Effective Date: April 1, 2026.
Last Updated: March 22, 2026.

1. Introduction

TheraFiles.ai (“TheraFiles”, “we”, “us”, or “our”) provides practice management software designed for mental health professionals, including psychiatrists, psychologists, psychotherapists, counsellors, and mental health clinics or organisations.

This Privacy Policy explains how we collect, use, store, disclose, and otherwise process personal data through our website, our macOS and iOS applications, our licensing and support infrastructure, and related services.

Because TheraFiles is designed for use in mental health practice, the Services may involve the processing of highly sensitive information, including health-related and clinical data entered by professional users. We therefore aim to apply safeguards appropriate to the nature and sensitivity of the data processed.

2. Who We Are

For account, website, subscription, licensing, support, and business administration data, the data controller is:

CureClass | Dimitrios Papadimitriadis
11-15 Aristotelous st., Athens 104 32, Greece
support @ therafiles.ai
therafiles.ai

If you are a patient or client whose therapist, psychiatrist, psychologist, psychotherapist, counsellor, or clinic uses TheraFiles, that professional or organisation is generally the data controller of your clinical data, and TheraFiles generally acts as a processor on their behalf. (EUR-Lex)

3. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

• the TheraFiles website;
• the TheraFiles macOS and iOS applications;
• account registration and authentication;
• licensing, subscription, renewal, and billing workflows;
• the Storage add-on;
• the Email/WhatsApp Reminders add-on;
• support and account-related communications;
• the application API and licence validation infrastructure;
• AI-assisted features made available within the Services.

This Privacy Policy does not replace any privacy notice that a therapist, clinic, or organisation may provide directly to its own patients or clients.

4. Categories of Personal Data We Process

Depending on how the Services are used, we may process the following categories of personal data.

4.1 Account and professional data

• full name;
• email address;
• telephone number;
• professional title;
• practice, clinic, or organisation name;
• country;
• preferred language;
• login, authentication, and account security data.

 

4.2 Licensing, subscription, and billing data

• licence type and status;
• subscription details;
• renewal dates;
• selected add-ons;
• billing address;
• VAT or tax-related information;
• payment status;
• transaction and invoicing metadata.

 

4.3 Technical and usage data

• IP address;
• device and operating system information;
• app version;
• authentication logs;
• security logs;
• API usage logs;
• operational diagnostics;
• troubleshooting data.

 

4.4 Practice management and communication data

• appointment details;
• reminder delivery status;
• recipient email addresses and phone numbers used for reminders;
• invoices and reimbursement certificates;
• collaborator identities, permissions, and access roles.

 

4.5 Clinical and special category data

Where entered, uploaded, imported, dictated, or otherwise processed by the professional user, TheraFiles may process highly sensitive personal data, including:

• notes;
• session records;
• clinical summaries;
• treatment plans;
• referral letters;
• psychometric data;
• mental health and other health-related information.

Under the GDPR, data concerning health is a special category of personal data requiring enhanced protection.

4.6 AI-related processing data

When a user chooses to use AI-assisted functionality, selected data may be processed in order to generate:

• draft clinical summaries;
• draft treatment plans;
• draft referral letters;
• structured clinical or administrative drafting outputs.

 

5. How We Collect Personal Data

We collect personal data:

• directly from users when they register, subscribe, purchase, renew, contact us, or otherwise use the Services;
• when users enter, upload, dictate, import, organise, or share data in the app;
• when users activate or use add-ons;
• through authentication, security, API, and operational logs;
• through customer support, service notices, and account communications;
• through payment and renewal workflows.

 

6. Purposes of Processing

We process personal data for the following purposes:

• to create and manage accounts;
• to issue, validate, renew, suspend, and manage software licences;
• to provide the core software and any purchased add-ons;
• to provide secure backup functionality where the Storage add-on is enabled;
• to send appointment reminders by email and/or WhatsApp where enabled;
• to support sharing and collaboration between authorised users;
• to generate invoices and reimbursement-related documents;
• to provide AI-assisted drafting tools;
• to maintain security, prevent fraud, detect abuse, and protect service integrity;
• to provide support and account-related assistance;
• to send service notices, renewal notices, and other essential communications;
• to comply with legal, tax, accounting, and regulatory obligations;
• to establish, exercise, or defend legal claims;
• to enforce our contractual rights and terms.

 

7. Legal Bases for Processing

Where the GDPR applies, we rely on one or more of the following legal bases:

• performance of a contract, where processing is necessary to provide the Services, licences, add-ons, support, or related functionality requested by the user;
• compliance with a legal obligation, where processing is necessary to comply with tax, accounting, security, or other legal requirements;
• legitimate interests, including service security, fraud prevention, system integrity, customer support, and the reliable operation and improvement of the Services, except where such interests are overridden by applicable rights and interests;
• consent, where consent is required under applicable law.

Where health or clinical data is processed through the platform, that processing is generally carried out by the relevant professional user or organisation acting as controller, while TheraFiles processes such data on their behalf under applicable contractual arrangements.

8. Apple Calendar Integration

TheraFiles allows users to create, update, and delete appointment events directly in Apple Calendar using Apple’s native EventKit framework — no external API or server communication is involved.

• All calendar operations happen locally on the device with the user’s explicit permission to access calendar data.
• TheraFiles does not store, transmit, or sync any Apple Calendar information to external servers — all event data remains fully within the user’s Apple ecosystem, including Calendar and iCloud.
• Users can revoke calendar access at any time through iOS/macOS system settings, which immediately prevents further event changes from the app.

 

9. Google Calendar Data Sync

TheraFiles accesses Google Calendar data to create, update, and delete appointment events on the user’s selected calendar.

• The app stores only the OAuth refresh token in the user’s iCloud Keychain and the selected calendar ID/name. No calendar data is stored on any TheraFiles server.
• All Google Calendar API communication happens directly between the user’s device and Google’s servers.
• Users can disconnect Google Calendar at any time from the app’s settings, which deletes all stored tokens.
• TheraFiles’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

 

10. Controller / Processor Roles

10.1 We act as controller for:

• website usage data;
• account registration data;
• licence, subscription, and billing data;
• support communications;
• business administration data;
• security, authentication, and operational logs relating to our own infrastructure and Services.

 

10.2 We act as processor for:

• patient or client records;
• clinical notes and documentation;
• appointment and reminder-related data processed on behalf of the professional user;
• files, records, and content stored by professional users in the application.

 

11. Where Data Is Stored and Processed

Based on our current infrastructure configuration:

• data entered into the application is stored within the application environment;
• where the Storage add-on is enabled, backup data is stored using IDrive® infrastructure located in Frankfurt, Germany;
• licence hosting and the application API are hosted on Leaseweb® infrastructure located in Amsterdam, the Netherlands;
• WhatsApp-related communications are provided through Meta® infrastructure in Ireland;
• AI-assisted features are provided using Mistral® infrastructure located in Paris, France, as configured for the Services.

 

We design our infrastructure so that personal data is intended to be hosted and processed within the European Union / European Economic Area.

11.1 International Transfers

Based on our current service architecture and provider configuration, we do not intend to transfer personal data outside the European Union / European Economic Area. If that changes, we will update this Privacy Policy and, where required, implement appropriate safeguards in accordance with applicable law. The GDPR framework for international transfers and controller/processor obligations is set out in the Regulation and related EU implementing materials.

12. AI-Assisted Features

TheraFiles includes AI-assisted functionality intended to reduce administrative burden and support clinical workflows.

When a professional user chooses to use these features:

• selected data may be processed for the purpose of generating draft outputs;
• outputs are generated automatically and may be inaccurate, incomplete, or inappropriate in part;
• all AI-generated material must be reviewed, verified, and approved by the responsible professional before use;
• AI output does not replace professional judgment, diagnosis, treatment responsibility, legal review, or regulatory compliance obligations.

TheraFiles does not use customer clinical files, notes, or records to train general-purpose AI models unless expressly agreed in a separate written agreement.

13. Reminders and Communications

Where the relevant add-on is enabled, TheraFiles may send appointment reminders or related communications by email and/or WhatsApp on behalf of the professional user.

The professional user remains solely responsible for:

• the lawfulness of the communication;
• the accuracy of recipient contact details;
• ensuring that reminder wording is appropriately discreet and proportionate;
• obtaining any necessary permissions, instructions, or consents under applicable law, confidentiality duties, and professional obligations.

 

14. Data Sharing

We do not sell personal data.

We may share personal data only where necessary and proportionate with:

• hosting and infrastructure providers;
• backup and storage providers;
• API and licence hosting providers;
• email and reminder delivery providers;
• Meta® for WhatsApp delivery where enabled;
• AI providers used to deliver AI-assisted functionality;
• payment processors and invoicing-related service providers;
• legal, tax, audit, or professional advisers where necessary;
• competent authorities, regulators, courts, or law enforcement where disclosure is required by law or legally binding process;
• successors or counterparties in the event of a merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality and lawful handling.

 

15. Data Retention

Unless a longer retention period is required by law:

• data associated with an active licence or add-on is retained for the duration of the active subscription or licence term;
• where a licence or the Storage add-on expires, associated stored data may be retained for up to one (1) month after expiry;
• during that period, the user may be notified by email about pending deletion;
• after that period, the relevant data is intended to be permanently deleted, subject to standard technical deletion processes and any minimal residual records or logs that must be retained for security, fraud prevention, audit, accounting, tax, or legal compliance purposes.

Users are solely responsible for exporting any data they wish to preserve before expiry and deletion.

16. Security Measures

We apply technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or misuse, including where applicable:

• encryption in transit;
• backup encryption;
• authentication and access controls;
• role-based permissions;
• security logging;
• infrastructure hardening;
• restricted administrative access;
• confidentiality obligations;
• incident response processes.

The GDPR requires appropriate technical and organisational measures, and the HIPAA Security Rule similarly requires administrative, physical, and technical safeguards for electronic protected health information where HIPAA applies.

17. Data Subject Rights

Where the GDPR applies, individuals may have rights including the right to:

• be informed;
• access their personal data;
• request rectification;
• request erasure in certain circumstances;
• request restriction of processing;
• object to certain processing;
• request data portability where applicable;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

The European Commission publishes guidance on these rights and on the information that must be given to individuals under EU data protection law. (European Commission)

If you are a patient or client whose therapist or clinic uses TheraFiles, requests relating to clinical records should generally be directed first to that therapist, clinic, or organisation.

18. Direct Distribution

TheraFiles may be distributed directly by us rather than exclusively through a third-party app marketplace. Where this applies, we process the personal data necessary to provide downloads, activation, updates, licence validation, renewals, support, and related services.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect technical, legal, operational, or business changes. Where appropriate, we will provide notice through the website, the application, or email.

20. Contact

For privacy-related questions or requests, contact:

CureClass
11-15 Aristotelous st., Athens 104 32, Greece
support @ therafiles.ai
therafiles.ai