Privacy Policy
TheraLoom is an independent talent network that connects therapy, rehabilitation, special education, and developmental-care professionals with the clinics, schools, centres, and individuals that need them. This policy explains what personal data we collect, why, how we share it, how long we keep it, and the rights you have over it.
1. Who we are
TheraLoom is an independent talent network. We are not an employer, a licensed recruitment agency, or your agent, and we do not employ the candidates we introduce. For any privacy question or request, contact us at theraloom@proton.me.
2. The data we collect
If you are a candidate
Your full name, email address, WhatsApp number, profession or role, experience level and years of experience, preferred country and location, licence or registration status, areas of experience, and the CV file you upload. Optionally, your current location, LinkedIn profile, any message you add, and the names of up to three organisations you currently work or have worked for. We ask for your employment history for one reason only: so we never introduce you to a clinic or school you already work at or have worked at. It is never shared with employers, and you can leave it blank.
If you are an employer or hirer
Your organisation or personal name, contact person, work email, phone or WhatsApp number, organisation type, the role and location you are hiring for, experience and specialisms required, timeline, and a LinkedIn link (owner, manager, or company). Optionally, a Google Business Profile link, trade licence number, and any notes.
If you sign in to manage your listings, we also record each request for a sign-in link (the email address and the time), your signed-in session (when it started and was last used; we store only a scrambled form of the sign-in code), and the outcomes you report for the candidates we shared with you.
Consent record
When you submit a form we record that you agreed to our terms, which version of the wording you agreed to, and the date and time, so we can demonstrate valid consent if asked.
We practise data minimisation: we ask only for what we need to make relevant introductions. We do not collect or store government identity documents such as passports or Emirates ID scans.
3. How we use your data
- To review your submission and, for candidates, your CV.
- To make relevant introductions between candidates and employers.
- To contact you about relevant opportunities or requirements.
- To verify that candidates and organisations are genuine before sharing any profile.
- To confirm your email address when you first sign up. Until you confirm it, your profile or listing is not active. If it is not confirmed within 14 days, we delete the submission, including any CV, at our next routine clean-up.
- If the form is submitted again with an email address we already hold, to email that address and ask its owner to confirm the update. Nothing changes until they do. An update that is not confirmed within 7 days can no longer be applied, and is discarded, including any CV uploaded with it, at our next routine clean-up.
- To check in with you by email: candidates roughly once a month, asking whether you are still looking, and employers before a listing closes, asking whether the role is still open. The links in these emails open a confirmation page on our website, and nothing changes until you press the button there. Candidates who do not respond to two check-ins are paused, and listings close after 30 days unless renewed. When an employer reports a hire or a candidate reports a placement, we update the related listing and profile. Pausing deletes nothing, and you can ask us to reactivate your profile or listing at any time.
- To send you messages about your profile or listing. We keep a record of each message we send and whether it was delivered.
- To let employers sign in with a one-time emailed link, with no password, to see and manage their own listings, report the outcome for each candidate we shared with them, and post another role. A sign-in link works once, for 15 minutes, and a sign-in lasts up to 7 days or until you sign out. Only the email address that posted a listing can sign in to it.
- To keep a record of each introduction we make and its outcome, so we know which roles are filled and which candidates are placed and do not contact you about roles that no longer apply.
- To protect the service from spam and abuse.
4. The legal basis
We process your data on the basis of the consent you give when you submit a form. This is required under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and India's Digital Personal Data Protection Act, 2023. You can withdraw your consent at any time (see section 8).
5. How we share your data
For candidates, we share your profile and CV only with clinics, schools, therapy centres, rehabilitation organisations, or individuals that we have reviewed, and only where the opportunity is relevant to you. We never publish CVs, never allow public browsing, and never sell your data. Employers receive candidate details in confidence and solely to recruit the role they described. An employer we have shared your profile with can also see your name and profession in their employer sign-in, next to that role, and can tell us the outcome (for example, interviewing or hired).
We also rely on a small number of service providers to run the service: cloud database and file storage, an email delivery service, a spam-protection service, and website analytics services including Google Analytics. They process data only on our instructions.
6. Cross-border transfer
Because our operational focus is the UAE and much of our talent is based in India, your data may be transferred across borders (for example, from India to the UAE) when we share a relevant profile. By submitting a form and giving explicit consent, you agree to this transfer. We share only what is relevant, and only with organisations we have reviewed.
7. How long we keep it, and how we protect it
We keep your data only as long as needed for the purpose above. As a guide, candidate data that has not led to a placement is reviewed for deletion after 12 months. Sign-ups whose email address is never confirmed are deleted after 14 days, and unconfirmed profile updates after 7 days, at our next routine clean-up. Records of sign-in link requests are deleted after 2 days, and employer sign-in links and sessions once they have ended, at our next routine clean-up. We protect it with encryption, private storage that's never publicly accessible, and strict access controls limited to authorised staff.
8. Your rights
You can ask us at any time to access, correct, or delete your personal data, or to withdraw your consent, by emailing theraloom@proton.me. We will action deletion requests and stop sharing your profile. Withdrawing consent does not affect sharing that already took place before your request.
9. Cookies
This site uses two kinds of cookie, and no advertising cookies at all.
Spam protection. Our spam-protection check may set a technical cookie to confirm you are a real person and not a bot.
Analytics. We use Google Analytics to understand how the site is used and which pages are useful. It sets cookies to recognise return visits and records information such as which pages you viewed, where your visit came from, your approximate location, and your browser and device type. We do not use it to identify you personally, we do not use it for advertising, and we never sell your data. Google processes this information as our service provider, and it may be transferred to and stored on servers outside your country. You can opt out across all sites using Google's browser opt-out add-on, or by blocking cookies in your browser settings.
We also use a privacy-friendly measurement tool that works without cookies and records only aggregated page views.
Employer sign-in. If you sign in to manage your listings, your browser keeps a sign-in code in its local storage (not a cookie) so you stay signed in for up to 7 days. It is used for nothing else, and signing out removes it.
10. Changes
We may update this policy from time to time. The "last updated" date above shows the current version. Continuing to use the service means you accept the current version.