Privacy Policy

Introduction

Vochella Technologies Inc. ("Vochella," "we," "us," or "our") operates a HIPAA-compliant platform for Speech-Language Pathologists (SLPs) and their clients. This Privacy Policy describes how we collect, use, disclose, and protect your information when you use our services. We comply with the Health Insurance Portability and Accountability Act (HIPAA) in the United States, the Personal Health Information Protection Act (PHIPA) in Ontario, and the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

Information We Collect

We collect information necessary to provide our services:

• Account information: Name, email address, and credentials you provide when creating an account.
• Protected Health Information (PHI): Client names, health conditions, treatment data, session notes, video submissions, and other clinical information you or your clients enter into the platform.
• Usage data: How you interact with the platform, including features used and session activity.
• Approximate area on our homepage: To open the map of speech therapy practices on your own part of the Greater Toronto and Hamilton Area, our server turns the rough location that arrives with your connection (a city, not a street) into one of six area names and sends back that name alone; the location is not stored, is never sent to anyone else, and is not looked at at all if you decline analytics cookies.
• Payment information: Processed securely by Stripe; we do not store full payment card details.

How We Use Your Information

We use your information to:

• Provide, maintain, and improve our SLP platform and services
• Process payments and send receipts
• Transcribe clinician dictation into session notes. Dictation audio is converted to text by Amazon Web Services (AWS Transcribe) under a Business Associate Agreement, processed transiently, deleted immediately after transcription, and never used to train models.
• Generate AI-assisted documentation for features other than SOAP notes (e.g., session-prep briefs, progress-report narratives, summaries). SOAP notes are not AI-generated. Clinical data for these features is processed through AWS Bedrock under a Business Associate Agreement; we apply the minimum necessary standard and strip direct identifiers where technically feasible. You control whether AI features are enabled for your account.
• Send transactional communications (e.g., session reminders, magic links)
• Comply with legal obligations and enforce our terms
• Support you with technical assistance

Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Infrastructure: Our platform runs on Supabase, a HIPAA-eligible infrastructure provider with whom we maintain a Business Associate Agreement (BAA).
• Access controls: Row-level security ensures users only access their own data. PHI is never exposed to unauthorized parties.
• Audit logging: Access to sensitive data (e.g., receipts, reports) is logged before data is returned.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your data (subject to legal retention requirements)
• Object to or restrict certain processing
• Data portability
• Withdraw consent where processing is consent-based

To exercise these rights, contact us at support@vochella.com.

HIPAA, PHIPA & PIPEDA Compliance

Vochella is designed to meet the requirements of HIPAA (U.S.), PHIPA (Ontario), and PIPEDA (Canada). We enter into Business Associate Agreements (BAAs) with covered entities and ensure that all third-party service providers handling PHI are BAA-compliant. We apply the minimum necessary standard when sharing data and maintain administrative, physical, and technical safeguards as required by applicable regulations.

Third Parties

We work with the following categories of service providers:

• Supabase: Database, authentication, file storage, and the edge functions that run our server-side code. All PHI. Data location: United States or Canada. Business Associate Agreement.
• Amazon Web Services (AWS): Speech-to-text for therapist dictation (Transcribe, with the audio held briefly in S3), the documentation features other than SOAP notes (Bedrock: session-prep briefs, summaries, progress-report narratives), transactional email (SES: receipts, reminders, sign-in links), and text messages (End User Messaging: appointment reminders and the texts after care a client or family agreed to, plus our replies to HELP and STOP; sign-in codes will move here from Twilio). Clinical data with direct identifiers such as client names stripped where technically feasible; dictation audio deleted immediately after transcription; email addresses, mobile numbers, and the text of each message. AWS does not use Vochella data to train models. Data location: United States. AWS Business Associate Addendum (HIPAA-eligible services only).
• Vercel: Hosts the website and the practice portal and renders portal pages on its servers. Portal pages, including PHI shown to a signed-in therapist, are rendered on and served through Vercel's servers in transit; our code keeps PHI out of server logs. Agreement on file; terms available on request.
• Stripe: Payment processing. Payment data only. We use generic descriptions (for example "Treatment Session") and never include a diagnosis or other clinical information, so Stripe does not handle health information on our behalf. Data Processing Agreement; processes no PHI, so no BAA is required.
• Twilio: Sends the one-time sign-in codes for two-step verification today, until they move to AWS End User Messaging. Twilio receives the mobile number and the text of the message, which holds the code, and nothing else from your record. Receives no clinical data. Agreement on file; terms available on request.
• Sentry: Error reports from the website and the practice portal. Which part of our code failed and on which screen, linked to the account id. PHI fields, emails, phone numbers, tokens, cookies and request bodies are removed before anything is sent. Receives no PHI by design. Agreement on file; terms available on request.
• PostHog: Website analytics, only if you accept analytics cookies and only on our public pages and the sign-up flow, plus error reports and a few in-app events from the practice portal and the Vochella app for signed-in therapists only. On the website: which public pages you visit and the steps you take, without your name or email (we remove email addresses and link tokens from page addresses before anything is sent). From the portal and app: which part of our code failed and on which screen, linked to the therapist's account; error messages are not sent, and record numbers and link tokens are removed first. Client and family accounts send nothing. On the website all of this passes through our own servers first, and your sign-in cookies and IP address are never passed on. Data location: United States. Receives no PHI by design. Agreement on file; terms available on request.
• Expo (push notifications): Delivers push notifications to the Vochella app on phones. The device push token and a notification title and body drawn from a fixed copy registry; a client name can never appear in one. Receives no PHI by design. Agreement on file; terms available on request.
• ElevenLabs: Text-to-speech for practice games. Practice words only: the written words a game reads aloud, such as the words a therapist types for home practice. It never receives recordings or account details. Receives no PHI. Agreement on file; terms available on request.
• OpenAI: Draws the picture cards for practice words (word art). The practice word and a style prompt only; no account, client, or recording data. Receives no PHI. Agreement on file; terms available on request.
• Ahrefs: Counts visits to our public website (the page, the site you came from, your country and device type) so we can see which pages and free tools are useful. Runs only if you allow analytics in the cookie banner, sets no cookies, and never runs in the app, the family portal, or any page that shows client information. Receives no PHI. Agreement on file; terms available on request.

Analytics on our website only run if you accept analytics cookies. You can change or withdraw that choice at any time with Cookie settings, also at the bottom of every page.

We do not sell your personal information or PHI.

Text Messages (SMS)

We send text messages only to people who ask for them. There are three kinds, and each has its own agreement: saying yes to one does not sign you up for another.

• Sign-in codes: a person who adds a mobile number for two-step verification gets a one-time code each time they sign in or ask for a new code. Today these codes are sent through Twilio; we are moving them to AWS End User Messaging.
• Appointment reminders: a client or family who ticks "Text me a reminder the day before" when booking on a practice's booking page gets one text the day before that visit, from that practice, sent through Vochella. The text links to a page to change or cancel the visit. Replying C confirms the visit, and we text back to say so.
• Texts after care ends: sent only when a client or family has told their therapist they agree to texts, the therapist has recorded that in Vochella, and the practice has turned on review requests. When care ends, the practice may send a short series: a question about how likely they are to recommend the practice (0 to 10), a reminder if there is no answer, then a link to leave a review or a request for private feedback, and a reminder about the review link. They may also get a short reply when they text back. Ticking the reminder box on a booking page does not sign anyone up for these.

Message frequency varies: one code each time you ask for one, one reminder for each visit you asked to be reminded about, and a short series after care ends. Message and data rates may apply. Reply HELP for help, or contact us at support@vochella.com. Carriers are not liable for delayed or undelivered messages.

Replying STOP: a STOP reply stops appointment reminders and texts after care to your number. Reply START to get them again. A STOP reply does not stop sign-in codes: when you ask for a code, we still send it, because you need it to sign in.

We text your mobile number only for the messages described here. We do not sell, rent, or share mobile numbers or text-message consent with third parties or affiliates for their marketing. We keep clinical details out of text messages.

Children's Privacy

Our platform includes interactive home practice features designed for use by children under the supervision of their parent, guardian, or treating SLP. When a child uses these features, we may collect:

• Audio recordings of speech exercises (collected only with explicit parental or guardian consent through our in-app consent flow)
• Practice session activity, including responses to exercises and progress data
• A child-friendly display name and age tier selected by the parent or SLP (we do not collect a child's full name, email, or contact information directly)

Parental consent: Before any audio recording or AI-based speech analysis features are enabled for a child, we require verifiable parental or guardian consent through our in-app consent mechanism. A parent or guardian may review, request deletion of, or refuse further collection of their child's data at any time by contacting us at support@vochella.com or through the account settings. How long we keep voice recordings, and how they are destroyed, is set out in our Voice Recording Retention and Destruction Policy.

COPPA compliance (United States): We comply with the Children's Online Privacy Protection Act. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have collected personal information from a child under 13 without proper consent, we will delete that information promptly.

PIPEDA (Canada): For Canadian users, we obtain meaningful consent from a parent or guardian for any collection of personal information from minors, consistent with the Office of the Privacy Commissioner's guidance on consent for minors.

Data Retention

We retain your information for as long as necessary to provide the Service and comply with legal obligations:

• Clinical records (SOAP notes, progress reports, goal data): Retained for at least 7 years in the United States and 10 years in Canada from the date of last contact, or that same period after a minor client reaches the age of majority, whichever is longer. The floor is set per jurisdiction from the practice's registered location.
• Account information: Retained for the duration of your account and for 90 days after you ask to close it, during which you can cancel the closure, unless a longer period is required by law.
• Audio recordings and video submissions: Retained for 90 days from capture, then the file is permanently deleted. Withdrawing recording consent or closing the account schedules deletion sooner. Recordings are not part of the longer clinical record above; the notes and practice results derived from them are. See our Voice Recording Retention and Destruction Policy for the full schedule.
• Payment records: Retained for 7 years as required by tax and financial regulations.
• Audit logs: Retained for a minimum of 6 years.

Upon request for data deletion, we will remove or de-identify personal information that is not subject to a legal retention requirement within 90 days.

Data Residency & Cross-Border Transfers

Our primary infrastructure is hosted by Supabase. Data may be stored and processed in Canada and/or the United States. If you are located in Canada and your data is processed in the United States, that transfer is governed by our BAA and the safeguards described in this policy. We apply the same security and privacy standards regardless of where data is stored.

If your organization requires data to remain within Canada, please contact us at support@vochella.com to discuss available options.

Breach Notification

In the event of a breach of security safeguards involving personal information or PHI, we will:

• Investigate and contain the breach as quickly as possible
• When a breach is logged, Vochella computes the notification deadline for each affected person from their own jurisdiction (72 hours in Canada, 30 days in New York, 60 days elsewhere in the United States under HIPAA) and notifies affected individuals and regulators within the shortest window that applies.
• Notify the Information and Privacy Commissioner of Ontario where required under PHIPA
• Provide a description of the breach, the types of information involved, and steps individuals can take to protect themselves
• Maintain records of all breaches and our response actions

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes affecting how we use PHI, we may provide additional notice via email or in-app notification.

Contact Us

For privacy-related questions, BAA requests, or to exercise your rights, contact us: