Privacy Policy
What personal information do we collect and process?
When you visit, use, or interact with our services, we may collect and process personal information depending on how you engage with Thera, the features you use, and the choices you make.
Do we process any sensitive personal information?
We may process sensitive personal information only when necessary and with your consent or as otherwise permitted by applicable law.
Do we receive any information from third parties?
No. All the information we have comes directly from you when you set up your account, book sessions, or communicate with us. We do not buy, harvest, or pull data about you from outside sources.
How do we use your information?
We use your information solely to run and improve Thera, such as scheduling your sessions, keeping your account secure, and communicating important updates to us. We never sell your personal data, and everything we do with your information is strictly grounded in keeping your experience running smoothly and lawfully.
In what situations and with whom do we share your personal information?
We only share your information when it is strictly necessary to deliver our services, such as with our secure payment processors or essential technical infrastructure providers. We never sell your data or share it with advertisers. Every partner we work with is held to strict confidentiality and security standards.
How do we protect your information?
We use technical and organisational measures to safeguard your personal information from unauthorized access, use, or disclosure.
What are your privacy rights?
Depending on your location, you may have specific privacy rights, including access, correction, or deletion of your data. You can contact us for more details or to exercise your rights.
GDPR compliance statement for Thera’s contact form
At Thera, we prioritise your privacy and are committed to ensuring that your personal data is handled securely and in compliance with the General Data Protection Regulation (GDPR). Below, we outline how we collect, use, and protect your data when you interact with our contact form for therapists, corporations, hospitals, and clients.
THERA HEALING CO. W.L.L. ("Company," "We," "Our," or "Us") respects your privacy and is committed to protecting your personal data. This Privacy Policy outlines how we collect, use, maintain, protect, and disclose information when you interact with our Platform.
Nature of Platform
The Company operates a technology-driven platform that facilitates the connection between independent Service Providers (counsellors, therapists, coaches, etc.) and Users (Clients). The Company itself does not provide therapy, medical services, or professional supervision. The Company acts as a Data Processor for the clinical data hosted on our infrastructure. All therapeutic services and clinical content are owned and managed by the Service Providers (the "Data Controllers").
1. Scope and Exclusions
This Privacy Policy applies to information collected through our Platform and electronic communications related to the Platform.
This policy does not apply to:
a. Information collected offline or through third-party websites.
b. Information provided to or collected by third parties outside Our control.
2. Data Protection & Jurisdictional Compliance
We process personal data in accordance with the Kingdom of Bahrain Decree-Law No. 45 of 2021 (PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR).
For Bahraini Users: We process data under the legal frameworks of the PDPL.
For EU/EEA Users: We process data based on contractual necessity and explicit consent as required by the GDPR.
Data Controller vs. Processor: For all clinical data (session notes, therapy logs), the Service Provider is the Data Controller, and the Company is the Data Processor
3. Data Collection
We collect data through:
Direct Interaction: Registration forms, subscription details, and direct contact.
Technical Metadata: Usage details, IP addresses, and device information collected via cookies and tracking technologies to ensure platform stability.
Financial Data: Transactional data processed via our payment partners (Paypal).
Sensitive Health Data: We are committed to achieving full HIPAA-compliant technical standards and implementing a Zero-Knowledge encryption architecture. Currently, we utilize industry-standard encryption for data in transit and at rest. We will update users as these infrastructure upgrades are deployed.
4. Cookies and Tracking Technologies
We use cookies, web beacons, and similar tracking technologies to enhance User experience and monitor Platform usage (e.g., to keep you logged in or remember your preferences).
Types of Cookies: We use strictly necessary cookies for platform function and performance cookies to analyze site traffic.
User Control: You may manage your cookie preferences through your browser settings. Please note that disabling cookies may affect your ability to access certain parts of our Platform.
5. Data Residency & International Transfers
Our cloud infrastructure is hosted in the European Union (Ireland, eu-west-1).
This location satisfies Bahraini PDPL "Adequacy" requirements.
For EU/EEA users, this ensures data remains within the EEA, maintaining GDPR compliance.
6. How We Use Your Data
We use your data strictly for:
Providing and maintaining the Platform’s technical functionality.
Facilitating secure communication between Service Providers and Users.
Complying with legal obligations.
Marketing (only with your explicit opt-in consent).
7. Disclosure of Information
We do not sell your personal data. We only disclose data when:
Required by law or government request.
Necessary to provide the Platform (e.g., hosting providers like AWS, payment processors like Paypal).
Enforcing our terms or protecting our rights.
8. User Rights (GDPR & PDPL)
You have the right to:
Access, rectify, or request erasure ("Right to be Forgotten") of your personal data.
Restrict or object to processing.
Request data portability.
Withdraw consent at any time.
To exercise these rights, contact us here.
9. Data Security & Breach Notification
We implement industry-standard technical measures, including firewalls and intrusion detection systems.
Breach Notification: In the event of a security incident, we will notify the Data Controller (the Service Provider) without undue delay (within 48 hours) to ensure compliance with the 72-hour regulatory reporting window.
10. Retention
We retain data only as long as necessary for the purposes for which it was collected or as required by law. After the required retention period, data is securely deleted or anonymized.
11. Children Under 18
Our Platform is not intended for individuals under the age of 18 without verified parental consent.
12. Changes in Privacy Policy
We may update this Privacy Policy from time to time. Updates will be posted on the Platform page, and User’s continued use of the Platform indicates acceptance of the revised policy. Users are encouraged to periodically review the Privacy Policy for any changes.
14. Acceptance of these Terms
By using our Platform, You acknowledge that You have read and understood this Privacy Policy and agree to its terms.
For questions, contact us at admin@thera-online.com or WhatsApp
