1. Introduction
SpeechLP Corp. (“we,” “us,” “our”) operates Speechtherapist.app (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
2. Information We Collect
Account Information
When you sign up, we collect your name, email address, and profile photo via Google OAuth. We do not store your Google password.
Protected Health Information (PHI)
Patient records, session transcripts, audio recordings, SOAP notes, and clinical data you enter are treated as PHI under HIPAA. This data is encrypted at rest and in transit.
Usage Data
We collect anonymized usage analytics (page views, feature usage) to improve the Service. These never contain PHI.
3. How We Use Your Information
- Provide, maintain, and improve the Service
- Generate AI-powered clinical notes and reports from your session data
- Process payments via Stripe (we never store card numbers)
- Send transactional emails (account, billing, security alerts)
- Comply with legal obligations including HIPAA
4. Data Sharing
We do not sell your data. We share information only with:
- Service providers bound by Business Associate Agreements (BAAs): Google Cloud Platform (infrastructure and database hosting) and Anthropic (AI processing). Speech-to-text audio is transcribed entirely on-device without third-party audio transmission.
- Stripe for payment processing (PCI-DSS compliant)
- Law enforcement only when required by valid legal process
5. Data Security
We implement administrative, technical, and physical safeguards including:
- All data and audio files are encrypted at rest and in transit
- All data is stored and processed in the United States (Google Cloud and Vercel US regions)
- Tenant-isolated, role-based access controls preventing cross-organization data access
- Client clinical data is never used to train or fine-tune artificial intelligence models
- Append-only HIPAA audit logging of all PHI access
- Content Security Policy and strict security headers
- Regular security reviews and penetration testing
6. Data Retention
PHI is retained for the duration of your account plus 7 years, consistent with clinical record-keeping requirements. You may request data export or deletion at any time by contacting us. Audit logs are retained for a minimum of 6 years per HIPAA requirements.
7. Your Rights
You have the right to:
- Access your personal data and PHI
- Request correction of inaccurate data
- Request deletion of your data (subject to retention requirements)
- Export your data in a portable format
- Receive an accounting of PHI disclosures
8. Student Data and FERPA
When a school, district, or education agency (an “Educational Institution”) uses SpeechLP or SpeechTherapist.app, information about its students is an education record under the Family Educational Rights and Privacy Act (FERPA), and the following applies:
- School official. We act as a “school official” with a legitimate educational interest, under the direct control of the Educational Institution, and use student data only to provide the services the Educational Institution has requested.
- Ownership. The Educational Institution owns and controls all student data. We do not sell student data, use it for targeted advertising, build advertising profiles from it, or use it to train AI models or for research.
- No re-disclosure. We do not disclose student data to anyone other than the Educational Institution and the service providers listed in this policy, each of which is bound by written confidentiality obligations. We disclose it to others only when required by law, after notifying the Educational Institution unless the law prohibits it.
- Directory information. We do not collect, publish, or disclose directory information.
- Parent and student rights. Requests from parents or eligible students to review or correct education records are directed to the Educational Institution. We help the Educational Institution respond within the timeframes FERPA requires.
- Deletion. When the Educational Institution asks, or when our agreement ends, we delete or return its student data within 60 days and confirm in writing.
- Security incidents. We notify the Educational Institution without unreasonable delay, and within 72 hours, of any confirmed unauthorized access to its student data.
- COPPA. Where an Educational Institution provides consent on behalf of parents for students under 13, we collect and use that information solely for the educational purpose the Educational Institution authorized and for no other commercial purpose. We keep a written data retention policy and information security program, as COPPA requires.
- HIPAA. Student records held by an Educational Institution are governed by FERPA rather than HIPAA. Where we support a HIPAA covered entity, such as a clinic or a school-based health program billing Medicaid, we sign a Business Associate Agreement and handle that information as protected health information.
- Agreements. We sign student data privacy agreements, including the Student Data Privacy Consortium’s standard agreement, and a HIPAA Business Associate Agreement where applicable. Where an agreement conflicts with this policy, the agreement governs.
9. Children's Privacy
The Service is intended for use by licensed speech-language pathologists and is not directed at children under 13. While the Service manages pediatric patient data, this data is entered and controlled by the clinician, not the child.
10. Changes to This Policy
We will notify you of material changes via email and update the “Last updated” date. Continued use after changes constitutes acceptance.
11. Contact Us
For privacy inquiries or to exercise your rights:
Email: privacy@speechtherapist.app
SpeechLP Corp., a subsidiary of ParagraphAI Inc., 6 Eglinton Ave E, Suite 200, Toronto, ON M4P 1A6, Canada