Your clients’ data stays theirs
Therapy runs on confidentiality, and a tool that holds session records and client details has to take that seriously. This page sets out how Therapy Manager protects your practice data.
Built on Supabase, backed by PostgreSQL
Your practice data is stored in Supabase, a managed PostgreSQL service, and is encrypted at rest by the platform. Everything between your browser and the app travels over HTTPS.
Access scoped to your account
Database access rules (row-level security) limit each signed-in therapist to their own clients, sessions, payments, notes and invoices, on top of the same checks in the application code. There are no shared workspaces.
A record of sensitive actions
We log when a session or client note is edited, when a session with a note, a client or a form response is deleted, when you download your data, a form’s responses or an income statement, and when an account is deleted. The log records what happened and when, never the content of a note or answer. You can read your own log from your Profile page. Entries are deleted after one year.
We never sell your data
Therapy Manager makes money from subscriptions. We do not sell your data, share it with third parties for their own purposes, or use client records for advertising. The services that run the app (Supabase for the database, Vercel for hosting, Resend for email, Dodo Payments for subscriptions, and Google for sign-in and calendar sync if you use them) handle it only to run the app.
Designed with DPDP principles in mind
India’s Digital Personal Data Protection (DPDP) Act asks that personal data be collected for a stated purpose, protected, and kept under the control of the people it describes. Therapy Manager is designed with those principles in mind: the client data you record stays scoped to your account and is used only to run your practice. This is a design commitment, not a certification, as no DPDP certification regime exists.
Your data, yours to take or delete
From your Profile page you can download your clients, sessions, notes, payments, invoices, forms and responses (a ZIP of CSV files plus your invoice PDFs), or delete your account yourself once any paid plan is cancelled. If you cancel a paid plan, it stays active until the end of the period you paid for, then you move to the Free plan with every record intact.
Not yet
- Two-factor sign-in is not available yet.
- Session notes and form answers are protected by encryption at rest and the access rules above, not by separate field-level encryption.
- We don’t hold security certifications.
Have a security question before trusting us with your practice? Email yoshita@dandelion-psychotherapy.com.