diff --git a/active-patients-import-sample.csv b/active-patients-import-sample.csv
new file mode 100644
index 0000000..18855ce
--- /dev/null
+++ b/active-patients-import-sample.csv
@@ -0,0 +1,6 @@
+imagica_patient_id,patient_name,mobile,age,gender,language,lung_condition,other_health_condition,category,payment_status,whatsapp_opt_out,cohort_start_date,slot,sessions_completed,virtual_prt_email
+P10021,Ramesh Kumar,9810011122,62,Male,Hindi,COPD,,Obstructive,Paid,no,03/08/26,09:00-10:00,12,prt.hindi@example.com
+P10088,Sunita Devi,9810033344,58,Female,Hindi,Asthma,Hypertension,Obstructive,Partial,no,03/08/26,09:00-10:00,12,prt.hindi@example.com
+P10045,Anil Sharma,9810055566,71,Male,Hindi,COPD,Diabetes,Obstructive,Paid,no,03/08/26,09:00-10:00,12,prt.hindi@example.com
+P10102,Murugan S,9840099988,67,Male,Tamil,ILD,,Restrictive,Paid,yes,04/08/26,18:00-19:00,8,prt.tamil@example.com
+P10119,Lakshmi R,9840010101,64,Female,Tamil,ILD,Hypertension,Restrictive,Unpaid,no,04/08/26,18:00-19:00,8,prt.tamil@example.com
\ No newline at end of file
diff --git a/frontend/public/privacy/index.html b/frontend/public/privacy/index.html
new file mode 100644
index 0000000..c92fb83
--- /dev/null
+++ b/frontend/public/privacy/index.html
@@ -0,0 +1,108 @@
+
+
+
+
+
+ Privacy Policy | Pulmonary Rehabilitation
+
+
+
+
+
+
Privacy Policy
+
Last updated: 13 October 2026
+
+ This privacy policy applies to VirtualPR, the Pulmonary Rehabilitation Program, whose home page is
+ https://pulmorehab.virtualengage.in.
+ VirtualPR is operated by Stratawiz (“we”, “us”). This policy explains what information we collect, how we use it, and the choices available to the people who use the service. It applies to staff who sign in to VirtualPR and to patient information those staff enter in order to run the program.
+
+
+
Information we collect
+
We collect the following information:
+
+
Staff account details: name, email address, password (stored only as a hash), and role.
+
Program records entered by staff: patient identifier, name, mobile number, age, gender, language, health conditions, session slot, preferred weekday, cohort, payment status, payment screenshot, and WhatsApp preferences.
+
Session, cohort, holiday, leave, and message records needed to schedule and run the program.
+
Technical logs needed to keep the service secure and to diagnose errors.
+
+
+
Google user data
+
A staff member may connect their own Google account from My profile. Connecting is optional. We request only these permissions:
+
+
Email address (https://www.googleapis.com/auth/userinfo.email) — to show which Google account is connected.
+
Google Calendar events (https://www.googleapis.com/auth/calendar.events) — to create, update, and delete events on that person’s primary calendar for rehabilitation sessions assigned to them.
+
Google Meet spaces (https://www.googleapis.com/auth/meetings.space.created) — to create the Meet link for those events and apply the meeting settings chosen in VirtualPR, including who may join and whether participants may use a microphone and camera.
+
+
From the connected Google account we store:
+
+
the Google account email address and account identifier;
+
the OAuth access token and refresh token, stored encrypted;
+
the permission scopes that were granted and the token expiry time;
+
the identifier, link, and Meet link of calendar events VirtualPR creates.
+
+
+ We use this Google data only to show the connected account and to create, update, and delete the calendar events and Meet links for that staff member’s program sessions. We do not read, list, or change calendar events that VirtualPR did not create. We do not access Gmail, Drive, Contacts, or any other Google product.
+
+
+ We do not sell Google user data. We do not use Google user data for advertising, for credit decisions, or to train generalized artificial-intelligence models. We do not transfer Google user data to others except to Google, to perform the calendar and Meet actions the staff member requested, or where required by law. Humans do not read this Google data except where the staff member asks us to, where we need to investigate a security incident, or where the law requires it.
+
+
+ VirtualPR’s use and transfer of information received from Google APIs adheres to the
+ Google API Services User Data Policy,
+ including the Limited Use requirements.
+
+
+
How we use other information
+
We use staff and patient information to:
+
+
authenticate staff and apply their role permissions;
+
enroll patients, schedule sessions, and assign cohorts and educators;
+
send program email, such as password resets and operational notices;
+
send WhatsApp messages and group updates that the program is configured to send, except where a patient has opted out;
+
keep audit records of staff actions and protect the service.
+
+
+
Sharing
+
+ We do not sell personal information. We share information with service providers that host the application, store the database, deliver email, or deliver WhatsApp messages, and only so they can perform those services for us. We may disclose information if a law, court, or government authority requires it, or to protect the rights and safety of patients, staff, or the public.
+
+
+
Retention and deletion
+
+ Google tokens and the connected-account email are deleted when a staff member chooses Disconnect on My profile. We also ask Google to revoke the token. The staff member can remove VirtualPR at any time from their Google Account permissions at
+ https://myaccount.google.com/permissions.
+
+
+ Program records are kept for as long as the program needs them. Onboarding records that stay unpaid and unconfirmed are deleted on a daily schedule. Staff can ask us to delete their account by emailing the address below.
+
+
+
Security
+
+ Access to VirtualPR is limited to signed-in staff and to the actions their role allows. Passwords are hashed. Google tokens are encrypted at rest. No method of storage or transmission is perfectly secure.
+
+
+
Contact
+
+ Questions about this policy or a request to access, correct, or delete staff account information can be sent to
+ support1@stratawiz.com.
+ The related terms are on the Terms of Use page.
+
+
+
+
+
diff --git a/frontend/public/terms/index.html b/frontend/public/terms/index.html
new file mode 100644
index 0000000..105c5fa
--- /dev/null
+++ b/frontend/public/terms/index.html
@@ -0,0 +1,100 @@
+
+
+
+
+
+ Terms of Use | Pulmonary Rehabilitation
+
+
+
+
+
+
Terms of Use
+
Last updated: 13 October 2026
+
+ These terms govern use of VirtualPR, the Pulmonary Rehabilitation Program at
+ https://pulmorehab.virtualengage.in,
+ operated by Stratawiz (“we”, “us”). By signing in or using the service, you agree to these terms and to the
+ Privacy Policy.
+
+
+
Who may use VirtualPR
+
+ VirtualPR is for staff of the pulmonary rehabilitation program. We provide accounts to people the program authorizes. You must keep your password confidential and you are responsible for activity under your account. Tell us promptly at
+ support1@stratawiz.com
+ if you believe your account is being used without permission.
+
+
+
Permitted use
+
You may use VirtualPR only to carry out the program: enrolling patients, scheduling sessions, managing cohorts, and the related messages and records. You may not:
+
+
share your login or let an unauthorized person use the service;
+
use patient or staff information for a purpose outside the program;
+
attempt to break, probe, or bypass the service’s access controls;
+
upload content you do not have the right to store.
+
+
+
Patient information
+
+ Information you enter about patients is confidential. You may enter and view only the records your role allows, and only for the program. Payment screenshots and health details must be handled with the same care as the rest of the patient record.
+
+
+
Google Calendar and Google Meet
+
+ Connecting a Google account is optional and is done from My profile. If you connect, you authorize VirtualPR to use your Google account email, to create, update, and delete calendar events for your program sessions, and to create the Google Meet link for those events. VirtualPR does not read the rest of your calendar.
+
+
+ You can disconnect at any time from My profile, or by removing VirtualPR from your Google Account permissions. Your use of Google services also remains subject to Google’s own terms. Our handling of Google data is described in the
+ Privacy Policy.
+
+
+
Messages
+
+ The service can send email and WhatsApp messages that the program configures, including session notices. Do not use those tools to contact people who have opted out, or for messages unrelated to the program.
+
+
+
Availability
+
+ We provide VirtualPR for the program’s operations. We may change, suspend, or stop a feature, including when a third-party service such as Google, email, or WhatsApp is unavailable. Scheduled sessions and records may be interrupted during maintenance.
+
+
+
Ending access
+
+ We may disable an account that is unused, no longer authorized by the program, or used in breach of these terms. You may ask us to close your staff account by emailing
+ support1@stratawiz.com.
+
+
+
Liability
+
+ VirtualPR is an operational tool for the program. Clinical decisions remain with the responsible clinicians. To the extent the law allows, we are not liable for indirect or consequential loss arising from use of the service, or for a failure caused by a third-party service.
+
+
+
Changes
+
+ We may update these terms. The date at the top of this page will change when we do. Continued use of VirtualPR after an update means you accept the updated terms.
+
diff --git a/frontend/src/views/legal/LegalLayout.jsx b/frontend/src/views/legal/LegalLayout.jsx
new file mode 100644
index 0000000..2c1fdc3
--- /dev/null
+++ b/frontend/src/views/legal/LegalLayout.jsx
@@ -0,0 +1,36 @@
+import logo from '@/assets/images/logo.png';
+import PageMetaData from '@/components/PageMetaData';
+import { FooterCredit } from '@/layouts/components/footer';
+import { Link } from 'react-router';
+import { Container } from 'react-bootstrap';
+
+const LegalLayout = ({ title, children }) => {
+ return (
+
+
+
+
+
+
+
+
+
{title}
+
Last updated: 13 October 2026
+ {children}
+
+
+ Privacy Policy
+ ·
+ Terms of Use
+ ·
+ Sign in
+
+
+
+
+
+
+ );
+};
+
+export default LegalLayout;
diff --git a/frontend/src/views/legal/privacy.jsx b/frontend/src/views/legal/privacy.jsx
new file mode 100644
index 0000000..877820b
--- /dev/null
+++ b/frontend/src/views/legal/privacy.jsx
@@ -0,0 +1,88 @@
+import { Link } from 'react-router';
+import LegalLayout from '@/views/legal/LegalLayout';
+
+const Privacy = () => {
+ return (
+
+
+ VirtualPR (the Pulmonary Rehabilitation Program) is available at https://pulmorehab.virtualengage.in and is operated by Stratawiz (“we”, “us”). This policy explains what information we collect, how we use it, and the choices available to the people who use the service. It applies to staff who sign in to VirtualPR and to patient information those staff enter in order to run the program.
+
+
+
Information we collect
+
We collect the following information:
+
+
Staff account details: name, email address, password (stored only as a hash), and role.
+
Program records entered by staff: patient identifier, name, mobile number, age, gender, language, health conditions, session slot, preferred weekday, cohort, payment status, payment screenshot, and WhatsApp preferences.
+
Session, cohort, holiday, leave, and message records needed to schedule and run the program.
+
Technical logs needed to keep the service secure and to diagnose errors.
+
+
+
Google user data
+
+ A staff member may connect their own Google account from My profile. Connecting is optional. We request only these permissions:
+
+
+
+ Email address (https://www.googleapis.com/auth/userinfo.email) — to show which Google account is connected.
+
+
+ Google Calendar events (https://www.googleapis.com/auth/calendar.events) — to create, update, and delete events on that person’s primary calendar for rehabilitation sessions assigned to them.
+
+
+ Google Meet spaces (https://www.googleapis.com/auth/meetings.space.created) — to create the Meet link for those events and apply the meeting settings chosen in VirtualPR, including who may join and whether participants may use a microphone and camera.
+
+
+
From the connected Google account we store:
+
+
the Google account email address and account identifier;
+
the OAuth access token and refresh token, stored encrypted;
+
the permission scopes that were granted and the token expiry time;
+
the identifier, link, and Meet link of calendar events VirtualPR creates.
+
+
+ We use this Google data only to show the connected account and to create, update, and delete the calendar events and Meet links for that staff member’s program sessions. We do not read, list, or change calendar events that VirtualPR did not create. We do not access Gmail, Drive, Contacts, or any other Google product.
+
+
+ We do not sell Google user data. We do not use Google user data for advertising, for credit decisions, or to train generalized artificial-intelligence models. We do not transfer Google user data to others except to Google, to perform the calendar and Meet actions the staff member requested, or where required by law. Humans do not read this Google data except where the staff member asks us to, where we need to investigate a security incident, or where the law requires it.
+
+
+ VirtualPR’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
+
+
+
How we use other information
+
We use staff and patient information to:
+
+
authenticate staff and apply their role permissions;
+
enroll patients, schedule sessions, and assign cohorts and educators;
+
send program email, such as password resets and operational notices;
+
send WhatsApp messages and group updates that the program is configured to send, except where a patient has opted out;
+
keep audit records of staff actions and protect the service.
+
+
+
Sharing
+
+ We do not sell personal information. We share information with service providers that host the application, store the database, deliver email, or deliver WhatsApp messages, and only so they can perform those services for us. We may disclose information if a law, court, or government authority requires it, or to protect the rights and safety of patients, staff, or the public.
+
+
+
Retention and deletion
+
+ Google tokens and the connected-account email are deleted when a staff member chooses Disconnect on My profile. We also ask Google to revoke the token. The staff member can remove VirtualPR at any time from their Google Account permissions at myaccount.google.com/permissions.
+
+
+ Program records are kept for as long as the program needs them. Onboarding records that stay unpaid and unconfirmed are deleted on a daily schedule. Staff can ask us to delete their account by emailing the address below.
+
+
+
Security
+
+ Access to VirtualPR is limited to signed-in staff and to the actions their role allows. Passwords are hashed. Google tokens are encrypted at rest. No method of storage or transmission is perfectly secure.
+
+
+
Contact
+
+ Questions about this policy or a request to access, correct, or delete staff account information can be sent to support1@stratawiz.com. The related terms are on the Terms of Use page.
+
+
+ );
+};
+
+export default Privacy;
diff --git a/frontend/src/views/legal/terms.jsx b/frontend/src/views/legal/terms.jsx
new file mode 100644
index 0000000..9207d29
--- /dev/null
+++ b/frontend/src/views/legal/terms.jsx
@@ -0,0 +1,71 @@
+import { Link } from 'react-router';
+import LegalLayout from '@/views/legal/LegalLayout';
+
+const Terms = () => {
+ return (
+
+
+ These terms govern use of VirtualPR, the Pulmonary Rehabilitation Program at https://pulmorehab.virtualengage.in, operated by Stratawiz (“we”, “us”). By signing in or using the service, you agree to these terms and to the Privacy Policy.
+
+
+
Who may use VirtualPR
+
+ VirtualPR is for staff of the pulmonary rehabilitation program. We provide accounts to people the program authorizes. You must keep your password confidential and you are responsible for activity under your account. Tell us promptly at support1@stratawiz.com if you believe your account is being used without permission.
+
+
+
Permitted use
+
You may use VirtualPR only to carry out the program: enrolling patients, scheduling sessions, managing cohorts, and the related messages and records. You may not:
+
+
share your login or let an unauthorized person use the service;
+
use patient or staff information for a purpose outside the program;
+
attempt to break, probe, or bypass the service’s access controls;
+
upload content you do not have the right to store.
+
+
+
Patient information
+
+ Information you enter about patients is confidential. You may enter and view only the records your role allows, and only for the program. Payment screenshots and health details must be handled with the same care as the rest of the patient record.
+
+
+
Google Calendar and Google Meet
+
+ Connecting a Google account is optional and is done from My profile. If you connect, you authorize VirtualPR to use your Google account email, to create, update, and delete calendar events for your program sessions, and to create the Google Meet link for those events. VirtualPR does not read the rest of your calendar.
+
+
+ You can disconnect at any time from My profile, or by removing VirtualPR from your Google Account permissions. Your use of Google services also remains subject to Google’s own terms. Our handling of Google data is described in the Privacy Policy.
+
+
+
Messages
+
+ The service can send email and WhatsApp messages that the program configures, including session notices. Do not use those tools to contact people who have opted out, or for messages unrelated to the program.
+
+
+
Availability
+
+ We provide VirtualPR for the program’s operations. We may change, suspend, or stop a feature, including when a third-party service such as Google, email, or WhatsApp is unavailable. Scheduled sessions and records may be interrupted during maintenance.
+
+
+
Ending access
+
+ We may disable an account that is unused, no longer authorized by the program, or used in breach of these terms. You may ask us to close your staff account by emailing support1@stratawiz.com.
+
+
+
Liability
+
+ VirtualPR is an operational tool for the program. Clinical decisions remain with the responsible clinicians. To the extent the law allows, we are not liable for indirect or consequential loss arising from use of the service, or for a failure caused by a third-party service.
+
+
+
Changes
+
+ We may update these terms. The date at the top of this page will change when we do. Continued use of VirtualPR after an update means you accept the updated terms.
+
+
+
Contact
+
+ Stratawiz, for VirtualPR at https://pulmorehab.virtualengage.in. Email support1@stratawiz.com.
+