Last updated: [date] · Versions: ES · IT · EN
This policy describes how SpeakiKids processes personal data under Regulation (EU) 2016/679 ("GDPR") and other data protection laws applicable in the European Union, including Spain's LOPDGDD (Organic Law 3/2018) and Italy's Privacy Code (Legislative Decree 196/2003, as amended).
[company name / owner], tax ID [tax ID], registered address [full address] ("SpeakiKids", "we"). Privacy contact: hola@speakikids.com.
SpeakiKids is a professional platform for speech therapists. We therefore act in two distinct roles:
| Data | SpeakiKids' role | Data controller |
|---|---|---|
| The therapist's professional account, subscription and billing data; data of visitors to this website | Controller | SpeakiKids |
| Data of patients (minors) and their families entered into the platform | Processor (Art. 28 GDPR) | The therapist or clinic who registers the patient |
Processing on behalf of professionals is governed by the Data Processing Annex included in our Terms and Conditions. To exercise rights over a patient's data, the most direct route is to contact the professional handling the case; you can also write to us and we will forward the request.
Professional name, email, password (encrypted), language, clinic name (optional), and subscription and payment data. Card details are handled directly by Stripe; we never see or store them.
First name or alias, age, working language, level, any clinical notes or goals the professional chooses to record, and exercise results (accuracy, practice time, frequent errors). Clinical notes and results are health data (special category, Art. 9 GDPR).
Only a username chosen by the professional and a password (encrypted). We do not ask for the family's email, phone number or any other contact details.
Some pronunciation games optionally use the browser's own speech recognition (Web Speech API) to check whether a word was said correctly. Depending on the browser, the audio may be processed on the device or sent to the browser vendor's servers (for example, Google in Chrome or Apple in Safari) solely to transcribe it. SpeakiKids never receives, records or stores the child's voice: we only use the transcribed text to score the exercise, and that transcription is not stored. The microphone requires the device's explicit permission, can be declined at any time, and every exercise can be completed without it.
If you leave your email in the news form, we store only the address and the sign-up date, to notify you about the launch and news (legal basis: your consent, Art. 6(1)(a) GDPR). You can unsubscribe at any time by writing to us or via the unsubscribe link in the emails themselves.
The informational website uses no analytics or advertising cookies. See the Cookie Policy.
| Purpose | Legal basis |
|---|---|
| Providing the service: professional account, dashboard, exercise tracking, reports | Performance of a contract (Art. 6(1)(b) GDPR) |
| Subscription management, payments and invoicing | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c): tax and accounting law) |
| Operational communications (trial expiry, service notices, password recovery) | Performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) |
| Platform security, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Processing patients' health data on behalf of the professional | Art. 9(2)(h) GDPR: health care purposes under the responsibility of a professional subject to professional secrecy. Consent of the holders of parental responsibility is obtained by the professional handling the case |
Patients are minors whose data is entered and managed by their speech therapist in the course of a professional intervention, with the informed consent of parents or guardians, which the professional must obtain and keep. SpeakiKids does not offer the service directly to children and does not request data from them: the child logs in with the username and password the family receives from the professional.
Data is kept while the account is active. The professional can archive or delete patient records at any time and, when the contract ends, may request the return or deletion of the data (as per the Data Processing Annex). Expired trial accounts and their data are deleted after a reasonable period following expiry, with prior notice. Billing data is kept for the periods required by tax law. Note: the duty to retain clinical records rests with the healthcare professional, not with the platform.
We do not sell data or share it with third parties except where legally required. We use these providers:
| Provider | Service | Safeguards |
|---|---|---|
| Supabase | Database and authentication | Data Processing Agreement (DPA); Standard Contractual Clauses (SCCs) for any international transfer |
| Vercel | Web application hosting | DPA; SCCs / EU-U.S. Data Privacy Framework |
| Stripe | Payment processing | DPA; SCCs / EU-U.S. Data Privacy Framework; PCI-DSS certified |
Where any of these providers processes data outside the European Economic Area, the transfer relies on a European Commission adequacy decision or Standard Contractual Clauses (Arts. 45 and 46 GDPR).
In addition, when the microphone exercises are used, the browser vendor (e.g. Google or Apple) may process the audio to transcribe it, as explained in section 3.4. That processing is carried out by the device's browser under its vendor's privacy policy; SpeakiKids takes no part in it and never receives the audio.
We apply appropriate technical and organisational measures (Art. 32 GDPR): TLS encryption in transit, hashed passwords, row-level security in the database (each professional can only access their own patients, and each family only their own child's data), pseudonymisation of children's data, and least-privilege access. In the event of a breach posing a risk, we will notify the competent authority within 72 hours (Art. 33 GDPR) and affected professionals without undue delay.
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to hola@speakikids.com, attaching information that allows us to verify your identity. We will respond within one month. If you believe the processing is not compliant, you may lodge a complaint with your national supervisory authority — in Spain, the AEPD (www.aepd.es); in Italy, the Garante (www.garanteprivacy.it); a full list is available from the European Data Protection Board (edpb.europa.eu).
For a patient's data, the controller is their therapist: please contact them first; in any case, if you write to us we will forward your request to the relevant professional.
We will publish any changes to this policy here and, if substantial, notify registered professionals by email before they take effect.