EPSpeak Privacy Policy

1. Who we are and what this policy covers

EPSpeak ("EPSpeak", "we", "us", "the app") is a medication and symptom companion app operated by MANOAI Pty Ltd (ABN 48 689 793 244, ACN 689 793 244), of Capital Square Towers, Level 25, Tower 3, 1 Spring Street, Perth WA 6000, Australia.

This policy covers the EPSpeak app on Google Play and the App Store, and this website, epspeak.co. It explains what personal information we collect, why, how it is stored and protected, and the choices and rights you have.

For any privacy question or request, email info@epspeak.co. You can also reach MANOAI at admin@manoai.ai.

2. EPSpeak is a self-monitoring tool, not a medical device

EPSpeak helps you record short daily voice samples and keep track of your wellbeing, medications and voice-pattern trends over time, for your own awareness. It does not diagnose, treat or prevent any condition, and the scores it shows are not a medical assessment. Always speak with a qualified health professional about any health concern.

Do not use EPSpeak in an emergency. In Australia, call 000 in an emergency, or Lifeline on 13 11 14 for crisis support at any time.

3. Information the app collects

You create most of this information yourself by using the app. Some of it is generated by your phone while you record or sync.

Information you create in the app:

• Voice recordings. When you complete a check-in, the app records an audio file (WAV) of you reading a short affirmation aloud. This is the main input the app analyses.
• Voice-analysis results. Acoustic measures calculated from your recordings, and a Combined Voice Change Score from 0 to 100 that compares each recording with your own earlier ones.
• Wellness check-ins. Your answers (each from 0 to 3) to six self-report wellness questions, the total score, and an optional note that you reviewed the check-in with your clinician.
• Medication log. The medications you choose to record: name, dose, how often you take it, and the dates of any changes.
• Medication reminder responses. If you turn reminders on, each time you tap Taken or Skip we record which medication it was and when, so a recording can be related to your dosing.
• Mood and context. An optional emotion and intensity you choose before recording, and the text and language of the affirmation you read.

3.1 Information collected by your phone

• Motion-sensor readings. While, and only while, a voice recording is in progress, the app reads your phone's accelerometer and gyroscope to measure how steadily the phone is being held: how much it moves, how often it oscillates, and how smoothly you move while reading. The raw sensor stream never leaves your phone and is never stored. Only these summary measures are uploaded, attached to the recording they came from. Sensing starts when recording starts and stops when it stops.
• Wearable health and activity data (optional). If you choose to connect a fitness tracker, we access your data through the Google Health API, with your separate consent on Google's own screen. We read daily and per-minute step counts, distance walked, recorded exercise sessions, sleep stages, heart rate and heart-rate variability, and work out daily movement summaries from them. Connecting also has to be approved for your Google address, which is arranged with the research team. You can disconnect at any time in Settings, which deletes our stored access to your Google account. If you never connect a tracker, none of this applies.
• Demographic information. Provided once, when you first open the app: sex, age range, country, and the type of medication you take.
• Identifiers. When you first open the app, it signs you in anonymously through Firebase Authentication and receives a randomly generated user ID. This ID links your data to your installation. The app also creates a one-way hashed identifier from it.
• Device and technical information. Operating system name and version, app version, and recording-quality measures such as signal level and background noise.

3.2 A note about the Google Health permission

One permission we must request is broader than what we use. To read heart rate and heart-rate variability, the Google Health API offers no narrower permission than googlehealth.health_metrics_and_measurements.readonly, which also covers other health metrics, including body weight, blood pressure and blood glucose. Google's consent screen will therefore describe more than we actually read.

We do not request, read, calculate anything from, or store any of those other metrics. The app contains no code that reads them. We are telling you this because the consent screen cannot.

3.3 What we do not collect

• Your name, email address or phone number
• Your contacts
• Your precise or GPS location
• Advertising identifiers. EPSpeak is not used for advertising of any kind.

4. Information this website collects

This website, epspeak.co, is an information site. It has no accounts, no forms and no sign-up, and it sets no cookies. It does not use analytics, advertising or tracking scripts, and it does not load third-party fonts or embeds that could track you.

The site is hosted by Cloudflare. Like any web host, Cloudflare processes basic technical information when your browser requests a page, such as your IP address, browser type and the page requested, in order to deliver the site and protect it from abuse. We do not use this information to identify you.

If you email us, we use your email address and message only to reply to you and to keep a record of the conversation.

5. How we use your information

We use the information described above only to:

• analyse your voice recordings and calculate your voice-pattern scores;
• show you your trends, wellness history and medication log over time;
• set and refine your personal baseline, so your scores are meaningful for you;
• keep the app reliable, for example by telling genuine recordings apart from offline estimates and checking recording quality;
• relate each recording to its context, such as where it falls in your dosing, your recent check-ins and what you take, so a change in your readings can be understood rather than just seen;
• support the possible future development of voice-analysis models, but only using data from people who have separately and explicitly enrolled in the pilot study (see below);
• produce aggregate counts of how the app is being taken up (see below).

We do not sell your personal information, and we do not use it for third-party advertising or for profiling unrelated to how the app works.

5.1 The pilot study

Research use is limited to people who have separately and explicitly enrolled in the EPSpeak pilot study. Enrolment is done by us, by hand, for a named person who has consented to it. An ordinary installation is never placed into the study by default, and ordinary use of the app never contributes to model training.

5.2 Aggregate counts

We keep simple running totals of how the app is being taken up: how many installations there were in a month, from which countries, and their age band, sex and medication-type distributions. These are counts and nothing else. They carry no identifier, and each figure covers a single characteristic rather than a combination, so no figure describes a group small enough to point to anyone. Because they are not personal information, they are not deleted with the rest of your data (see section 10).

6. The law that applies, and our legal basis

MANOAI is an Australian company, so the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to everything in this policy. Under the Act, health information, which includes your voice recordings, motion measures, wearable data, wellness answers and medication log, is sensitive information. APP 3 allows us to collect it only with your consent and only where it is reasonably necessary for our functions. That is why the app asks for your consent before it collects anything.

Where UK or EU data-protection law also applies, we rely on your consent, which you give before any data is collected and can withdraw at any time (see section 11), and on our legitimate interest in operating and securing the app. Voice recordings, motion measures, wearable health data, and wellness and medication entries are health data (special-category data), which we process only on the basis of your explicit consent.

6.1 Voice and motion data

A voice recording can identify a person, and we analyse its acoustic characteristics. In principle the same is true of how you hold and move a phone. We do not use either to identify or verify anyone, and we run no voice-matching or motion-matching system: the analysis only compares your readings with your own earlier ones. Because some places treat data like this as biometric regardless of purpose, we treat voice and motion data as sensitive health data throughout this policy and process it only with your explicit consent.

7. Where your information is stored and how it is protected

App data is stored using Google Firebase and Google Cloud Platform services (Firebase Authentication, Cloud Firestore and Firebase Storage), which act as our data processor. Google may store and process data on infrastructure outside your country, including in the United States.

• Data is sent over encrypted connections (HTTPS/TLS) and encrypted at rest by Google Cloud.
• Security rules mean each installation's data can only be read or written by that same signed-in installation. One user cannot access another user's data.

8. Sharing and disclosure

We do not share your personal information with anyone except:

• service providers that process data on our behalf and under our instructions, currently Google for the Firebase and Google Cloud services described above;
• a clinician you choose, and only when you choose to share your record with them using the app's QR code;
• where the law requires it, in response to legal process, or to protect someone's rights or safety.

We never sell your data, and we never share it with advertisers or data brokers.

9. Overseas disclosure

Your information may be processed outside your own country, including in the United States. For Australian users this is a cross-border disclosure under APP 8: we disclose your personal information to Google (Firebase and Google Cloud) as our processor, and it may be held on infrastructure outside Australia. We take reasonable steps to make sure it is handled consistently with the Australian Privacy Principles. Where other laws require it, we rely on appropriate safeguards such as Google Cloud's standard contractual clauses.

10. How long we keep your information

• Voice recordings (the audio files) are deleted after 7 days, unless you are an enrolled pilot-study participant. A scheduled job runs every day to remove them. For ordinary users we keep only the scores calculated from recordings, not the recordings themselves.
• If you are not an enrolled pilot-study participant, everything else we hold for you is deleted once you have been inactive for 30 days. A daily job finds the most recent dated record for your installation, and if it is more than 30 days old it removes all of your data: voice-analysis results, motion measures, wellness entries, medication entries, wearable summaries and demographics. There is nothing to opt into or switch off. Your cloud history is kept while you use the app and cleared if you stop. Trends stored on your own phone are not affected.
• For enrolled pilot-study participants, data is kept for as long as the installation exists and is in use, so long-term trends can be seen.
• If you delete your data or ask us to (section 11), we delete it as described there.
• An installation for which we hold no dated record is kept rather than removed, because its age cannot be determined.
• Aggregate counts (section 5.2) are kept indefinitely. Deleting your data removes everything we hold about you, but it cannot reduce a running total that no longer refers to anyone in particular. Nothing about your medications, recordings, check-ins or movement data is included in these totals.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal information, and to withdraw your consent.

• Delete all your data in the app. Go to Settings, then Privacy & data, then Delete my data. This permanently and immediately erases all of your data, including voice recordings, scores, wellness check-ins, medication log and demographics, from your phone and from EPSpeak's cloud, and gives your installation a new anonymous ID. Because the app uses an anonymous account, you can do this yourself without contacting us or proving who you are. It cannot be undone.
• Reset your voice baseline. You can reset just your voice baseline in Settings without deleting anything else.
• Access, correction or export. Because we do not collect your name or email, we cannot look your data up by name. For an access, correction or export request, or if in-app deletion fails, email info@epspeak.co. We will respond within 30 days, and we may ask for information that helps us find your data.
• Withdraw consent. You can withdraw consent at any time by deleting your data as above and no longer using the app.
• Complaints. If you are unhappy with how we have handled your personal information, please contact us first so we can try to put it right. You can also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

12. Children

EPSpeak is intended for people aged 16 and over and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, email info@epspeak.co and we will delete it.

13. Changes to this policy

We may update this policy from time to time. When we do, we will publish the new version here and change the "Last updated" date. Where a change is significant, we will also let you know in the app.

14. Contact us

EPSpeak, operated by MANOAI Pty Ltd (ABN 48 689 793 244, ACN 689 793 244), Capital Square Towers, Level 25, Tower 3, 1 Spring Street, Perth WA 6000, Australia.

Email info@epspeak.co, or MANOAI at admin@manoai.ai. Company website: manoai.ai.