Privacy policy
Last updated 12 October 2026
THERAFYX LTD, a company incorporated in England and Wales (Company No. 15897992) with its Registered Office at Shah & Co Accountants Ltd, 1st Floor 228 Widdrington Road, Cashs Business Centre, Coventry, West Midlands, United Kingdom, CV1 4PB ("We", "Us", "Our") provides the Therafyx toolkit, a set of online tools for healthcare practitioners ("the Platform"), and the website at therafyx.com ("the Website").
This policy explains how We use personal data about the practitioners who visit the Website or hold a Therafyx account ("you"). It also explains how We handle patient information when you use a tool that involves it.
1. Two kinds of data, two roles
1.1 Your data as a practitioner. When you sign up, log in, contact Us or use the Platform, We decide how and why that data is used. We are the controller of it, and this policy covers it.
1.2 Your patients' data. Some tools (for example pre-consultation forms and exercise programmes saved to a patient) let you collect information about your patients. For that data, you or your clinic are the controller and We act only as your processor, following your instructions under Our Data Processing Agreement ("DPA"). Your patients should read your clinic's own privacy notice. Part 9 summarises what We do as processor. During early access these tools are only switched on for clinics that have signed a DPA with Us.
1.3 Tools that do not need any patient details (Rehab 3D when no patient is chosen, FlagPoint and Conditions) do not store patient data.
2. About Us
2.1 Our Data Protection Officer is Akash Sharma.
2.2 Contact: hello@therafyx.com, or by post to the address above.
2.3 We are registered with the Information Commissioner's Office (ICO).
3. What is personal data?
Personal data is any information about you that allows you to be identified, as defined by the UK GDPR and the Data Protection Act 2018 (together, "the Data Protection Legislation"). It covers obvious information such as your name and contact details, and less obvious information such as identification numbers and online identifiers.
4. Your rights
Under the Data Protection Legislation you have the right:
- to be informed about how We use your personal data (this policy);
- to access the personal data We hold about you (Part 12);
- to have inaccurate or incomplete data corrected;
- to have your data deleted (some data We must keep by law; see Part 7);
- to restrict how We use your data;
- to object to Us using your data for a particular purpose, including direct marketing;
- to withdraw consent at any time where We rely on consent;
- to data portability, where you gave Us the data and We use it under contract or consent by automated means.
We do not make decisions about you by automated means alone. If you are unhappy with how We use your data, please contact Us first. You also have the right to complain to the ICO (ico.org.uk).
5. What data We collect
| Data | How We collect it |
|---|---|
| Identity: name, profession and registration number | When you create an account |
| Contact: email address, clinic name, address, phone and clinic email | When you create an account, fill in your settings or contact Us |
| Account: login details, settings, which tools you use | When you use the Platform |
| Communications: messages, support requests and feedback | When you contact Us |
| Technical: IP address, browser, device, pages and features used | Automatically, through the Platform's logs |
We do not ask practitioners for health data about themselves.
6. How We use your data and Our lawful basis
| What We do | Lawful basis |
|---|---|
| Creating and running your account and providing the tools | Contract |
| Checking that you are a registered practitioner | Legitimate interests (keeping clinical tools for qualified professionals) |
| Support and responding to your messages and feedback | Contract; legitimate interests |
| Keeping the Platform secure, fixing faults and improving tools | Legitimate interests (a safe, working product) |
| Telling you about changes to the Platform and these documents | Contract; legitimate interests |
| Sending news and offers | Consent, or for existing users Our legitimate interests in marketing similar services (you can opt out at any time) |
We will only use your data for the purposes it was collected for, or a compatible purpose. If We need to use it for an unrelated purpose, We will tell you and explain the legal basis.
7. How long We keep your data
- Account data: for as long as your account is open, then deleted or anonymised within 90 days of closure.
- Support messages and feedback: 2 years after the matter is closed.
- Technical logs: 90 days, unless needed to investigate a security incident.
- Billing records, once paid plans exist: 6 years after the end of the financial year they relate to, as required by HMRC.
8. How We protect and store your data
8.1 Steps We take include: encryption in transit (HTTPS) and at rest; access rules in the database so each clinic sees only its own records; optional two-factor login; regular backups; keeping systems up to date; and collecting only the data We need.
8.2 We store Platform data in the United Kingdom. Some of Our suppliers are based in, or may access data from, other countries (including the USA). Where data leaves the UK, We make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy decision (including the UK-US Data Bridge).
8.3 No transmission over the internet is completely secure, so please keep your login details safe and tell Us at once if you think your account has been misused.
9. Patient data processed for you
When you use a tool that involves patient data, We:
- only process it on your documented instructions and for the purpose of providing that tool;
- store it in the UK, encrypted;
- keep it only as long as the tool needs it (pre-consultation answers are deleted 30 days after you export them to your patient record), or as set out in the DPA;
- never sell it, use it for marketing or use it to train AI models;
- use only the suppliers listed in Part 10, and tell you before adding new ones;
- help you respond to patient rights requests and tell you without undue delay about any personal data breach.
If a patient contacts Us directly about their data, We will pass the request to you.
10. Who We share data with
10.1 We use the following suppliers to run the Platform. They act as Our processors (and as sub-processors for patient data where marked).
| Supplier | What they do | Where data is held |
|---|---|---|
| Supabase Inc. | Database and login for the Platform (sub-processor for patient data) | London, UK |
| Vercel Inc. | Runs the Platform's web application | Functions in London, UK; global content delivery network |
| Resend Inc. | Sends form links and account emails (sub-processor for patient email addresses) | USA, with the safeguards in 8.2 |
| Microsoft (Microsoft 365) | Our business email | Microsoft data centres, with the safeguards in 8.2 |
10.2 We may also share data: with professional advisers (accountants, lawyers, insurers); where required by law, court order or a regulator; and with a buyer or successor if We sell or restructure Our business, who may use it in the same way as described here.
10.3 We do not sell personal data.
11. Cookies
The Platform uses only essential cookies, to keep you logged in and secure. We do not use advertising or analytics cookies.
12. Accessing your data
12.1 You can ask for a copy of the personal data We hold about you (a "subject access request") by emailing hello@therafyx.com. You can also download your clinic's data from Settings.
12.2 There is normally no charge. If a request is manifestly unfounded or excessive, We may charge a reasonable fee or refuse.
12.3 We will respond within one month. For complex requests this can be extended by up to two further months, and We will keep you informed.
13. Changes to this policy
We may update this policy, for example if the law or Our service changes. We will post the new version here and, for significant changes, email account holders.
Questions? Email hello@therafyx.com. See also our Terms of use.