Privacy Notice | Theramie

Who we are

Theramie Ltd (company number 17044207) provides the Theramie practice-management service for therapists and their clients.

Privacy contact: admin@theramie.co.uk

Postal address: 86-90 Paul Street, 3rd Floor, London EC2A 4NE

Theramie does not currently appoint a data protection officer or UK or EU representative.

When this notice applies and who controls what

This notice covers people who visit Theramie websites, create therapist or client accounts, receive our emails, join sessions, pay invoices, connect a bank account, or whose personal data is otherwise processed through the service.

Each therapist should also provide their own privacy information for the therapy records and special-category health data they control. This notice explains Theramie's role in those workflows and Theramie-controlled processing. It does not replace the therapist's own clinical privacy notice.

In most day-to-day clinical workflows, the therapist using Theramie is the data controller for client records and Theramie acts as a data processor on that therapist's behalf. That includes client records, session metadata, notes, messages, invoice data and video-session metadata stored in the product.

Theramie is its own data controller for website and product operations, account creation and authentication, subscription billing, support, fraud prevention, operational emails and legal compliance.

When a therapist chooses to connect a bank account, Theramie is a controller for providing and securing the account-connection feature. Where imported transactions identify clients or other payers and are used as part of the therapist's practice records, the therapist determines the purpose of that processing and Theramie processes those records on the therapist's behalf.

If you are a client and want a copy, correction or deletion of therapy records, the therapist is usually the first person who must decide that request. Theramie assists them as processor.

If a therapist creates or updates a client record before that client has their own Theramie login, Theramie usually makes this notice available in the first portal invite, payment request, session link or other direct contact that brings the client into the service.

What personal data we process

Website and account data: names, email addresses, sign-in and verification records, password-vault setup data, referral codes, public profile details, subscription tier and connected-account status.
Practice and client data: client names, dates of birth, contact details, and clinical notes are stored after being encrypted by the therapist (meaning Theramie cannot read them). Availability, session schedules, messages, and consent flags entered into the platform are stored with standard encryption.
Billing and payment data: invoices, ledger entries, cash payments and refunds, Stripe customer, subscription and connected-account identifiers, and payment or refund references.
Optional open-banking data: connected institution and account names, masked account identifiers, account type and currency, transaction identifiers, amounts, dates, descriptions, merchant or category information, payment references, and payer or counterparty information where supplied by the financial institution. We also keep connection status, synchronisation timestamps and errors, and the links a therapist makes between transactions, clients and accounting records.
Video and service data: room identifiers, session join tokens, call participation events, timestamps, webhook payloads, cron execution logs and request metadata.
Browser-side data: cookies, session storage, local storage and IndexedDB data used for sign-in, referral attribution, UI preferences, device preferences and encrypted vault keys stored locally in your browser.

Where personal data comes from

Directly from you when you create an account, sign in, edit your profile, send messages, pay invoices, join sessions, choose to connect a bank account or contact us.
From a therapist using Theramie when they create or update a client record before that client has their own account or when they manage therapy administration on the client's behalf.
From financial institutions through Plaid when a therapist authorises an optional bank-account connection. Plaid provides the selected account and transaction information made available by the financial institution.
From service providers such as Supabase, Stripe, Plaid, Resend, Daily and Vercel when they send transaction data, delivery events, billing status, session events or operational logs back to Theramie.
From your browser or device when pages load, settings are saved locally or security logs are created.

How and why Theramie uses personal data

Provide the service: we use account, profile, session, messaging and billing data to run Theramie, authenticate users, manage subscriptions, provide client-hub access and deliver session, invoice and sign-in emails. For Theramie-controlled processing, the main lawful basis is contract or taking steps before a contract.
Run therapist-controlled records: where therapists use Theramie to manage therapy records, Theramie acts as processor on the therapist's instructions. The therapist is responsible for the relevant Article 6 lawful basis and any Article 9 condition for special-category data.
Payments and platform administration: we use billing and payout data to manage Theramie subscriptions, connected-account onboarding, charge handling, refunds, bookkeeping and support. The main lawful bases are contract, legitimate interests and legal obligation. Stripe may also use payment data as an independent controller for the parts of payment processing it must run under its own regulatory obligations.
Optional bank-transaction reconciliation: when a therapist connects an account, we use account and transaction data to show incoming and outgoing activity, identify possible client payments, link confirmed transactions to client and billing records, maintain matching rules the therapist has approved, and keep the related accounting trail. For the therapist's own account and use of the feature, the main lawful basis is contract. Where a transaction identifies a client or payer within therapist-controlled practice records, Theramie acts on the therapist's instructions as processor.
Security, operations and support: we use service data and logs to secure the platform, prevent abuse, diagnose incidents and improve reliability. The main lawful basis is legitimate interests.
Legal and compliance duties: we keep and use some personal data to meet tax, accounting, anti-fraud and regulatory obligations. The main lawful basis is legal obligation.

Where Theramie relies on legitimate interests, those interests are running a secure therapy-practice platform, preventing fraud and misuse, recovering fees due, maintaining accurate business records, supporting users and improving reliability without using more personal data than necessary.

Therapy records may include health and other special-category data. In normal clinical workflows, the therapist is responsible for choosing and documenting the relevant Article 6 lawful basis and Article 9 condition, and for giving any clinician-facing privacy information required for that processing. Theramie does not determine that clinical condition for the therapist; it processes that data on the therapist's instructions. The most sensitive note content is encrypted in the browser before storage.

Theramie does not currently offer AI summary or session-audio processing. If that changes, we will update this notice, the DPA and the product controls before making that feature available.

Plaid open banking

Open banking is optional and is available only when a therapist chooses to connect an account. Plaid Link handles the connection and the therapist's authentication or consent with Plaid and the financial institution. Theramie does not receive or store the therapist's online-banking username, password or other bank login credentials.

The integration uses Plaid's account-information and Transactions services. It requests up to 90 days of transaction history when an account is first connected and then synchronises changes while the connection remains active. Theramie uses this information for reconciliation only: the feature does not initiate bank transfers, run Direct Debits or provide Confirmation of Payee.

A therapist can disconnect a linked institution from Theramie. Disconnecting asks Plaid to remove the connection where possible, revokes Theramie's stored access token and stops future synchronisation. Imported transaction history and accounting records already created from it may be retained under the retention rules below so that client ledgers and financial records remain accurate.

Plaid Financial Ltd may process financial-account, connection, device and usage information for its own service, security, legal and regulatory purposes. Plaid explains that processing and the rights available directly against Plaid in its End User Privacy Policy.

When you must provide certain data

Some personal data is needed so Theramie can enter into or perform a contract with you or the therapist account you are using. For example, without account credentials, session details, billing details or payment information, Theramie may not be able to create an account, authenticate you, send security messages, run a booked session, issue an invoice or take payment.

Other fields may be optional. Where a therapist decides what client information to collect for clinical administration or record keeping, the therapist decides what is necessary for that purpose and must explain the consequences of not providing it.

Connecting a bank account and providing open-banking data is optional. A therapist who does not connect an account can continue to use Theramie's other available features, but cannot use automated bank-transaction import or open-banking reconciliation.

Who we share personal data with

We share personal data with service providers where needed to host the service, send emails, run payments, provide optional open-banking connections and support video sessions. Some providers act only on our instructions. Others, including Stripe and Plaid for regulated activities, may also act as independent controllers for the parts they run under their own obligations.

Supabase: Database, authentication, storage and background data services. Data involved: Account records, client records, session metadata, encrypted notes, billing ledgers and operational logs. Theramie uses Supabase for core application storage and access control, including row-level security policies.
Stripe: Payment processor and Stripe Connect payout infrastructure. Data involved: Therapist billing details, Stripe customer IDs, subscription data, payment intents, refunds and connected account onboarding data. Stripe handles card processing and therapist payout onboarding; Theramie stores references and billing outcomes.
Plaid: Optional open-banking account-information and transaction-data provider. Data involved: Connected institution and account details, masked account identifiers, account type and currency, transaction amounts and dates, descriptions, merchant or category information, payment references, and payer or counterparty information where the financial institution supplies it. A therapist can choose to connect an account through Plaid Link so Theramie can import transactions for payment reconciliation. Plaid also processes connection and financial-account information under Plaid's own End User Privacy Policy and regulatory obligations.
Resend: Transactional email delivery provider. Data involved: Email addresses, email content, billing notices, session reminders and sign-in links. Theramie sends account, session and billing emails from noreply@theramie.co.uk via Resend.
Daily: Video session infrastructure provider. Data involved: Session room identifiers, access tokens, timing metadata and call participation events. Theramie creates private video rooms and issues therapist/client meeting tokens through Daily APIs.
Vercel: Application hosting and scheduled job platform. Data involved: Application traffic, request metadata, scheduled email and Stripe reconciliation job execution and deployment logs. Theramie uses Vercel-hosted routes and cron jobs for operational processing.

International transfers

Some suppliers, especially payment, open-banking, hosting, email and video providers, may process personal data outside the UK or permit access to it from outside the UK. Where that happens, Theramie relies on the supplier's adequacy decision or another UK GDPR transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us if you want more detail about the safeguard used for a particular supplier.

Retention

We keep personal data only for as long as we need it for the purpose it was collected for, the therapist's instructions where we act as processor, and our legal, accounting, fraud-prevention or security obligations.

Therapist account and profile data: kept while the account is active. A therapist can start permanent account deletion from account settings. Live Theramie practice data is removed after password re-authentication, a separate one-time email code and final confirmations, subject to the provider and legal-retention limits described below.
Therapist-controlled client records, notes, messages and session metadata: kept for the life of the therapist-client relationship unless the therapist archives the relationship, erases the client's personal data while retaining minimal pseudonymous history, or permanently deletes all relationship data. Archiving only limits ordinary use and display; it is not erasure.
Billing, tax, payout and anti-fraud records: usually kept for at least 6 years after the end of the relevant financial year, and longer if a dispute, chargeback or legal hold applies.
Open-banking connections and imported transactions: access and future synchronisation stop when the therapist disconnects the institution. The unusable connection record and imported transaction history may remain with the therapist-controlled practice records for the life of the account and the usual 90-day export and deletion window after closure. Transactions linked to payments, and the minimum connection or audit information needed to explain them, may instead be kept with billing, tax and anti-fraud records for at least 6 years after the relevant financial year.
Security, authentication and operational logs: the default retention target is 12 months, shorter where feasible, and longer only if tied to an active incident or legal hold.
Referral and preference cookies: referral attribution is kept for up to 30 days, and requested video-device or interface preference cookies are kept for up to 12 months.
Browser storage: session storage, local storage and IndexedDB entries are kept until they expire, are overwritten, you sign out, reset the relevant feature, or you clear them from your browser.

Where financial or audit records must be preserved, Theramie may delete direct identifiers and keep only the minimum ledger data needed to preserve bookkeeping integrity.

Account or client deletion removes data from the live Theramie service and deletes associated application storage objects. Copies in disaster-recovery backups are protected from ordinary use and expire through the backup-retention cycle. Stripe, email, hosting, video and other providers may retain limited records where they have an independent legal, fraud-prevention, security or financial obligation.

Deletion and account closure

Therapists can archive a client without deleting data, erase personal and clinical information while retaining the client number and minimal session or accounting history, or delete all data for that therapist-client relationship. Records belonging to other participants in a shared group, and a client's separate login or relationships with other therapists, are not deleted by one therapist's instruction.

Therapists can permanently delete their own Theramie account from account settings. Theramie requires the account password, a purpose-specific one-time code sent to the verified account email, confirmation of each affected data category and a final typed phrase. Active subscriptions to Theramie are cancelled and Theramie's stored reference to a therapist's Stripe account is removed. Deleting a Theramie account does not close the therapist's separate Stripe account.

Erasure rights are not absolute. Data may be retained where processing remains necessary to comply with a legal obligation, establish or defend legal claims, prevent fraud or meet another applicable UK GDPR exception. Where retention is justified, access and use are limited to that purpose.

Cookies and browser storage

Authentication cookies: Supabase session cookies keep signed-in users logged in and allow secure account access. These are strictly necessary for the service you request.
Referral cookie: if a referral link is used, Theramie stores a referral code in an HTTP-only cookie for up to 30 days.
Device preference cookie: Theramie stores chosen camera, microphone and speaker devices, whether the camera and microphone are enabled, and background-blur settings for up to 12 months so they can be restored in later video sessions.
Interface preference cookie: Theramie may store collapsed or expanded session-list sections for up to 12 months so the hub can reopen in the state you last chose.
Browser storage: Theramie uses session storage, local storage and IndexedDB for pending verification details, UI state and locally stored encryption keys.

Theramie does not currently use behavioural advertising trackers or social-media ad pixels in the product.

Automated decision-making

Theramie does not use solely automated decision-making or profiling that produces legal or similarly significant effects on individuals. Theramie does use automated rules to verify sign-ins, enforce subscription status, send scheduled emails, process billing workflows, identify exact open-banking reference matches approved by a therapist and prevent misuse, but these are service operations rather than automated legal or similarly significant profiling decisions.

Security measures we currently rely on

Access to application data is limited through Supabase authentication checks and row-level security policies on the core tables.
Clinical notes are encrypted in the browser with AES-256-GCM before storage, and therapist vault keys are derived with PBKDF2 and stored in wrapped form.
Stripe webhook events are verified with webhook signatures before billing changes are applied.
Plaid credentials remain server-side, Plaid access tokens are encrypted with AES-256-GCM before storage, and row-level security limits therapists to their own open-banking records.
Background cron routes require a shared secret before operational jobs can run.
Sensitive service credentials are loaded from server-side environment variables rather than being shipped to the browser.
Application routes use server-side session checks and ownership validation before returning account, billing, client or session data.
Video-session credit controls and session entry links use signed tokens and server-side checks to limit unauthorised access.
Client erasure runs through service-only database functions after server-side ownership checks, and account deletion requires a current password, a short-lived one-time email code bound to the current session, and final explicit confirmations.

We describe only the controls evidenced in the product today. We do not claim automatic deletion, auditable retention tooling, mandatory two-factor authentication or formal certification unless and until those controls are implemented and documented.

Your rights and how to use them

You may have rights to access, correct, erase, restrict, object to, or ask for a copy of your personal data, and in some cases to receive it in a portable format. If a therapist controls the record, they decide how a request about therapy records should be handled and Theramie assists them as processor.

Right to object: if Theramie relies on legitimate interests for Theramie-controlled processing, you have the right to object. Tell us what processing you object to and why.

Withdraw consent: where we rely on consent, you can withdraw it at any time. This will not affect processing already carried out before the withdrawal.

How to make a request: For subject access, correction, restriction, objection, portability or erasure requests about Theramie-controlled data, email admin@theramie.co.uk or write to 86-90 Paul Street, 3rd Floor, London EC2A 4NE. We will usually need to verify identity and, where a therapist is the controller, may direct the request to that therapist so the instruction comes from the correct controller.

Therapists can also use the client-data controls and account-deletion process in Theramie. Using those controls does not prevent a person from contacting us or their therapist to exercise a data-protection right.

Complaints

If you are unhappy with how Theramie handles personal data, please contact us first so we can try to resolve the issue. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or call 0303 123 1113.