Privacy Policy

Clinical Pathweaver provides the software your massage therapy practice uses to manage your care, along with a client portal and mobile app where you can see your own information. This policy explains what we collect, why, who else sees it, how long we keep it, and what you can ask us to do.

Your practice decides what goes in your treatment record. We hold and protect that information on their behalf.

1. Information you give us

• Your identity and contact details — name, preferred name, date of birth, email addresses, phone numbers, postal address.
• Emergency contacts — the names and phone numbers you provide.
• Health information — everything recorded about your care: treatment notes, assessments, medical history, and any authorisations.
• Insurance details — your carrier, plan, and policy or member numbers, where your practice bills insurance for you.
• Payment information — handled by our payment provider. We hold a reference to your payment method; we do not store your full card number.
• Identity documents — where your practice needs them, such as a photographed ID or insurance card.

2. Information the mobile app collects automatically

When you sign in to the Clinical Pathweaver app, we receive:

• A device notification token, so your practice can send you appointment reminders.
• An installation identifier — a random value identifying this installation of the app. It is not your device's advertising ID, and it is not shared with anyone.
• Your device's name, so you can recognise your own sessions and sign out of one you no longer use.
• The app version, for support and troubleshooting.

The app stores your sign-in tokens in your device's secure keystore — the Android Keystore or the iOS Keychain. It does not keep your treatment records on your device.

We do not collect location data, advertising identifiers, contacts, photos, or usage analytics. The website carries no analytics or advertising trackers.

3. How we use your information

• To provide your care and let your practice manage it
• To show you your appointments, visit history, payments and profile
• To send appointment reminders and other messages you have asked for
• To bill your insurer or process your payment
• To keep your account secure and detect misuse
• To meet our legal and professional obligations

We do not sell your information. We do not use your health information for advertising.

4. Who else sees your information

We use service providers who process information on our behalf, under contract, and only for the purposes above. Where a provider handles health information, we put the agreements in place that the law requires before that information reaches them.

Push notifications are deliberately kept plain: the message your device receives says an appointment has changed, not what it was for. Your practice's name appears on your lock screen only if you turn that on in your notification settings.

We also disclose information where the law requires it, or where you have asked us to.

If you have records at more than one practice, each practice sees only its own. Your portal login covers them all, and you choose which practice you are looking at.

5. How long we keep it

How long we keep each kind of information is published on our retention schedule, which is generated from the rules the system actually applies rather than written out here. Two copies of a number drift apart; one does not.

We are legally required to keep treatment records for a set period, which is why closing your account does not delete them — see section 7.

6. Your rights

• See your information. Your appointments, visit history, payments and profile are in the portal and the app.
• Get a copy. You can download a complete copy of your record from your profile, in the portal or the app.
• Correct it. You can update your contact details yourself. For anything in your treatment record, ask your practice.
• Choose how we contact you. Email, text message and push notifications are each controlled separately, per practice, in your notification settings.
• See your active sessions and sign out of a device, including signing out everywhere at once.
• Close your portal account. See section 7.
• Ask who has seen your record. Contact your practice to request an accounting of disclosures. We record every access to your health information, including who, when and why.
• Complain. Contact your practice, or the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for complaining.

Your rights over your health record are set out in full in our Notice of Privacy Practices.

7. Closing your account

You can close your portal login at any time from your profile. We ask for your password first, because closing is permanent and we do not want it to happen from a device you left unlocked. When you do, we sign you out everywhere, unregister every device, stop all notifications, and delete your password.

Your treatment records stay with your practice. We are legally required to keep them for a set period, and closing your login does not delete them. If you return to the practice later, they can give you portal access again against your existing record.

8. How we protect your information

• Information is encrypted in transit and at rest.
• The app keeps your sign-in tokens in your device's secure keystore, never in ordinary storage.
• We record every access to your health information, including who, when and why.
• Staff access is limited by role, and to the practice you are a client of.

9. Children

A portal account is for someone aged 18 or over. Where your practice treats a minor, a parent or legal guardian holds the account and exercises these rights on the minor's behalf, to the extent the law allows. We do not knowingly let a child create their own portal login.

10. Changes

If we change this policy we will update the date above and, where the change is significant, tell you in the app or by email.

11. Contact us

Questions about this policy, or about your information, can go to your practice, or you can contact us.