undue delay and within any period the law requires of us, tell the practice what we know, and cooperate with the practice's own obligations to notify individuals, regulators, or colleges. We keep a record of privacy incidents.

11. Retention and deletion

• Client Information is kept for as long as the practice's subscription is active and for a read-only export window of 30 days afterwards. It is then scheduled for deletion from active systems. Routine nightly database backup copies are scheduled for deletion after 30 days, followed by a seven-day soft-delete recovery period, and the database provider's own recovery history is kept for up to seven days. Cleanup is asynchronous, so these configured periods do not guarantee deletion of every copy on an exact day.
• Practices are responsible for exporting any records they must keep under their own retention obligations before the export window closes.
• Account, billing, acceptance, and audit records are kept for as long as needed to meet legal, accounting, and security obligations, and then deleted or de-identified.

12. Your rights

Customers and their staff may ask us to access or correct the account information we hold about them. Clients and parents should direct requests to access, correct, or withdraw consent for Client Information to their practice, which is accountable for it; we will assist the practice in responding.

Family members can also delete their portal sign-in in the TherapyCRM Family app, as described in Section 3B. Anyone may ask the Privacy Officer how their information has been handled, and may complain to the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner if not satisfied with our response.

13. Children and minors

The Services are used by practices that serve children and youth. Information about minors is collected by the practice under the consent of a parent or legal guardian, or of the minor where the practice determines the minor is capable of consenting, in accordance with the practice's professional obligations. We do not knowingly collect information from minors directly except through a portal account a practice has set up under a guardian's consent.

The TherapyCRM Kiosk app is used by children at the practice's front desk under staff supervision. Children select their own name and may choose a character; they do not create accounts or enter other information. The apps contain no advertising, tracking, or third-party analytics.

14. Compliance posture

The Services are designed to support practices subject to Canada's federal private-sector privacy law and provincial health-privacy statutes, including where TherapyCRM acts as an agent or service provider of a health-information custodian. We do not hold a privacy or security certification and do not claim one; we are pursuing an independent security attestation and will state it here only once it has been issued.

15. Changes to this Policy

We may update this Policy. Material changes are published with a new version date, and practice owners are asked to accept the new version in the application. Earlier versions are available from the Privacy Officer on request.

16. Privacy Officer and contact

Our Privacy Officer is accountable for our compliance with this Policy and can be reached at privacy@therapycrm.io. We acknowledge privacy inquiries within two business days and respond as required by law. Postal: DataInn, Privacy Officer, Suite 200, 55 Village Centre Pl, Mississauga, ON L4Z 1V9, Canada.