TheraXPro Privacy Policy

Effective date: October 13, 2026

1. Who we are and what this policy covers

TheraXPro, Inc. ("TheraXPro," "we," "us," or "our") is a Georgia nonprofit organization recognized as tax-exempt under Section 501(c)(3) of the Internal Revenue Code. We provide educational and professional-support tools for rehabilitation clinicians, students, educators, and related professionals, including home exercise programs, educational resources, outcome measures, clinical calculators, and templates.

This Privacy Policy explains how we collect, use, disclose, and retain personal information through our public website, signed-in applications, shared program pages, subscriptions, and related communications (collectively, the "Platform"). It applies to visitors, account holders, subscribers, people who access shared materials, and recipients of our communications, including people who do not have an account.

Our Site Agreement separately governs permitted use, clinical responsibilities, and subscription terms. This policy describes our information practices; it does not authorize prohibited use, establish a clinical relationship, or constitute authorization for recurring charges. Independent websites and services have their own privacy notices.

2. Privacy at a glance

• We use personal information to provide the Platform, administer accounts and subscriptions, deliver requested communications, maintain security, and improve our services.
• Stripe processes subscription payments. We receive information needed to administer billing, subscriptions, invoices, and related transactions.
• Twilio services process recipient phone numbers and email addresses for delivery and associated operational reporting. Contact information is handled separately from saved exercise-program content, but delivery records can still associate a recipient with a message or link.
• Do not submit protected health information (PHI) or patient-identifying clinical content. The Platform is not a patient-record system or a service offered for HIPAA-compliant clinical messaging.
• Shared program links may be accessible to anyone who obtains them.
• Our public website uses Squarespace Analytics, and Squarespace promotional email campaigns measure opens and clicks.
• We do not sell personal information or disclose it for cross-context behavioral or targeted advertising.
• Contact Support@TheraXPro.com for privacy questions or requests.

This summary supplements the details below.

3. Information we collect

Account and professional profile information

We collect information you provide when creating or updating an account, including your name, email address, account identifiers, authentication information, and any professional or organizational information you choose to provide. We maintain preferences, saved settings, and account status needed to operate your account.

Permitted program content and activity

We process exercise selections, non-identifying instructions, templates, bookmarks, educational materials, permitted tool inputs, and other content you create or save. We also process activity needed to save or share materials, maintain security, and troubleshoot problems. Patient-identifying content is prohibited as explained in Section 4.

Subscription, billing, and authorization information

We process subscription plans, billing intervals, trial eligibility and history, prices, billing dates, payment and subscription status, transaction references, invoices, cancellations, refunds, and payment disputes. Billing information may include subscriber contact information and company billing details supplied for a company-addressed invoice.

We maintain records of Site Agreement acceptance and recurring-payment authorization, including accepted versions and dates or timestamps. We may process incomplete checkout records to resolve interrupted transactions and prevent duplicate enrollment or unauthorized activity.

Recipient contact and delivery information

When an account holder initiates an available SMS or email delivery, we and the relevant providers process the destination phone number or email address and information needed for delivery. This can include the message or link, sender information, timestamps, provider identifiers, delivery or failure status, and replies where supported. Consent, unsubscribe, opt-out, and suppression information may also be processed.

The initiating user may supply the recipient's contact information. Recipient information is personal information even when the recipient has no TheraXPro account. Processing does not necessarily end when a message is sent; see Sections 6 and 9.

Support and other communications

We collect information you send in support requests, feedback, surveys, or other communications, including your contact details and the content of your request. Do not send passwords, full payment-card details, PHI, or patient-identifying attachments.

Technical and usage information

Our websites, applications, and supporting services may collect IP addresses, browser and device characteristics, approximate location inferred from IP address, accessed pages or features, referring pages, timestamps, and error, access, or security logs. Shared-page access may generate this information even without an account. Cookies and email engagement information are described in Section 8.

Information from service providers

We receive operational information from providers, including Stripe payment and subscription status, communications delivery results, and hosting or security information. These records support operations and are not proof that a recipient read a message or completed prescribed exercises.

4. Patient information, clinical use, and shared programs

TheraXPro provides educational and professional-support tools. It does not provide medical care, establish a provider–patient relationship, or serve as an electronic health record, electronic medical record, or clinical documentation repository.

Do not enter PHI or patient-identifying information into saved program content, templates, outcome-measure entries, free-text fields, uploads, support requests, billing descriptions, or analytics inputs. Prohibited content includes patient names, medical-record numbers, contact details, and diagnoses, treatment information, or other clinical details connected to an identifiable individual. Do not place identifying clinical details in message subjects, message bodies, attachments, or URL text. Information may identify someone through a combination of details even when their name is omitted.

Destination contact information is processed when designated delivery fields are used. Those fields are not permission to store patient records or disclose PHI. Users must comply with the Site Agreement, applicable law, their organization's requirements, and required recipient consent. Keep patient records in appropriately authorized systems.

Recipient contacts are handled separately from saved HEP content. However, a message, link, delivery record, or combination of information may connect a recipient with care or clinical content. Separate storage, a generic message, or a difficult-to-guess URL does not by itself establish that information is outside HIPAA or another privacy law.

TheraXPro does not offer its ordinary SMS or email delivery features as HIPAA-compliant clinical messaging or a confidential patient-record service. Do not use them for communications involving PHI. This restriction does not determine every legal obligation that may arise from actual processing.

Shared exercise programs and other materials may be accessible to anyone who obtains their link. Recipients may forward links, copy materials, or retain downloaded or printed content. Do not assume a shared link is private merely because it is not publicly listed. Do not include confidential patient information in shared materials.

If you believe prohibited information was submitted, stop further submission and contact Support@TheraXPro.com promptly. Describe the issue without repeating the sensitive information. We will assess the report and take appropriate action, which may include restricting access, removing affected content, and addressing applicable notification or other legal obligations. Our submission restriction does not guarantee that accidental submissions can never occur.

5. How we use information

We use information as relevant to your interaction with the Platform to:

• Create, authenticate, maintain, and support accounts.
• Provide tools, save permitted content, and apply preferences.
• Administer subscriptions, trials, billing, invoices, refunds, and cancellations.
• Document agreements and payment authorization, resolve checkout interruptions, and prevent duplicate or unauthorized transactions.
• Send necessary account, security, service, and transaction communications.
• Deliver requested messages and links and maintain consent or communication preferences.
• Respond to support requests, feedback, and privacy requests.
• Diagnose problems, maintain accessibility and reliability, and understand Platform use.
• Detect fraud, misuse, unauthorized access, or violations of our agreements.
• Maintain organizational and accounting records, comply with legal obligations, and establish or defend legal rights.
• Send optional news or promotional communications where permitted and subject to opt-out choices.

Contact information supplied solely for program delivery is not used to enroll recipients in unrelated promotional email or SMS lists.

We may use aggregated or appropriately de-identified information to improve services and report nonprofit impact. Removing a name alone does not necessarily de-identify information. This provision does not authorize submission of prohibited patient information.

Where applicable law requires a legal basis, we rely on the basis appropriate to the activity, including performing an agreement, complying with legal obligations, legitimate operational interests where permitted, or consent. This policy is not blanket consent to every form of processing.

6. SMS, email, and communication choices

We use Twilio services for SMS and email delivery. Providers process destination contacts, message content or links, routing information, timestamps, delivery results, and related records. Twilio also handles recipient contact and delivery information for statistical and analytical reporting associated with communications. This reporting is separate from saved program content, but it should not be understood as anonymous merely because contacts are stored separately.

SMS delivery involves telecommunications carriers, and email delivery involves recipient mail providers. These providers may retain information for delivery, security, abuse prevention, support, and legal purposes under their applicable practices. See Twilio's Privacy Notice. Our provider agreements govern processing performed on our behalf; providers may also process information independently for their own lawful purposes.

Users initiating delivery must have the required recipient consent, verify the destination, identify the sender appropriately, and honor communication choices. Consent to receive a requested program message does not authorize unrelated promotions. Do not submit sensitive clinical information through these features.

For SMS sent through a reply-enabled number, recipients can reply STOP to opt out. Recipients may also contact Support@TheraXPro.com for assistance with messaging preferences. Message and data rates may apply. Frequency depends on requested communications.

Optional promotional emails include an unsubscribe mechanism. Unsubscribing does not cancel a subscription or delete an account. Necessary account, billing, security, or service emails may continue where permitted. This does not authorize continued SMS after an applicable SMS opt-out. Limited suppression records may be retained to honor communication choices.

7. Stripe payments and billing information

We use Stripe for subscription payments and related billing services. We share subscriber and transaction information needed to create and administer subscriptions, such as account association, contact and billing information, selected plan, price, and transaction references. Company billing information supplied for an invoice is processed for invoicing and related administration.

Payment credentials submitted through Stripe-hosted payment interfaces are handled by Stripe. TheraXPro receives subscription and transaction records needed for administration, which may include customer or subscription identifiers, billing information, limited payment-method summaries, invoices, receipts, and payment status. Do not provide full card details or card security codes in TheraXPro content or support requests.

Stripe also processes information for payment services, security, fraud prevention, and legal compliance. Depending on the activity, it may act on our behalf or independently. Banks, card networks, digital wallets, or other selected payment services also process information needed to complete transactions.

See Stripe's Privacy Policy. Optional services such as Stripe Link may have additional terms and notices. Subscription prices, trials, renewal, cancellation, and refunds are addressed in subscription disclosures and the Site Agreement. This policy does not authorize a charge.

8. Cookies, analytics, email tracking, and external content

Essential technologies and public website analytics

Cookies, local storage, and similar technologies support authentication, preferences, security, and basic website functions. Our public website and signed-in tools may have different technologies and settings.

Our public website uses Squarespace Analytics, including activity logging, to understand visits and usage. The website cookie banner offers Accept and Decline choices; non-essential cookies are configured as restricted pending the relevant choice. Declining non-essential cookies does not necessarily stop essential security processing or ordinary server access logs.

Promotional email tracking

We use Squarespace Email Campaigns for promotional communications. These emails measure opens and link clicks, as well as delivery and unsubscribe information. Email engagement measurement can use tracking pixels and tracked links and can associate engagement with a recipient's email address. You can stop future promotional emails using the unsubscribe mechanism. Website cookie preferences do not necessarily control email tracking.

Open and click reports are approximate: mail-provider privacy tools, automated scanning, and other factors may affect them. We do not treat these reports as proof that someone read an email or completed an exercise. See Squarespace's Privacy Policy.

Application and delivery records

Signed-in tools and shared program pages generate technical and operational records for functionality, security, and troubleshooting. SMS and email services also generate delivery, failure, consent, and suppression records. These records are distinct from optional open/click tracking and are not necessarily removed by declining website cookies.

Embedded videos, equipment links, and other services

Embedded YouTube videos, Amazon equipment or affiliate links, payment interfaces, and other external services may cause the relevant provider to receive technical information, such as an IP address or referring page, and use its own cookies or similar technologies. Data may be transmitted when embedded content loads or when you interact with a service, depending on implementation. External providers' privacy notices govern their independent processing. See Google's Privacy Policy and Amazon's Privacy Notice.

Affiliate links may allow a provider to attribute a purchase and pay TheraXPro a commission. This does not authorize users to include patient-identifying information in links or content.

Your technology choices

Use available website cookie controls and browser settings to manage cookies. Blocking essential technologies may affect login or other functions. Applicable consent, opt-out, and privacy-preference requirements govern the technologies we use. Our policy is not to use personal information for cross-context behavioral or targeted advertising.

9. When we disclose information

We disclose relevant information in the following circumstances:

Operational providers. Providers support hosting, storage, authentication, payments, communications, security, support, analytics, and accounting. Core providers include Squarespace for the public website and promotional campaigns, application cloud providers, Stripe for billing, and Twilio services for communications. Provider roles and obligations vary. Not every provider receives every category of information.

Your instructions and sharing choices. Recipients and external services receive information needed when you share a program, use an integration, or interact with external content. Sharing a link can make content available outside your account.

Legal, security, and safety purposes. We may disclose information as required by law or valid legal process, or as reasonably necessary to address fraud or security incidents, protect rights or safety, or establish or defend legal claims, subject to applicable law.

Organizational transitions. Relevant information may be disclosed or transferred in a merger, reorganization, transfer of operations, or similar transaction, subject to applicable protections and required notice.

We do not sell personal information or disclose it for cross-context behavioral or targeted advertising. Mobile numbers and SMS consent records are not provided to third parties for their own marketing. Necessary disclosures for delivery, security, or opt-out enforcement remain subject to the purposes described above.

10. Retention, cancellation, and deletion

We retain personal information for as long as reasonably necessary for the purposes described in this policy. We consider the type and sensitivity of information, the purpose of processing, account status, security needs, and applicable tax, accounting, dispute-resolution, and legal obligations.

Cancelled subscriptions and inactive accounts. Cancelling a subscription does not automatically delete your account, settings, or saved permitted content. We may retain this information to support account administration and possible reactivation, subject to the purposes and retention criteria described above. We do not specify a fixed account-deletion schedule or guarantee indefinite preservation of accounts, content, or shared links. You may request deletion as described in Section 12. We may also remove accounts or content under the Site Agreement. Certain billing, authorization, security, or legally required records may remain after account removal.

Delivery and provider records. Destination contact information and message-related information may remain in delivery systems, logs, or provider records after sending. Keeping these records separate from saved program content does not mean they are deleted immediately or cannot be associated with a communication. Retention varies by system, provider, settings, and purpose. We do not promise immediate deletion of recipient contacts. Limited consent, unsubscribe, and suppression records may be retained to avoid unwanted communications.

Billing and other justified records. Subscription cancellation or account deletion does not necessarily require immediate removal of invoices, agreement acceptance, payment authorization, trial history, fraud-prevention records, or information needed for legal obligations or disputes.

When information is no longer needed, we delete it or appropriately de-identify it. Backup copies may remain until their normal retention cycle ends, or longer where preservation is legally required. We cannot remove copies independently held by recipients of shared materials or providers acting under their own obligations.

Cancellation and deletion are separate processes. Use the available subscription-management controls to cancel recurring billing, or contact support for assistance. When requesting deletion, tell us if you also want to cancel an active subscription so both requests can be addressed. Do not assume deleting content or sending a privacy request has automatically cancelled recurring charges.

11. Security

We use reasonable technical and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No online transmission or storage system can be guaranteed completely secure. These safeguards do not make the Platform a patient-record system or authorize submission of PHI.

Use a unique password, protect your credentials, sign out on shared devices, and promptly report suspected unauthorized account activity. Do not send passwords or sensitive information to support. If an incident requires notification under applicable law, we will provide the required notification.

12. Your choices and privacy requests

You may update account information through available settings or contact support. You may unsubscribe from optional promotional email and request assistance with other communication preferences as described above.

Depending on your location, the activity, and the laws applicable to TheraXPro, you may have rights to request access, correction, deletion, a portable copy, restriction of processing, objection to processing, withdrawal of consent, or an appeal of a privacy-request decision. Rights and exceptions vary; not every privacy law applies to every person or activity.

Email Support@TheraXPro.com with the subject Privacy Request. Describe your request and identify the relevant account or communication without unnecessary sensitive information. Recipients without accounts may also contact us. We may request information reasonably needed to verify identity or an authorized agent's authority. We will respond as required by applicable law and explain relevant limitations or refusals. Where applicable, you may appeal to us or contact the relevant regulator. We will not unlawfully discriminate against you for exercising applicable rights.

Withdrawal of consent does not undo prior lawful processing or require deletion of information retained on another lawful basis. Requests about information independently handled by Stripe or another provider should also be directed to that provider.

13. Children and account eligibility

Subscriber accounts are intended for adults and are not directed to children under 18. We do not knowingly offer subscriber accounts to children under 18. Contact us if you believe a child has provided personal information through an account or communication so we can assess and take appropriate action.

A clinician or parent may share non-identifying exercise materials for use with a minor. This does not authorize a minor's subscriber account or submission of identifying patient information about a child. Access to shared pages may generate technical information as described above.

14. International access

TheraXPro operates from the United States. Information may be processed in the United States and other locations where our providers operate. Privacy laws may differ from those where you live. Where applicable law requires safeguards for international transfers, those requirements apply. This policy does not waive applicable privacy rights.

15. Changes to this policy

We may update this policy as our services, practices, or legal requirements change. We will identify the effective date of the approved update. For material changes, we will provide notice through the Platform, email, or another appropriate method and obtain consent where required by applicable law.

16. Contact

TheraXPro, Inc.
Georgia nonprofit recognized as tax-exempt under Section 501(c)(3).
Email: Support@TheraXPro.com
Website: www.theraxpro.com