Privacy Policy

STATE OF FLOW is a chiropractic practice in Singapore, registered as a sole proprietorship (UEN 53387919A) operated by Dr. Tim Foo. We are responsible for the personal data described in this policy. Our Data Protection Officer is Dr. Tim Foo, whom you can reach about any privacy matter — including the requests described below — at hello@stateofflow.org or +65 8112 3506.

Depending on how you interact with us, we may collect:

• Identity & contact details: name, email address, phone number, and postal address.
• Health information: intake and medical history you provide, medical alerts, symptoms and conditions, clinical and treatment notes recorded by your practitioner, care plans, and any documents or images you or we upload to your record. This is sensitive data and we treat it accordingly.
• Appointment & care data: booking times, appointment types, visit locations (in-person or virtual), and notes shared with you.
• Billing information: invoices, prepaid packages, insurance verification status, and payment/co-payment records. We do not store full card numbers.
• Emergency contact & background: the emergency contact, occupation, and referral source you choose to provide.
• Communication preferences: which reminder channels you enable (email, WhatsApp, Telegram, web push) and the associated identifiers you connect, such as your WhatsApp number or Telegram account.
• Technical data: limited data needed to operate the portal securely, such as authentication sessions, device/browser information, and error diagnostics.

• To provide chiropractic care and maintain your clinical record.
• To schedule appointments and send you reminders and care-related messages.
• To bill for services and manage prepaid packages and insurance.
• To operate, secure, and improve the patient portal.
• To meet legal, regulatory, and professional record-keeping obligations that apply to healthcare providers.

We rely on your consent and on the performance of our care relationship with you as the bases for processing. You can withdraw consent for optional processing (such as a reminder channel) at any time — see “Your choices” below.

Reminder channels are opt-in. If you connect WhatsApp or Telegram, appointment details (such as your name, appointment time, and clinic information) are sent through that provider so the reminder can reach you. That message content leaves our systems and is handled by the provider under its own terms and privacy policy.

Please note: WhatsApp is operated by Meta and Telegram by Telegram FZ-LLC. If you connect one of these channels, your appointment information is processed by that provider under its own privacy policy, and we cannot guarantee it applies the same protections we do. You can disconnect any channel at any time from your notification settings, and email remains available.

We do not sell your personal data. We share it only with service providers who process it on our behalf to run the practice, under agreements that limit their use of it:

• Clerk — secure sign-in and account authentication.
• Convex — our application database, which encrypts data at rest.
• Resend — delivery of transactional emails such as confirmations and reminders.
• Meta (WhatsApp) and Telegram — delivery of reminders, only if you connect those channels.
• Google Calendar — scheduling and availability synchronisation for the practice.
• Sentry — error diagnostics, configured to avoid capturing your health information.
• Hosting infrastructure — to run the application and website.

We may also disclose information where required by law, to protect safety, or to comply with a lawful request from a regulator or authority.

Some of our service providers process and store data on infrastructure located outside Singapore. Where personal data is transferred abroad, we take steps intended to ensure it remains protected to a standard comparable to Singapore's Personal Data Protection Act (PDPA).

• Encryption of data at rest through our database infrastructure.
• Role-based access controls so staff see only what their role requires.
• Audit logging of access to and changes in patient records.
• Encrypted connections (HTTPS) between your device and our services.

No method of transmission or storage is completely secure, but we work to protect your information using industry-standard safeguards.

We retain your clinical records for six years after your last visit, in line with accepted medical record-keeping practice, and longer where the law requires it. Other personal data is kept only as long as needed for the purposes described above. When information is no longer required, we take steps to securely delete or anonymise it.

Subject to applicable law, you may:

• Request access to the personal data we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Withdraw consent for optional processing, such as a reminder channel.
• Ask questions about how your data is handled.

To make a request, contact us at hello@stateofflow.org. Some clinical records may need to be retained even after a request, where the law requires it.

We use only the cookies and similar technologies needed to keep you signed in, keep the portal secure, and remember basic preferences such as light or dark theme. We do not use advertising or cross-site tracking cookies.

Where we provide care to a minor, we collect their information from, and share it with, a parent or legal guardian who consents to and manages that care.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and material changes will be communicated as appropriate.

If you have questions or concerns about this policy or your personal data, contact us at hello@stateofflow.org or +65 8112 3506. If you are in Singapore and are not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC).