Security and privacy information for your practice review

Access and accountability

TherapyCRM provides role-based access scoped to the practice and branch, multi-factor authentication, short staff sessions and audit trails. Your practice controls staff responsibilities and must review access when roles change or people leave.

Ask to see how the roles you actually use handle client records, documentation approval, billing and family sharing. A feature list does not establish that a particular configuration meets your obligations.

Where TherapyCRM data is stored

TherapyCRM data is stored in Canada. The production application, database, uploaded files and backups run on Google Cloud in Toronto, and the session cache is in Canada.

• A few services process limited data outside Canada to do their job: email and text messages (Twilio SendGrid), payments (Stripe), optional AI features (OpenRouter, with models from OpenAI and Anthropic) and app notifications and updates (Expo) in the United States; Apple push notifications, Google reCAPTCHA bot checks on public forms (and on sign-in where it is turned on), optional Google Analytics on public pages and a YouTube video on the offer page that loads only when a visitor presses play, on those providers’ global networks.
• AI features replace the identifiers of people already in the practice’s records, and identifier fields in record data, before sending text; other details a user types, such as names, dates of birth, addresses or email addresses that do not match a record, are sent as typed, as is a phone number or email address a user types for the assistant to set or check and the details of a new lead a user asks it to create; images, such as scanned pages and photos uploaded to import records, are sent as they are.
• A Google calendar or other service that a practice chooses to connect keeps its copies under that provider’s own terms and locations.
• Microsoft Outlook and Microsoft 365 calendar connections are not yet enabled.

Copies made before production moved to Canada on October 2, 2026 are being retired: a frozen copy of the database in the United States (Neon on Amazon Web Services) is kept as a rollback source until about November 1, 2026, and backup exports made in Germany are deleted under a 30-day rule about November 1, 2026 and cannot be recovered after about November 8, 2026. Testing and pre-release environments run in the United States (Neon) and Germany (Hetzner) and can hold copies of production records.

TherapyCRM is available to practices in Canada outside Quebec. Review the subprocessor list, the privacy policy and service terms as part of your assessment, and check the optional features you intend to enable against your own requirements.

Records, retention and device use

The platform includes encrypted storage and transport, retention controls and audit functionality. Offline session collection stores an encrypted draft on the device and requires later synchronization. Practice policies should address device access, loss, shared devices and completion of synchronization.

Ask for current evidence on backup, recovery, retention, export and offboarding that applies to your agreement. Do not infer a recovery commitment or a certification from the presence of technical controls.

Marketing analytics are separate from clinical work

Optional TherapyCRM visit tracking and Google Analytics run only on an explicit list of public marketing pages after consent.

• Declining analytics leaves those pages usable.
• Authentication, checkout, portal, private ticket and clinical screens do not load marketing analytics.

TherapyCRM visit tracking uses a random browser identifier to measure repeat visits, public page paths, campaign labels and, with the separate ad-measurement choice, ad-click identifiers, broad device and browser categories, language, timezone and page interactions. We retain this history for up to 90 days and may connect it to a promo inquiry after you verify its email address, including the linked practice signup and current customer status.

We do not store raw IP addresses, full referrers, form contents, clinical records or private links in this visit history. It identifies a browser, which may be shared, rather than proving who clicked an ad.

Google receives the public page path, defined marketing interaction names, approved campaign labels and a recognized search-engine origin.

• If you also allow ad measurement, we retain Google click identifiers and connect your Google browser identifier to verified promo, trial and first paid-subscription outcomes for up to 90 days.
• We send the outcome, time and, for a payment, amount and currency from our server; Google tags still do not run on private screens.

Advertising personalization remains off.

• We do not send Google form fields, email addresses, client records, staff identifiers, private links, arbitrary query strings or page fragments.
• Google processes analytics data under its own terms, potentially outside Canada.

Use Analytics preferences in the footer to change your choice. Withdrawing stops optional collection and requests deletion of the current browser’s TherapyCRM visit history; a network failure can delay deletion until your next public-page visit.

Request security documentation

Contact support@therapycrm.io with your organization name, province and the evidence you need for vendor review. Do not include client records or sensitive health information in the request. TherapyCRM holds no privacy or security certification.

Frequently asked questions