Security FAQ

At TheraPro, protecting your patients’ data and your clinic’s trust is our highest priority. This page explains where TheraPro data is stored, how it is secured, how backups and retention are managed, and who owns the data.

Where is TheraPro Data Stored?

TheraPro uses secure, HIPAA-ready infrastructure across AWS DynamoDB and Wasabi (S3-compatible) storage. Data location depends on the environment chosen for your account:

• United States (default for U.S. clinics): AWSus-east-1(Virginia) for DynamoDB, AWS Lambda, and supporting services, with Wasabi Virginia region for object storage
• International clinics (case-by-case): Storage may be provisioned in the closest compliant Wasabi region
• Development/Test Environments: Stored in a shared Wasabi bucket (alltheraprodev) with per-clinic folders — contains no PHI

How is TheraPro Data Secured?

TheraPro uses a multi-layered security architecture across compute, network, identity, and edge protection:

Encryption & Data Protection

• Encryption in transit: TLS 1.2+ (128-bit+ encryption) for all data exchanges
• Encryption at rest: AES-256 encryption for DynamoDB and Wasabi storage
• Secure content delivery: Amazon CloudFront enforces HTTPS delivery and signed access to protected assets

Identity & Access Management

• User authentication: Powered by Amazon Cognito for secure login, session control, and optional MFA
• Role-based access control (RBAC): Admins, therapists, and patients have strictly defined permissions
• IAM role isolation: No clinic users have direct AWS access; all actions are mediated through secure APIs

Application & API Security

• Serverless backend: AWS Lambda executes all business logic in isolated environments
• Pre-signed access model: Secure, time-limited access to files via Lambda-generated URLs
• API protection: All endpoints are secured behind API Gateway with authentication and request validation

Network & Edge Security

• Web application firewall: AWS WAF protects against SQL injection, XSS, and common web exploits
• DDoS protection: AWS Shield provides automatic mitigation against volumetric and application-layer attacks
• AWS Firewall controls: Network-level filtering and threat protection across services

Monitoring & Audit Logging

• Centralized logging: Amazon CloudWatch captures system metrics, logs, and alerts in real time
• Audit trails: All user actions—logins, edits, exports, and file access—are logged and retained for compliance
• Security visibility: Continuous monitoring enables anomaly detection and incident response

How is Data Access Controlled?

• User Accounts: Each Admin, Therapist, and Patient has a unique authenticated session
• Role Permissions: Clinic Admins define who can access patient charts, billing, or analytics
• Audit Logging: Every interaction is logged and traceable via CloudWatch and internal audit tables
• Activity Reports: Filter by user, action, or date to ensure HIPAA compliance

How is Data Backed Up?

• Weekly backups retained for 30 days
• Monthly backups retained for 12 months

Encryption: All backups remain encrypted in transit and at rest

Data Retention & Storage

• Account access is locked
• Data remains securely stored for a defined retention window
• Clinics are strongly encouraged to export patient data prior to cancellation

Export Options

• Batch CSV export (demographics, appointments, billing)
• Full Chart Export packages for clinical records

Who Owns TheraPro Data?

• Clinic Account Data (billing, subscription details): Owned by TheraPro under our Privacy Policy
• Patient Data (PHI): Fully owned by the clinic (Subscriber)

TheraPro acts strictly as a Business Associate (BAA):

• We securely store and transmit PHI on your behalf
• We do not sell, mine, or use patient data for any purpose outside of service delivery

Connection & Access Errors

If you receive a “Your Connection is Not Secure” warning:

• Verify the correct URL format:
• clinicname.therapro.app
• Do not include “www.” before the subdomain
• Ensure your website and Google Business profile use the correct link

Still Have Questions?

We’re here to help with any security, privacy, or compliance questions:

• Email: security@therapro.app
• Address: TheraPro LLC, 6650 Rivers Ave, Suite 100, Charleston, SC 29406
• Website: www.therapro.app