Therasize Limited

Therasize is a cloud-based web platform that supports practitioners in delivering structured psychological therapy (principally CBT) to their clients — sharing therapeutic resources, setting and reviewing homework, administering psychometric assessments, secure messaging, and video sessions. It supports, rather than replaces, the therapy pathway.

No. Therasize is not classified as Software as a Medical Device (SaMD) or AI as a Medical Device under the UK Medical Devices Regulations 2002. It does not diagnose, treat, monitor or provide clinical decision support; clinical judgement remains with the practitioner.

Minimal by design. Clients are identified by email address only (no name, no date of birth, no NHS Number). Special-category (health) data includes assessment responses, homework/worksheet content, and message content created during therapy.

All core personal data is stored and processed within the UK/EEA on managed cloud infrastructure (Google Cloud / Firebase — Firestore, Cloud Storage and Cloud Functions in EU regions).

Core data stays in the EEA (covered by UK adequacy). Where a sub-processor is US-headquartered, EU data residency is used and transfers are covered by the EU-US Data Privacy Framework (UK Extension) and/or the UK IDTA/SCCs.

Encrypted in transit with TLS and at rest with AES-256, on managed EU infrastructure.

For the care content on the platform (assessments, worksheets, messages), Therasize acts as your data processor — we process it only on your documented instructions, and you (the practitioner or organisation) remain the controller. We do not use care data for our own purposes.

Yes. System, access and administrative events are logged and monitored, with alerting on security-relevant events. Logs are access-restricted, encrypted, and reviewed periodically.

AI is used in a limited, practitioner-facing way only: to help practitioners generate generic templates — for example worksheet templates and correspondence templates — when they choose to. It is not used to process, analyse, profile, monitor, or make decisions about clients or their care. No client or patient personal or health data is sent to, processed by, or accessible to our AI provider. Template generation is based on the practitioner's instructions for a generic template; any client-specific information is added within the platform afterwards, never by the AI. AI features that would involve client care data are not enabled.