Is Theralyn HIPAA-compliant?

We are not currently HIPAA-certified. ABA, OT, and speech therapy in school and outpatient settings frequently falls outside HIPAA's covered entity definition — but we take data security seriously regardless. All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Each clinic's data is logically isolated and never shared with third parties. HIPAA BAA support is on our near-term roadmap.

Which therapy types does Theralyn support?

Theralyn supports Applied Behavior Analysis (ABA), Occupational Therapy (OT), Speech-Language Pathology (SLP), and Physical Therapy (PT) — each with discipline-specific data collection built in, like DTT trial data and ABC behavior logging for ABA, or range-of-motion and pain-scale tracking for PT. Play Therapy, CBT, and other modalities are also supported with standard session tracking, with specialized templates for those on the roadmap.

How much will Theralyn cost?

Theralyn is completely free during the current early-access period. When we launch paid plans, early access members get a founding discount — pricing will start around $49/month for small clinics and $99/month for teams up to 10 therapists. You'll receive 30 days' notice before any changes, and you can cancel anytime. No credit card is required to sign up.

Do parents need to create an account to view session reports?

No — and that's by design. Parents receive a secure, time-limited link (valid 7 days by default). They click it and instantly see a beautifully formatted progress report. No app download, no account creation, no friction.

Can independent therapists use Theralyn, or is it only for clinics?

Both. Independent practitioners get their own private workspace the moment they register — no clinic required. Clinic owners can additionally create an organization account and invite multiple therapists, with org-level reporting and activity libraries.

Does Theralyn support supervisor review of reports?

Yes. Reports written by staff therapists automatically route to the clinic admin for review and cosign before they can be finalized — a built-in supervisory check. It's a proxy-supervisor model today (there's no dedicated BCBA/clinical-supervisor role yet), but it gives clinic owners visibility before a report goes out.

How is my session and client data secured?

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Each organization's data is logically isolated — queries are scoped by organization ID at the database level, making cross-tenant data access architecturally impossible, not just policy-restricted.

When will Theralyn officially launch?

Early access is open now — you can create your account today and start planning sessions immediately. We're continuing to roll out new features based on direct feedback from early clinics, and founding member pricing is locked in for everyone who signs up during this period.

Legal

Privacy Policy

Last updated: August 1, 2026

About This Document

This privacy policy covers two things: the personal information collected through our public site at theralyn.co (account registration and optional free resource downloads), and, for registered therapy practices, the protected health information (PHI) — a child's name, guardian contact details, and clinical session or assessment data — stored and managed on their behalf through the Theralyn platform. If your organization uses Theralyn to store PHI, see our Notice of Privacy Practices for HIPAA-specific detail on how that data is handled.

1. What We Collect

From visitors who download a free resource (such as a template or checklist), we collect only an email address. From registered organizations, authorized users create accounts, and the platform stores whatever clinical data the organization enters to plan and document therapy sessions — including a child's name, guardian contact information, session notes and observations, therapy goals, and assessment results.

2. How We Use This Information

Email addresses collected from free resource downloads are used solely to deliver the requested resource and send occasional product updates — never sold, rented, or shared for marketing. PHI entered by a registered organization is used only to provide the contracted service back to that organization (hosting, session documentation, scheduling, reporting) and is never used for our own marketing, analytics, or any purpose beyond delivering the service the organization directs.

3. Data Storage

All data — resource-download emails and organization/clinical data alike — is stored with reputable cloud infrastructure providers, encrypted at rest (AES-256) and in transit using modern TLS encryption.

4. Cookies

We use minimal, essential cookies necessary for the website to function, plus Google Analytics (GA4) on our public marketing pages — theralyn.co's homepage, blog, and similar public content — to understand basic site traffic. GA4 sets standard analytics cookies (_ga, _ga_*) and is only active after you accept our cookie banner; if you decline, no analytics cookies are set. GA4 is never loaded on your dashboard, client records, session data, reports, or any page behind login — protected health information is never sent to Google or any analytics provider, under any circumstance.

5. Security

We implement technical and organizational measures to protect personal information and PHI, including encryption, role-based access control, and audit logging of account activity. No internet transmission is completely secure. See our Security & Compliance FAQ for more detail, and contact hello@theralyn.co with any security concern.

6. Your Rights

If you've given us your email address for a free resource download, you may request its deletion at any time by emailing us; we will remove it within 7 business days. If PHI about you or your child is stored in Theralyn on behalf of a therapy practice, that practice controls the record — please contact your therapy practice directly to request access, correction, or deletion, as described in our Notice of Privacy Practices.

7. Children's Data & PHI

Theralyn's platform is used by registered therapy practices to store protected health information belonging to the children and families they serve. In providing this service, Theralyn acts as a Business Associate under HIPAA with respect to that data, and is actively building out the safeguards and Business Associate Agreements required by HIPAA's Privacy and Security Rules — see our Notice of Privacy Practices for the current state of that program.

8. Changes to This Policy

We will update this policy as Theralyn evolves. Material changes will be communicated by email to anyone who has shared an email address with us, and to organizations via their account administrators.

9. Contact

For any privacy-related questions, email us at: hello@theralyn.co

This policy covers theralyn.co's public site and its registered platform. See our Notice of Privacy Practices for HIPAA-specific detail.

Questions? hello@theralyn.co