Terms of service
Last updated 5 September 2026
The agreement between you and Truly Empowered Ltd when you use TheraComply. Written to be read, not skimmed past.
What the service is
TheraComply helps UK therapy practices produce, publish and maintain data-protection documents from the answers you give and checks of your public website, and provides tools including a hosted policy page, a consent banner and a complaints route. The service generates documents from your input; you remain responsible for the accuracy of what you tell it and for how you run your practice.Not legal advice
The service provides general information and document generation, not legal advice, and no solicitor-client relationship is created by using it. Documents are generated from information you provide. Where your situation is unusual, the service will say so and recommend professional review; we would rather you asked a qualified adviser than relied on software for an edge case.Your account
The purchasing practice must be based in the United Kingdom. You confirm this before payment and must tell us if it changes. Your therapy clients may live overseas; you remain responsible for any additional duties arising from that work. The documents address UK data-protection requirements and are not tailored to other countries' laws.You sign in with one-time email codes, so keeping access to your email account secure is essential. You are responsible for what happens under your sign-in, and you will tell us promptly at hello@theracomply.co.uk if you believe your account has been misused. Do not enter client records into the practice questionnaire. The separate complaints route accepts only the personal information needed to handle a data protection complaint.Fees, payment and cancelling
The annual subscription price is shown including VAT and is taken in full when you check out. Your subscription renews automatically each year on your renewal date, and we remind you before that happens. You can cancel renewal at any time from your account; your access then continues to the end of the year you have paid for. The optional website setup service is selected at signup and paid once with your first annual payment, including VAT. It does not renew. You review and publish your documents before we connect them to your website and configure and test its cookie controls. We will contact you to arrange any access needed. If we cannot deliver the purchased setup, we will refund its one-off fee.At checkout you ask us to provide access as soon as payment completes. This does not waive any statutory cancellation right you may have; contact us at hello@theracomply.co.uk within 14 days of first payment if you believe a cancellation right applies. Documents you have generated remain yours, and you can download them before your account closes.Fair use
Do not misuse the service: no attempting to access other practices’ data, no checking websites you do not control or have permission to check, no using the service to send spam or host unlawful content, and no reselling it without a written agreement with us.Processing information for your practice
For personal information you submit or receive through the practice document and complaints tools, your practice is the controller and we process it on your behalf. The work is hosting, organising, generating documents, publishing at your request, sending messages you request and supporting your account. It continues while we provide those services and until agreed return or deletion. It can involve practice contacts, staff, complainants and people mentioned in a complaint; contact details, practice answers and complaint correspondence, including sensitive information where supplied. You are responsible for lawful instructions and for limiting what you submit.We process that information only on your documented instructions, including the choices you make in the service, unless law requires otherwise. We tell you of a legal requirement before acting where permitted, and tell you if we believe an instruction infringes data protection law. Authorised personnel must keep information confidential. We maintain access controls, encrypted sensitive complaint fields, secure transport and appropriate organisational safeguards.We assist with rights requests, security obligations, breach handling, impact assessments and regulator consultation, taking account of the processing and information available to us. We notify you without undue delay after becoming aware of a personal data breach affecting your information. We provide information needed to demonstrate these obligations and allow proportionate audits, including inspections, subject to arrangements protecting other customers.By accepting these terms, your practice gives written authorisation for the current sub-processors listed in the provider schedule below. We impose equivalent data protection obligations on sub-processors and remain responsible for their performance. Before adding or replacing a sub-processor, we will email your account contact with at least 30 days' notice and give you an opportunity to object on data protection grounds. We will work with you to resolve an objection before the proposed provider processes your practice information; if we cannot resolve it, you may end the affected service and arrange return or deletion of your information. Restricted international transfers require an applicable lawful safeguard.At service end, you choose return or deletion of practice personal information, including copies, unless law requires retention. The account export and support route help you give those instructions. Routine recovery backups expire after 30 days. Records awaiting backup expiry are kept beyond normal use, and any restoration must reapply recorded deletion instructions. Our separate purposes for billing, security and support are described in our privacy notice.Current provider schedule
- 20i Ltd: website, database and service email hosting in the United Kingdom. This includes practice records and messages sent through the service. 20i data processing terms.
- Backblaze, Inc.: encrypted recovery backups stored in its EU-Central region in the Netherlands. Routine daily backups are retained for 30 days. Backblaze UK data processing terms.
- Stripe: payment processing, invoices and subscription management. Stripe receives billing and payment details, not therapy records through our payment integration. Depending on the activity, Stripe acts as a processor or for its own controller purposes, such as fraud prevention and regulatory duties. Stripe data processing terms and privacy notice.