Legal

Privacy Policy

Last updated July 20, 2026

TouchTrace is a documentation tool for massage therapists. You use it to record client session notes, tag treated body zones, and track progress over time. This policy explains what we collect, how we use it, and the choices you have. It is written to be read, not to bury the important parts.

Who is responsible for your data

TouchTrace provides the software. You, the therapist, are responsible for the client information you enter — you decide what to collect, and you are responsible for having any consent your local regulations require before recording a client's health information. We process that information on your behalf so the app can function.

What we collect

Account data. Your email address and authentication details, so you can sign in and we can secure your account.
Client and session records. The client names and session notes you create — including SOAP notes, the body zones you tag, and any progress information you record. This can include health-related details about your clients.
Billing notes. Because payment is manual, we record which plan your account is on and an internal note about your payment (for example the method and month). We do not collect or store card numbers.
Basic usage data. Standard server logs and, for the free public tools, a hashed (non-reversible) form of the visitor IP used only to enforce rate limits and prevent abuse.

How we use it

We use your data to run the app: to authenticate you, store and display your clients and notes, generate AI drafts and progress summaries from the notes you dictate, enforce plan limits, and respond to support requests. We do not sell your data, and we do not use your client records to advertise to you.

AI processing of your notes

When you generate a SOAP note or a progress summary, the relevant text you dictated or typed is sent to a third-party AI provider to produce the draft, which is returned to you for review. We send only what is needed to produce the result. Voice transcription happens in your browser using its built-in speech recognition; the audio itself is not uploaded to us. AI output is a draft — you are expected to review and correct it before relying on it.

Where your data is stored

Your account, clients, and sessions are stored in our managed Postgres database (Supabase). Access is protected by row-level security so that each account can only read its own clients and sessions. We take reasonable measures to protect your data, but no online service can promise perfect security.

Cookies

We use cookies only for authentication — to keep you signed in and to secure your session. We do not use advertising or third-party tracking cookies.

Your choices and rights

You can edit or delete your clients and session notes at any time from within the app. If you want to export your data or delete your account entirely, email us and we will help. Depending on where you live, you may have additional rights over your personal data; we will honor valid requests to the extent the law requires.

Data retention

We keep your data for as long as your account is active. If you delete a record it is removed from the live database. If you close your account, we delete your clients and sessions, retaining only what we must for legal or accounting purposes.

Changes to this policy

If we make material changes, we will update the date at the top of this page. Continued use of TouchTrace after a change means you accept the updated policy.

Contact

Questions about privacy or a data request? Email us at arslankhanwazir@gmail.com.