Privacy Policy
1: Who We Are and What This Policy Covers
SpeechATTAX Privacy Policy. Last updated: 4th November 2026
Melbourne Digital Therapeutics Pty Ltd (ABN 47 664 944 405) ("we", "us", "our") operates SpeechATTAX, a home-based digital speech therapy program, including the website at www.speechattax.com and the SpeechATTAX application (together, the "Services"). Our registered address is PO BOX 4203, Fitzroy, Melbourne Australia 3065.
We respect your privacy and are committed to protecting your personal information. This policy explains what we collect, why, who we share it with, where it may be sent, how long we keep it, and the rights you have under the laws that apply to you, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the EU and UK General Data Protection Regulation (GDPR), the Privacy Act 2020 (New Zealand), and US federal and state privacy laws.
This policy applies to visitors to our website, people who use the app to practise speech exercises ("patients" or "users"), carers and family members who help them, and clinicians and clinic staff who use the Services ("clinicians"). If your clinic or health service provides SpeechATTAX to you, that clinic may also handle your information under its own privacy notice, and we may act on its behalf (see section 4).
In this policy, personal information means information about an identified or reasonably identifiable individual. Sensitive information (Australia) and special category data (EU/UK) include health information and biometric information used to identify a person.
2: Information We Collect
We collect the following. We collect only what we need to deliver and improve the Services, and we collect sensitive information only with your consent or where the law otherwise permits. If you give us information about someone else, such as a person you care for, you confirm you are entitled to do so. If you decline to give us information we ask for, we may not be able to provide some or all of the Services.
| Category | Examples | How we collect it |
|---|---|---|
| Contact and enquiry details | Name, email, organisation, reason for enquiry, message text | You submit the contact form or email us |
| Account details | Name, email, password (stored hashed), role (patient, carer, clinician), clinic | You or your clinic create your account |
| Voice and speech recordings | Audio of speech exercises (loudness, pitch, clarity, functional phrases) [and any derived acoustic measures such as intelligibility, pitch and intensity] | Captured by the app through your device microphone while you practise |
| Health information | [Diagnosis (for example Friedreich's ataxia or spinocerebellar ataxia), clinician-allocated tasks, progress and outcome measures, clinician notes] | You, your clinician or your clinic provide it; generated as you use the app |
| Biometric information | Voice recordings are not used by us to identify or authenticate you | Not applicable unless confirmed otherwise |
| Device and usage data | Device type, operating system, app version, IP address, session times, error logs, practice frequency | Collected automatically |
| Website data | Pages visited, referring site, approximate location, cookie identifiers | Cookies and similar technologies on our website (section 5) |
| Billing details | Billing name, billing address, transaction reference. Card numbers are handled by our payment provider, not by us | When you or your clinic purchase a program |
| Research data | [Data collected under an approved research protocol, covered by a separate participant information and consent form] | Only if you join a study |
3: How We Use Your Information and Our Legal Bases
We use personal information only for the purposes below, or for a directly related purpose you would reasonably expect.
Consent. Where we rely on consent, we ask for it separately from other terms and before collection. You may withdraw it at any time by contacting us or using the app settings. Withdrawal does not affect processing done before withdrawal, and it may mean we can no longer provide the Services to you.
What we do not do. We do not sell your personal information. We do not use your recordings or health information for advertising or to build advertising profiles. We do not permit third-party advertisers on our Services.
Australia. We collect sensitive information, including health information and voice recordings, only with your consent or as otherwise permitted by APP 3. United States. Where state law requires it (for example Washington's My Health My Data Act), we obtain separate consent before collecting consumer health data beyond what is needed to provide the Services, and separate authorisation before sharing it.
| Purpose | Information used | Legal basis (EU/UK) |
|---|---|---|
| Provide the program: deliver exercises, give biofeedback, track progress, allow clinician review and check-ins | Account, recordings, health information, usage data | Contract (Art. 6(1)(b)); for health data, your explicit consent (Art. 9(2)(a)) [or Art. 9(2)(h) where a clinician provides care and professional secrecy applies] |
| Respond to enquiries and communicate about the Services | Contact details | Legitimate interests (Art. 6(1)(f)) or consent |
| Operate, secure and maintain the Services, prevent misuse | Device, usage and log data | Legitimate interests |
| Improve and evaluate our products, including de-identified analysis of speech data | Recordings and measures, de-identified where practicable | Consent for sensitive data; [Art. 9(2)(j) with safeguards for research] |
| [Research under an approved ethics protocol] | Research data | Explicit consent and the study's consent form |
| Billing and accounting | Billing details | Contract; legal obligation (Art. 6(1)(c)) |
| Comply with law, regulatory requests, audits and to establish or defend legal claims | As needed | Legal obligation; legitimate interests |
| Marketing emails to people who opt in | Contact details | Consent; you can unsubscribe at any time |
4: Who We Share Information With, and Overseas Transfers
We do not disclose your personal information except as described here.
Your clinician or clinic. If a clinician or clinic enrols you, we share your practice data, recordings and progress with them so they can allocate tasks and review your care. Where a clinic is your health provider, it decides how that data is used for your care. In that case we act as its service provider and process the data on its instructions. [US: where a clinic is a HIPAA covered entity, we handle protected health information under a business associate agreement with that clinic.]
Service providers. We use providers for cloud hosting and storage, email, website hosting (Squarespace), analytics, payment processing and technical support. They may use your information only to provide services to us and must protect it under written agreements.
Research collaborators. [Research partners may receive data under an approved ethics protocol and your consent. Data shared for secondary research is de-identified unless your consent says otherwise.]
Business transfers. If we are involved in a sale, merger, restructure or financing, your information may be transferred to the new owner, who must honour this policy. For sensitive information we will seek your consent where the law requires it.
Legal and safety. We may disclose information where required or authorised by law, to respond to a lawful request, or to prevent a serious threat to life, health or safety.
Aggregated or de-identified data. We may use and share data that no longer identifies you. We commit not to attempt to re-identify it, and we require recipients to do the same.
Overseas transfers. Our hosting and service providers are located in Australia. Your information may therefore be stored or accessed outside the country where you live, including in Australia, the United States and EU member states. For Australian users, we take reasonable steps under APP 8 to ensure overseas recipients handle your information consistently with the APPs, and we remain accountable for it. For EU and UK users, we transfer data outside the EEA or UK only where there is an adequacy decision, or under Standard Contractual Clauses (and the UK Addendum or IDTA) with a transfer risk assessment [and, for US providers certified to it, the EU-US Data Privacy Framework]. You can request a copy of the safeguards we rely on by contacting us.
US restrictions. We do not transfer your health or biometric data to any person or entity in a country of concern, or controlled by one, in a way that would breach US restrictions on bulk sensitive personal data transfers.
5: Cookies and Similar Technologies
Our website uses cookies and similar technologies. A cookie is a small file placed on your device. We use:
Strictly necessary cookies, which keep the site secure and working (including those set by Squarespace, our website host). These do not need consent.
Analytics cookies, which tell us how visitors use the site.
Marketing or social media cookies.
If you are in the EU or UK, we set non-essential cookies only after you opt in through our cookie banner, and you can withdraw consent at any time through the cookie settings link in the website footer. For visitors elsewhere, you can accept or decline non-essential cookies in the banner. You can also block cookies in your browser settings, though parts of the site may not work properly.
We respond to the Global Privacy Control signal as an opt-out of sale or sharing of personal information where the law requires it.
The app does not use advertising identifiers. We do not use session replay or third-party advertising pixels in the app or on pages where you enter health information.
6: Retention, Security and Breach Notification
Retention. We keep personal information only as long as needed for the purposes in section 3 or as the law requires. Our current periods are: [contact enquiries: 24 months]; [account data: for the life of the account plus 12 months]; [voice recordings and health information: [15] years, or the period set by the applicable clinical or research record-keeping rules]; [billing records: 7 years]. When information is no longer needed, we destroy it or de-identify it. Research data is kept for the period set by the approved protocol and applicable guidelines. We cannot delete records we are legally bound to keep.
Security. We use technical, physical and organisational safeguards appropriate to the sensitivity of the data. These include encryption in transit and at rest, access limited to staff who need it, multi-factor authentication for staff accounts, logging and monitoring, supplier security review, and staff privacy training. No system is completely secure, so please protect your login details.
Data breaches. If a breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. For EU and UK data, we will notify the relevant supervisory authority within 72 hours where required and notify you where the breach is likely to result in a high risk to you. We will also meet breach-notification duties under US federal and state law, including the FTC Health Breach Notification Rule where it applies. We will tell you what happened, what information was involved and what you can do.
7: Your Rights and Choices
Your rights depend on where you live. We extend the core rights below to all users where we reasonably can. To use any of them, email privacy@melbournedtx.com (see section 8). We may ask you to verify your identity first, and we will respond within the time the law requires (generally within 30 days; one month under GDPR; 45 days under most US state laws).
Non-discrimination. We will not treat you less favourably for exercising your rights.
Australian users: statutory privacy tort. Australian law now allows individuals to sue for serious invasions of privacy. This does not change how you contact us, and you may also complain to us or the OAIC.
California and other US state residents. In the past 12 months we have collected the categories listed in section 2 and disclosed them for business purposes to the recipients in section 4. We do not sell or share personal information for cross-context behavioural advertising. Sensitive personal information, including health data, is used only to provide the Services. You may appeal a refusal of a request by replying to our decision and writing "Appeal" in the subject line. Washington residents have separate rights over consumer health data, including to withdraw consent and to have data deleted.
EU and UK users. Melbourne Digital Therapeutics Pty Ltd is the controller. You may also lodge a complaint with the supervisory authority in your country of residence, workplace or the place of the alleged infringement.
| Right | Australia (APPs) | EU/UK (GDPR) | US | New Zealand |
|---|---|---|---|---|
| Access your information | Yes (APP 12) | Yes (Art. 15) | Yes, where state law applies (for example California, Washington) | Yes (IPP 6) |
| Correct it | Yes (APP 13) | Yes (Art. 16) | Yes, where state law applies | Yes (IPP 7) |
| Delete it | No general right; we delete or de-identify when no longer needed (APP 11.2) | Yes, in the cases in Art. 17 | Yes, subject to exceptions, where state law applies | No general right; limited by retention duties |
| Receive a portable copy | Not a general right | Yes, for consent or contract-based processing (Art. 20) | Yes, where state law applies | Not a general right |
| Object or restrict processing | Not a general right | Yes (Arts. 18, 21) | Opt out of sale, sharing and targeted advertising where state law applies | Not a general right |
| Withdraw consent | Yes | Yes (Art. 7(3)) | Yes; required for consumer health data under Washington law | Yes |
| Not be subject to solely automated decisions with significant effects | See section 8 | Yes (Art. 22) | Varies by state | Not a general right |
| Complain to a regulator | OAIC | Your local supervisory authority | State attorney general or FTC | Office of the Privacy Commissioner |
7: Children, Automated Processing, Complaints, Contact and Changes
Children. The website is intended for adults. The app may be used by [children and young people only with the involvement and consent of a parent or guardian]. We do not knowingly collect personal information from anyone under [16/18] without verifiable parental or guardian consent. We do not knowingly collect personal information from US children under 13 without verifiable parental consent under COPPA. If we learn we hold such information without consent, we will delete it. Parents and guardians may review, correct or delete their child's information by contacting us.
Automated processing and AI. The app analyses your speech to give you instant feedback and to show your progress. We do not make decisions that significantly affect your legal rights or interests, such as eligibility for care or funding, solely by automated means. Clinicians remain responsible for clinical decisions.
Complaints. Please contact us first so we can try to resolve your concern. We will acknowledge your complaint within [5] business days and aim to respond within [30] days. If you are not satisfied you may contact: the Office of the Australian Information Commissioner (oaic.gov.au); your local EU/UK supervisory authority; the Office of the Privacy Commissioner (New Zealand); or, in the US, your state attorney general or the Federal Trade Commission.
Contact us. Privacy Officer, Melbourne Digital Therapeutics Pty Ltd, PO BOX 4203, Fitzroy, Melbourne Australia 3065. Email: privacy@melbournedtx.com.
Changes to this policy. We may update this policy. We will post the new version with its date on this page and, if the changes are material, notify you by email or in the app. Where the law requires your consent to a new use of your information, we will ask for it before applying the change. We use your information as described in the policy in effect when we collected it, unless you consent otherwise.