Privacy Policy

1. Introduction

Welcome to Voxoap ("we," "our," or "us"). We are committed to protecting your privacy and explaining how we collect, use, and protect personal information when you use our websites, applications, and related services (collectively, the "Service"). Voxoap provides administrative session documentation tools: for example, turning voice into structured notes that you review, edit, and approve.

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

2. Data Controller

Contact email: contact@voxoap.com
Website: voxoap.com

For purposes of the General Data Protection Regulation (GDPR) and similar laws where applicable, the operator identified above is the data controller for personal information processed through the Service, unless we state otherwise for a specific processing activity.

3. Information We Collect

We collect information needed to run the Service and communicate with you:

3.1. Account and contact information

• No cloud practice account in v1: client lists, session notes, and invoices are stored on your device. We do not host a practitioner database of your clients for the current app release.
• Email address: if you join a waitlist or contact us, for service communications
• Store purchase identity: App Store / Google Play and RevenueCat may process subscription entitlements; that is separate from storing your client notes

3.2. Content you provide (including session documentation)

• Voice audio: when you record or upload audio for transcription or note generation
• Transcripts and notes: text generated or edited in the Service, including structured notes and related metadata you choose to save
• Client or session records: information you enter about people you work with stays on your device. Transcripts or audio you submit for note generation are processed by our AI service as described below and are not retained as a practice database

3.3. Technical and usage information

• Device and app data: device type, operating system, app or browser version where relevant
• Usage data: features used, approximate timestamps, and diagnostic events to operate and improve the Service
• IP address and logs: for security, abuse prevention, and troubleshooting

3.4. Waitlist and marketing site

If you join a waitlist or submit a form on our marketing site, we collect the information you submit (for example email address) to contact you about the Service.

4. How We Use Your Information

We use personal information to:

• Provide, maintain, and secure the Service
• Process audio and text to produce drafts you can review and approve
• Process transcripts or audio briefly to draft notes; we do not keep a cloud copy of your full practice data in v1
• Communicate with you about the Service, including support responses
• Detect, prevent, and address fraud, abuse, and security issues
• Comply with law and enforce our terms
• Improve the Service in line with this policy

5. Legal Basis for Processing (GDPR)

Where GDPR applies, we rely on:

• Contract (Article 6(1)(b)): processing needed to provide the Service you request
• Legitimate interests (Article 6(1)(f)): for example security, analytics at an aggregate level, and product improvement, balanced against your rights
• Consent (Article 6(1)(a)): where we ask for consent for optional communications or optional cookies, when applicable
• Legal obligation (Article 6(1)(c)): where the law requires processing

6. Third-Party Services and Processors

We use infrastructure and service providers to host and operate the Service. Examples may include:

• Google AI services (such as Gemini): used server-side to process content you submit when AI features are invoked. See Google's privacy documentation for those services.
• API hosting: cloud providers that run our note-generation API and related networking.
• RevenueCat and app stores: subscription and purchase processing.
• Analytics (when enabled): product usage analytics providers such as PostHog.

We require subprocessors to protect personal data through appropriate agreements. The specific providers and purposes may evolve; we will update this policy for material changes where required.

7. International Transfers

Your information may be processed in the United States and other countries where we or our providers operate. Where GDPR applies, we use appropriate safeguards such as Standard Contractual Clauses or other mechanisms recognized by applicable law.

8. Retention

Practice data in the mobile app is stored on your device. Deleting the app deletes that local data unless you exported a backup. For AI generation requests, we process transcripts or audio to produce a draft and do not keep a long-term practice database of your clients. Server logs may be kept briefly for security and abuse prevention. Waitlist emails and support messages are retained as needed to communicate with you, unless a longer period is required by law.

9. Your Rights (including GDPR and similar laws)

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete certain information, subject to exceptions
• Restrict or object to certain processing
• Data portability, where applicable
• Withdraw consent where processing is consent-based
• Lodge a complaint with a supervisory authority

To exercise these rights, contact contact@voxoap.com. We will respond within the timeframe required by law.

10. Cookies and Similar Technologies

Our websites may use cookies or similar technologies for essential operation, preferences, and analytics. Where required, we obtain consent before non-essential cookies. You can control cookies through browser settings.

11. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including encryption in transit where appropriate and access controls. No method of transmission or storage is 100% secure.

Important: Unless we explicitly offer and contract for a HIPAA business associate relationship for a specific product tier, the Service is not marketed as a HIPAA compliance solution. You are responsible for deciding whether the Service fits your regulatory obligations.

12. Data Breach Notification

If we become aware of a breach that requires notification under applicable law, we will notify regulators and affected individuals as required.

13. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. Contact us if you believe we have done so.

14. AI Processing

Parts of the Service use AI to help format or draft content from your inputs. You remain responsible for reviewing outputs before relying on them. We configure providers to limit misuse of data in line with our agreements; model training use varies by provider and product configuration, and we describe material choices in product documentation when they change.

15. Sharing and Disclosure

We do not sell your personal information. We share information with subprocessors who help us operate the Service, when required by law, or to protect rights, safety, and security.

16. Contact

Questions about this Privacy Policy: contact@voxoap.com. Subject line: Privacy inquiry.

17. Changes

We may update this Privacy Policy from time to time. We will post the updated version and adjust the "Last Updated" date. If changes are material, we will provide additional notice as appropriate (for example email or in-product notice).