Data processing agreement

    Many therapy centres want a signed DPA on record, for their CA, legal advisor or their own files. Send one email and we send back a DPA to review and sign.

    Last reviewed 7 September 2026

    Request your DPA

    Email founders@theraflow.in with your centre name and registered address. We respond within one business day with the current DPA, ready for your review and e-signature.

    Email DPA request

    What's in our DPA, at a glance

    The DPA is structured around DPDP Act 2023 requirements. Here is the substance of each section so you know what you are signing.

    Roles

    You (the therapy centre) are the data fiduciary. Theraflow is the data processor: we process patient data on your instructions.

    Data categories

    Patient PII, sensitive health data (diagnosis, session notes), children's data, parent/guardian contact, and billing records. Where the centre connects WhatsApp: its WhatsApp Business Account ID, phone number ID, business portfolio ID, message template metadata and delivery status (Meta Platform Data).

    WhatsApp and Meta Platform Data

    Used solely to send transactional messages on the centre's behalf and show delivery status. Never sold, shared, combined across centres, or used for advertising or model training. Access tokens are stored encrypted and deleted on disconnect; Platform Data is retained only while the connection is active plus the backup window below.

    Processing purposes

    Only what is required to operate Theraflow for you: scheduling, attendance, notes, reports, billing, parent communication.

    Sub-processors

    Listed publicly at theraflow.in/sub-processors, including Meta Platforms (WhatsApp Business Platform) for centres that connect WhatsApp. 30-day notice before any new sub-processor touches Customer Data.

    Security

    AES-256 at rest, TLS 1.3 in transit, per-tenant isolation, RBAC with MFA, audit logging, vulnerability scanning.

    Breach notification

    Within 72 hours of becoming aware, to the affected centre and India's Data Protection Board, per DPDP Act 2023.

    Data subject rights

    We help you respond to access, correction, and deletion requests from patients or their guardians within statutory timelines.

    Data residency

    Customer Data is stored in AWS Mumbai (ap-south-1). No replication outside India.

    Audit rights

    One audit per year, with reasonable notice and scope, plus immediate audit access in the event of a breach.

    Return / deletion

    60-day export window post-termination, then irreversible deletion from primary storage and backups within a further 60 days.

    Liability for data breaches

    Negotiable for signed agreements; commercial caps apply per the MSA or Terms of Service.

    FAQ

    Do I need a DPA if I am a small centre?

    The DPDP Act requires data fiduciaries (you) to have processing arrangements with their processors (us). A DPA is the standard way to record that. Whether you sign one is your call. We offer it to every customer.

    Can I negotiate clauses?

    Yes. Send your redlines along with the request and we will turn them around quickly. For enterprise centres we are happy to use your template DPA instead.

    Is there a cost?

    No. The DPA is part of being a Theraflow customer.

    Do you sign Standard Contractual Clauses (SCCs) for international transfers?

    Theraflow's primary data is stored in India. Some sub-processors (Clerk, Anthropic, Google) are based outside India. We can add an international transfer addendum based on the model SCCs if your legal team requires it.

    For all DPA-related questions, write to founders@theraflow.in.