Privacy Policy
Last updated: August 14, 2026
Introduction
SpeechWay ("we", "our", or "us") is committed to protecting the privacy of speech and language therapists and the clients they serve. This policy explains how we collect, use, and protect your data when you use our voice-to-SOAP documentation service.
We are registered with the UK Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data Controller
For your account and billing data, SpeechWay acts as the data controller.
For client session data (notes, transcripts, client information), you (the therapist) are the data controller, and SpeechWay acts as a data processor on your behalf. You are responsible for having appropriate consent or legal basis to process your clients' information.
What We Collect
| Data Type | Purpose | Retention |
|---|---|---|
| Account info (email, name) | Authentication, communication | Until account deletion |
| Client records (name, goals) | Organise sessions, track progress | Until you delete them |
| Session transcripts | Generate SOAP notes, audit trail | Until you delete them |
| SOAP notes | Clinical documentation | Until you delete them |
What We Don't Store
Audio recordings are never stored
Your voice recordings are processed for transcription and immediately deleted. We never retain audio files on our servers.
How We Process Your Data
1. Voice Recording
Audio is captured in your browser using the MediaRecorder API and transcribed as you speak. Audio is never stored on our servers.
2. Transcription
Audio is streamed securely from your browser to Deepgram for real-time transcription. If a live connection is unavailable, the recording is sent to OpenAI's Whisper API instead. We send every Deepgram request with model-training participation explicitly disabled, and audio is deleted immediately after transcription.
3. SOAP Generation
The transcript is sent to Anthropic's Claude API to structure it into SOAP notes. Anthropic does not use API data for training.
4. Storage
Transcripts and SOAP notes are stored in our UK-based database (Supabase, London region), encrypted at rest and in transit.
Sub-processors
We use the following third-party services to provide SpeechWay. The Agreement column states, honestly and per provider, what contractual protection is currently in place.
| Provider | Purpose | Location | Agreement |
|---|---|---|---|
| Deepgram | Real-time audio transcription (streaming) | US | DPA in progress — see note below |
| OpenAI | Audio transcription (Whisper API, fallback) | US | DPA signed (SCCs + UK Addendum) |
| Anthropic | SOAP note generation (Claude API) | US | DPA in force (SCCs + UK Addendum) |
| Supabase | Database and authentication | UK (London) | DPA signed |
| Vercel | Application hosting | Global (UK primary) | DPA in force |
| Resend | Transactional email (parent consent and session update emails you send) | US | DPA in force |
SCCs = Standard Contractual Clauses; IDTA = the UK International Data Transfer Agreement. Both are ICO-approved safeguards for GDPR-compliant international data transfers.
Deepgram: a Data Processing Agreement has been requested and is not yet executed. In the meantime we send every request with model-training participation disabled, and the temporary credential issued to your browser is scoped to a single session and expires after 60 seconds. We will update this page when the agreement is in place.
Onward processing: Deepgram engages its own sub-processors, which at the time of writing include Anthropic, OpenAI, Cloudflare, Amazon Web Services, Baseten and Oracle Cloud. Their current list is published at deepgram.com/privacy/subprocessors. We will give you notice before adding or replacing any sub-processor of our own, and you may object.
AI and Model Training
Your data is not used to train AI models
OpenAI and Anthropic do not train on data sent through their APIs by default. Deepgram does operate a model-improvement programme that is on by default for its standard rates, so we explicitly opt out of it on every single request. Your session content is not used to improve anyone's models.
Who at SpeechWay Can See Your Records
Most privacy policies leave this unsaid. Because you are trusting us with clinical records about children, we would rather state it plainly.
What is technically possible
SpeechWay is operated by one person. Running the service requires database administration access, and that access is not technically restricted from reading stored records, including transcripts, notes and client details. Our data is encrypted at rest and in transit, but encryption protects against a stolen disk or an intercepted connection — it does not, and cannot, prevent the operator of the service from reading the database. Any provider who tells you otherwise while also running AI over your notes is overstating their position.
What we actually do
We access identifiable clinical content only where it is necessary to deliver the service to you — investigating a fault you have reported, recovering data, or meeting a legal obligation. We do not read your notes to study how you write, to evaluate the product, to build features, or out of curiosity. Under UK GDPR you are the controller and we are your processor: using your records for our own purposes would make us a controller in our own right, which we are not willing to become.
Statistics rather than content
To understand how SpeechWay is used we rely on counts and timings — how many sessions were recorded, how long a note took, whether a generated note was edited — never the clinical text itself. If we want to know what you would change about a note, we will ask you.
Your right to ask
You may ask us at any time whether anyone has accessed your records, and why. Write to privacy@speechway.io and we will answer honestly. If we ever access your clinical content for any reason other than a fault you have reported to us, we will tell you.
Security Measures
- Encryption in transit (TLS 1.2+)
- Encryption at rest (AES-256)
- Row-level security (therapists only see their own data)
- Secure authentication via Supabase Auth
- UK data residency for stored data
Your Rights
Under UK GDPR, you have the right to:
- Access:View all your data through your dashboard
- Rectification:Edit client information and session notes
- Erasure:Delete clients, sessions, or your entire account
- Portability:Request an export of your data
To exercise these rights, contact us at privacy@speechway.io
Health Data
Session notes may contain health-related information, which is considered "special category data" under GDPR Article 9. We process this data on the following lawful bases:
- Article 6(1)(b): Processing is necessary for the contract (providing the service)
- Article 9(2)(h): Processing is necessary for the provision of health or social care (healthcare purposes), with the therapist as data controller
Cookies
We use only essential cookies required for authentication and security. We do not use advertising or tracking cookies.
Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes via email or through the application.
Contact Us
For privacy-related questions or to exercise your rights:
If you're not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk