Security and privacy information for your practice review

Access and accountability

TherapyCRM provides role-based access scoped to the practice and branch, multi-factor authentication, short staff sessions and audit trails. Your practice controls staff responsibilities and must review access when roles change or people leave.

Ask to see how the roles you actually use handle client records, documentation approval, billing and family sharing. A feature list does not establish that a particular configuration meets your obligations.

Data processing may occur outside Canada

TherapyCRM does not claim that all data stays in Canada. The published subprocessor list identifies providers and processing locations, including locations outside Canada. Review that list, the privacy policy and service terms as part of your assessment.

Obtain current information about the services and optional features you intend to enable. Region availability, contracts and provider arrangements must be checked for your use case.

Records, retention and device use

The platform includes encrypted storage and transport, retention controls and audit functionality. Offline session collection stores an encrypted draft on the device and requires later synchronization. Practice policies should address device access, loss, shared devices and completion of synchronization.

Ask for current evidence on backup, recovery, retention, export and offboarding that applies to your agreement. Do not infer a recovery commitment or a certification from the presence of technical controls.

Marketing analytics are separate from clinical work

Optional Google Analytics runs only on an explicit list of public marketing pages after consent. Declining analytics leaves those pages usable. Authentication, checkout, portal and clinical screens do not load marketing analytics.

We send the public page path, defined marketing interaction names and a recognized search-engine origin for search attribution. We do not send form fields, client records, staff identifiers, query strings or page fragments. Google processes analytics data under its own terms, potentially outside Canada. You can change your choice using Analytics preferences in the footer.

Request security documentation

Contact support@therapycrm.io with your organization name, province and the evidence you need for vendor review. Do not include client records or sensitive health information in the request. No HIPAA, PHIPA, PIPEDA or other certification is asserted by this page.