Data Processing Agreement (DPA)
VoiceBloom offers a Data Processing Agreement (DPA) compliant with GDPR Article 28 and Canadian PIPEDA for Therapy and Education plan customers who require one for their internal procurement or compliance reviews. Family plan customers can also request a copy.
To Request a Copy
Email info@voicebloom.ca with the subject line "DPA Request" from your account billing email. Include:
- Your full legal entity name
- Your registered address
- The name and email of your authorized signatory
We'll return a counter-signed PDF within 5 business days.
Authorized Subprocessors (Annex)
The DPA authorizes VoiceBloom to engage the subprocessors listed on our Subprocessors page, which serves as the agreement's subprocessor annex and is kept current. Each entry states what data the subprocessor receives, where it is stored, and the safeguards that apply. Two commitments follow from that list:
- We give at least 30 days' notice before adding a subprocessor that handles personal data, changing where an existing one stores data, or materially widening the data one receives.
- You may object on data-protection grounds during that period. If we cannot resolve the objection, you may terminate and we will refund any prepaid amounts covering the period after the change.
Analytics subprocessors are limited to the marketing website and the signed-in adult account pages. None of them are loaded inside the communication board or the iOS and Android apps, so no subprocessor in the analytics category receives a child's vocabulary, symbol taps, or composed phrases.
Already signed a DPA? Replacements and amendments are available on request from the same email. The executed DPA is incorporated into our Terms of Service and supplements (does not replace) the commitments in our Privacy Policy and Security page.