Privacy Policy

TheraConnect ("we", "us", or "our") is committed to protecting your privacy and the privacy of the children and families we serve. This Privacy Policy explains how we collect, use, store, and share your information when you use our platform at www.theraconnect.org and any related services. By using TheraConnect, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the platform immediately.

We collect the following types of information: Personal Information (provided by you): • Full name, email address, phone number • Child's name, date of birth, age, diagnosis, and areas of concern • Location, timezone, and availability preferences • IEP documents, assessment reports, and medical records you upload • Professional credentials and qualifications (for therapists) • Government-issued ID for identity verification (therapists) • Payment and billing information Automatically Collected Information: • Device type, browser, operating system • IP address and general location data • Pages visited, features used, and time spent on the platform • Cookies and similar tracking technologies

We use the information we collect for the following purposes: • To create and manage your account • To match families with appropriate therapists based on needs, location, and availability • To facilitate communication between parents and therapists • To process payments and issue receipts • To verify therapist credentials and conduct background checks • To track therapy progress and generate reports • To send important notifications about your account, sessions, and platform updates • To improve our platform, services, and user experience • To comply with legal obligations and enforce our Terms of Service • To detect, prevent, and address fraud, security issues, or technical problems

TheraConnect takes children's privacy very seriously. Our platform is used by parents and therapists on behalf of children — children do not directly create accounts or interact with the platform. We collect information about children (such as name, age, diagnosis, and therapy progress) solely for the purpose of providing therapy services and tracking developmental progress. This information is: • Only accessible to the child's parent/guardian and their assigned therapist(s) • Never sold to third parties • Never used for advertising or marketing purposes • Stored securely with encryption at rest and in transit • Deleted upon request by the parent/guardian We comply with the Nigeria Data Protection Regulation (NDPR) and follow best practices aligned with international standards for children's data protection.

We do not sell your personal information to anyone. We may share your information only in the following circumstances: With Therapists: When you are matched with a therapist, we share relevant information about your child's needs, diagnosis, and therapy goals so they can provide appropriate care. With Payment Processors: We share necessary billing information with our third-party payment processors (e.g., Paystack, Flutterwave) to process transactions securely. We do not store your full payment card details on our servers. With Service Providers: We may share limited data with trusted service providers who help us operate the platform (e.g., cloud hosting, email delivery, analytics). These providers are contractually bound to protect your data. For Legal Compliance: We may disclose information if required by law, court order, or government regulation, or to protect the rights, property, or safety of TheraConnect, our users, or the public. With Your Consent: We may share information for other purposes with your explicit consent.

We take the security of your data seriously and implement industry-standard measures to protect it: • All data is encrypted in transit (TLS/SSL) and at rest (AES-256) • We use Firebase Authentication for secure login with multi-factor authentication options • Uploaded documents (IEPs, assessments, credentials) are stored in secure cloud storage with access controls • We conduct regular security audits and vulnerability assessments • Access to personal data is restricted to authorized personnel only on a need-to-know basis • Our servers are hosted on Google Cloud Platform with SOC 2 and ISO 27001 certifications While we strive to use commercially acceptable means to protect your data, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

We use cookies and similar technologies to enhance your experience on TheraConnect: Essential Cookies: Required for the platform to function properly (e.g., authentication, session management). These cannot be disabled. Analytics Cookies: Help us understand how users interact with our platform so we can improve it. We use privacy-friendly analytics that do not track individual users across websites. Preference Cookies: Remember your settings and preferences (e.g., timezone, notification preferences). We do not use advertising or tracking cookies. We do not share cookie data with third-party advertisers. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

Under the Nigeria Data Protection Regulation (NDPR) and applicable laws, you have the following rights: Right to Access: You may request a copy of the personal information we hold about you. Right to Correction: You may request that we correct any inaccurate or incomplete information. Right to Deletion: You may request that we delete your personal information, subject to legal retention requirements. Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances. Right to Data Portability: You may request a machine-readable copy of your data for transfer to another service. Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Right to Complain: You have the right to lodge a complaint with the National Information Technology Development Agency (NITDA) if you believe your data rights have been violated. To exercise any of these rights, contact us at privacy@theraconnect.com.ng.

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy: • Active account data is retained for the duration of your account's existence • Therapy session records and progress reports are retained for 7 years after the last session, in line with healthcare record-keeping requirements • Payment records are retained for 6 years for tax and audit purposes • Identity verification documents for therapists are retained for the duration of their platform membership plus 2 years • When you delete your account, we will remove your personal information within 30 days, except where retention is required by law You may request early deletion of your data by contacting us, subject to legal obligations.

Our platform may contain links to third-party websites or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party services. We encourage you to review the privacy policy of every site you visit. Our inclusion of a link does not imply endorsement of the linked site or service.

TheraConnect primarily operates within Nigeria. However, some of our service providers may process data in other countries. Where data is transferred internationally, we ensure appropriate safeguards are in place, including: • Standard contractual clauses approved by relevant data protection authorities • Ensuring receiving parties maintain adequate data protection standards • Compliance with the NDPR requirements for cross-border data transfers

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will: • Post the updated policy on this page with a revised "Last updated" date • Notify you via email or an in-app notification for significant changes • Obtain your consent where required by law We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Email: privacy@theraconnect.com.ng General: info@theraconnect.com.ng Data Protection Officer TheraConnect Nigeria Lagos, Nigeria For urgent privacy concerns or data breach reports, please email privacy@theraconnect.com.ng with "URGENT" in the subject line.