1. Who We Are

VoiceBloom ("we", "us", or "our") operates the VoiceBloom communication platform, accessible at voicebloom.ca. We provide augmentative and alternative communication (AAC) tools for children, their families, therapists, and organizations.

VoiceBloom is based in Canada. This privacy policy is written in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), as well as GDPR and CCPA where applicable.

Privacy Officer: For questions about this policy or to exercise your data rights, contact our Privacy Officer at info@voicebloom.ca.

2. Information We Collect

Information You Provide to Us

• Account information: your name, email address, and password when you create an account
• Child profile: your child's first name, age, communication level, and interests (used solely to personalize the app)
• Payment information: processed directly by Stripe (website purchases), Apple (iPhone and iPad in-app purchases) or Google (Android in-app purchases). VoiceBloom never stores your credit card details
• Communications: emails you send to our support team

Information We Collect Automatically

• Symbol usage: which symbols your child taps, in which order, and at what time (used to generate progress reports and personalize the board)
• Session data: session start and end times, tap counts
• Device information: browser type and device type (used for technical support and product improvement)

Information We Do Not Collect

• We do not record audio from your device's microphone
• We do not collect video or photos of your child
• We do not collect your location
• We do not track you across other websites

3. How We Use Your Information

• To provide, operate, and improve VoiceBloom
• To personalize the Responses and coaching, and generate progress reports for your child
• To generate weekly progress reports and IEP notes
• To process payments and manage your subscription
• To send service emails (receipts, trial reminders, password resets)
• To send newsletter and product emails: a welcome series when you create an account or sign up on our website, getting-started tips while you are on a trial, occasional product news, and reminders such as a setup you did not finish or a checkout you left open. Every one of these carries an unsubscribe link. Unsubscribing stops them and does not affect the service emails above, which you keep receiving because they are part of running your account
• To respond to support requests
• To comply with legal obligations

We do not use your child's communication data to train models, and Anthropic does not use our inputs for training under our API agreement. Claude (Anthropic) is used in three places, and only these: drafting your weekly and daily report summaries; answering questions you ask in Coach, where the request includes a summary of that day's symbol activity so the answer is specific to your child; and drafting IEP progress notes for school staff, where the student's name is replaced with a placeholder before the request is sent and restored on your device afterwards, so no identified student record leaves the device. The child's communication board itself sends nothing: the animated character's replies are generated on the device. Anthropic deletes inputs and outputs within 30 days under their standard commercial terms.

4. Consent

Under PIPEDA, we collect and use your personal information only with your knowledge and consent. By creating a VoiceBloom account, you consent to the collection and use of information as described in this policy.

• Express consent: We obtain express consent when you create an account, add a child profile, or start a subscription
• Implied consent: Your continued use of VoiceBloom after being notified of policy changes constitutes implied consent to the updated terms
• Withdrawing consent: You may withdraw consent at any time by deleting your account from your account settings or by emailing info@voicebloom.ca. Withdrawing consent may result in us being unable to provide the service. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal

5. Parental Consent and Children's Privacy (COPPA)

VoiceBloom is used with children but is operated by adults (parents, therapists, or organization administrators). We do not collect personal information directly from children under 13. All child data is provided by an adult account holder on the child's behalf.

Verifiable Parental Consent

Before any child data is collected in a family, clinic or therapist account, the responsible adult must provide consent during onboarding, in accordance with the U.S. Children's Online Privacy Protection Act (COPPA) and applicable Canadian privacy law (PIPEDA, with provincial extensions where they apply, including Quebec's Law 25 and BC's PIPA):

• Parent / legal guardian: sign in under an account you control, attest that you are the parent or legal guardian of the child, and confirm that you are at least 18 years old (we record the year of your date of birth as evidence of adult attestation; we do not store the full date of birth)
• Clinic or therapist proxy: a licensed clinical provider may consent on behalf of the parent, after confirming that they have the parent's authorization and that VoiceBloom will not be used as their system of record. Students added by a school board are covered in Students added by an Ontario school board below

Consent records (method, timestamp, account identity, and adult-attestation evidence) are stored in our database and can be produced on request. We do not collect consent from families for students added by a school board: any notice or consent records for those students are held by the board. You may withdraw consent at any time and request deletion of all child data (see the section below).

VoiceBloom is set up and managed by adults (parents, legal guardians, and the professionals who support a child); children do not create or control accounts. In family, clinic and therapist accounts we obtain verifiable parental consent before a child's information is used, scaled to how that information is used: we use it to operate VoiceBloom and to generate the parent's reports, we do not sell it, and we share it only with the service providers contractually bound to process it solely for us.

The 30-day free trial does not require a credit card. During the trial, verifiable parental consent (VPC) is established by the responsible adult creating and authenticating into an account they control and confirming, during onboarding, that they are the parent or legal guardian, or that they are acting under that parent's authorization. That confirmation is logged with a timestamp, the consent method, and the account identity, and can be produced on request, together with the account-holder authentication and our contractual data-use restrictions on service providers. When an account holder continues on a paid Family or Therapy plan, the payment transaction — processed through Stripe on our website, or through Apple or Google for a purchase made inside the app — adds the "monetary transaction" verification method recognised by the Federal Trade Commission's COPPA Rule (16 CFR § 312.5(b)) and a further record of who consented and when.

For an Education account in Ontario, consent is not the route by which student information reaches VoiceBloom. The school board is responsible for the student information it adds, under Ontario's Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), and we act as the board's service provider. This is set out in the next subsection. For school districts in the United States, FERPA applies instead.

If a future regulatory requirement makes an even stronger verification method necessary for your jurisdiction, we will add it before further data collection and update this policy accordingly.

Students added by an Ontario school board

When an Ontario school board adds a student to VoiceBloom, the board is the institution with custody and control of that student's personal information under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA, R.S.O. 1990, c. M.56), which names a school board as an institution in section 2(1). The board decides the purpose of the collection, gives the notice of collection required by section 29(2), and holds any consent record its own policies call for. VoiceBloom acts as the board's service provider: we use the student's information only to provide VoiceBloom to the board, on the board's instructions.

MFIPPA section 32(d) allows an institution to disclose personal information to a consultant or agent who needs the record to perform their duties, where the disclosure is also necessary and proper in the discharge of the institution's functions. Both parts have to be met. Whether a board relies on that clause for VoiceBloom is the board's own determination and depends on the agreement between us, so we do not claim that status for ourselves.

VoiceBloom is not the Ontario Student Record. Under the Education Act, R.S.O. 1990, c. E.2, section 266, a pupil record is privileged. VoiceBloom is not that record, does not replace it, and is not a system of record. If board staff save a VoiceBloom report into a student's Ontario Student Record (OSR), that copy becomes the board's record and is handled under the board's OSR procedures.

Where student information is stored. Student information from school board accounts is stored in the United States. Our database and file storage run on Amazon Web Services in the us-east-1 region through Supabase, and every serverless function that handles student information runs in the United States on Vercel (iad1). Two small functions that serve public configuration and marketing images run at the Vercel location nearest the visitor, including Montreal for Canadian visitors, and neither one handles student information. Information is encrypted in transit and at rest. We do not host student data in Canada, and a board should treat this as a transfer outside Canada when it does its own assessment.

Notice about digital technology (O. Reg. 52/26). Since July 1, 2026, Ontario Regulation 52/26 under the Enhancing Digital Security and Trust Act, 2024 requires a school board to notify the parent or guardian of a student under 16, and to notify students aged 16 and 17 themselves, about digital technology that collects their personal information, as early in the school year as is operationally feasible. That duty belongs to the board. Our part is to give the board an accurate list of what we hold: on request we will prepare and send a written student data inventory setting out the data elements, what each is used for, and the service providers involved, so the board can write its notice.

Cyber security (O. Reg. 51/26). Ontario Regulation 51/26 places cyber security duties on school boards, not on vendors, so it puts no duties on us directly. A board's duties can still reach us through its agreement with us: an incident on our side can start the board's own reporting clock. We support a board's programme by answering its security questionnaires and by telling the board about an incident that affects its students as soon as we have confirmed it.

If you are a parent and your child's profile was created by the school. The board controls that information, so ask the board first. Its privacy or freedom of information office handles access and correction requests under MFIPPA, and we help the board respond. If you are not satisfied with the board's answer, you can raise it with the Information and Privacy Commissioner of Ontario at ipc.on.ca.

Agreements. We do not ask an Ontario board to sign a United States school privacy contract. A board can work from its own information sharing agreement or privacy schedule, or we will prepare terms with the board.

School districts in the United States. FERPA (20 U.S.C. 1232g) applies to educational agencies and institutions that receive funding from the United States Department of Education. It does not apply to Ontario school boards. For a United States district, whether the district treats us as a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1) is the district's own determination, and it depends on the terms we agree and the control the district keeps over the records. The district is responsible for parental notice and any direct consent its own policy requires. See our FERPA addendum for details.

Specific Uses of Child Data

Child data (communication events, session activity, profile information, and any IEP / progress notes generated) is used only to:

• Operate the AAC communication board for that specific child
• Generate progress reports and recommendations for the parent and any therapist the parent has linked
• Allow the parent or therapist to export, modify, or delete the data
• For a student added by a school board: show school-hours activity to the staff the board has added to that school, and send daily progress emails to a parent only after that parent has confirmed their email address

We do not use child data for advertising, profiling, behavioral targeting, or any secondary purpose. We do not sell child data. Our third-party service providers are contractually prohibited from using child data for any purpose other than operating VoiceBloom.

Optional Features and Opt-Out

Several features that process child data are optional and can be turned off without deleting the account: weekly progress reports, IEP note generation, Coach conversations, and therapist sharing via a linked code. You can toggle these from account settings or simply not use them.

Newsletter and product emails are separate from all of that. Every one carries an unsubscribe link at the bottom, and using it stops them immediately. You do not need to close your account or give a reason, and it does not stop the service emails you still need, such as receipts and password resets.

Child Data Handling

Every child profile is created by an adult: a parent, a clinician, or a member of school board staff. In a family or clinic account, child data (including names, ages, communication levels, and session activity) is associated with that adult account and subject to the adult's data rights. A profile created by a school board belongs to the board's account rather than to a family account, and the board controls it.

Withdrawing Consent for Child Data

You may withdraw consent for your child's data at any time by:

• Deleting your child's profile from your account settings
• Deleting your entire account, which removes all child data permanently
• Emailing info@voicebloom.ca to request selective data removal

Withdrawing consent will result in the permanent deletion of your child's communication data, session history, and progress reports. This action cannot be undone.

If you believe we have inadvertently collected personal data directly from a child under 13, please contact us at info@voicebloom.ca and we will delete it promptly.

6. HIPAA (Therapy and Education Plans)

VoiceBloom is not a system of record for clinical care, electronic health records, or medical billing. Therapists, clinics, and organizations who use VoiceBloom must maintain their primary clinical documentation in their own HIPAA-compliant or otherwise appropriate records system. VoiceBloom is intended as a collaboration and progress-sharing tool, not a substitute for an EHR.

That said, VoiceBloom is built on HIPAA-eligible infrastructure. Our providers Supabase and Vercel both support Business Associate Agreements (BAAs) for healthcare use cases.

• We will work with Therapy and Education plan subscribers to put appropriate BAAs in place on request
• Data is encrypted in transit (TLS 1.2+) and at rest by our infrastructure providers
• Row Level Security ensures users can only access their own data

To discuss HIPAA requirements or request a BAA, email info@voicebloom.ca.

7. Data Sharing

We do not sell, rent, or trade your personal information. We share data only with the following third-party service providers, solely to operate VoiceBloom:

• Supabase: database and authentication hosting (SOC 2 Type II certified)
• Anthropic (Claude API): cloud processing for reports and personalization. Data processed under our API agreement; not used for model training
• Google Cloud Text-to-Speech: optional premium voices only. When a premium voice is selected, the text being spoken (which can include a child's composed phrases) is sent to Google to synthesize audio; the default on-device voice sends nothing. Inputs are not used for model training
• Stripe: payment processing for purchases made on our website (PCI DSS Level 1 certified). Stripe handles all card data; we never see it
• Apple and Google: payment processing for subscriptions bought inside the iPhone, iPad and Android apps. The store handles the payment method under its own terms; we receive only the subscription status, never card data
• RevenueCat: reconciles those in-app store subscriptions with your VoiceBloom account. Receives the account identifier and the purchase record, never child data
• Resend: transactional email delivery
• beehiiv: newsletter and product email delivery, and the list those emails are sent from. Receives your email address and first name, plus a small number of flags that decide which emails you get: whether you are on a trial and when it ends, whether you have finished setting up, and whether you claimed a discount. It never receives your child's name, their words or symbol taps, or any session content. beehiiv is based in the United States and handles this data under a data protection addendum, with standard contractual clauses covering transfers
• Mandrill (Mailchimp): a standby sender for the service emails above. It is not in use today, and is kept configured so transactional email can be switched over quickly if Resend has an outage. If it is ever switched on it receives the same thing Resend does: your email address and the contents of that email
• Vercel: application hosting (SOC 2 Type II certified)
• Sentry: error and crash monitoring (loaded conditionally; receives stack traces, page URL, and anonymous user ID; no symbol-tap content or child names)
• Google Fonts: typography on public marketing pages only (your IP address is sent to Google to fetch fonts; no cookies are set)
• Google Analytics 4 and Firebase Analytics: aggregate usage analytics for the website (Google Analytics 4) and the iOS and Android apps (Firebase Analytics), covering page and screen views, sessions, and feature and conversion events. It is configured for privacy: advertising signals are disabled, Google Signals and ad personalization are turned off, no advertising identifier (IDFA) is collected, and we do not send names, emails, or symbol-tap content. On the website it loads only after you accept optional cookies, and sensitive URL parameters are redacted before any data is sent
• HeyCatch: product analytics for the website and the signed-in account pages, covering page views, clicks, and conversion events such as sign-up and subscription. It receives your email address and internal user id so we can tell repeat visits apart. It is not used in the communication board or in the iOS and Android apps, so it never receives symbol-tap content or your child's words. Session replay and form-input capture are off, and on the website it loads only after you accept optional cookies

We may disclose information if required by law, court order, or to protect the safety of any person.

8. Data Retention

• Account and profile data: retained while your account is active, and for 30 days after account deletion
• Session and symbol tap data: retained for 24 months from collection, then anonymized
• Billing records: retained for 7 years as required by financial regulations
• Support communications: retained for 2 years

You can trigger the 30-day deletion window yourself at any time from account settings → "Delete my account". See section 9 below for the full self-service flow.

9. Your Data Rights

Under PIPEDA, GDPR, and CCPA, you have the following rights over your personal data:

• Access: Request a copy of all personal data we hold about you and your child
• Correction: Update inaccurate or incomplete information via your account or by contacting us
• Deletion: Permanently delete your account and all associated data, including all child profiles, session history, and progress reports
• Portability: Download all your data in a machine-readable JSON format
• Objection: Object to certain types of processing
• Withdrawal of consent: Withdraw consent at any time without affecting prior processing

If your child's profile was created by an Ontario school board, the board controls that information under MFIPPA. Send access and correction requests to the board, and we will help the board respond. See Students added by an Ontario school board.

How to Exercise Your Rights

We have built self-service tools so you can exercise your rights immediately:

• Download your data: Go to account settings and click "Download My Data" to export all your data as a JSON file. This includes your profile, subscription, child profiles, all session data, symbol taps, weekly reports, billing events, and consent records
• Delete your account: Go to account settings and click "Delete My Account". This permanently deletes all your data from our systems, cancels any active subscription billed through our website (Stripe), and removes your authentication credentials. This action cannot be undone. If you subscribed inside the iPhone, iPad or Android app, the subscription is held by Apple or Google and deleting your account does NOT cancel it — cancel it in your Apple Account or Google Play subscription settings, or you will keep being charged
• Other requests: For corrections, objections, or any other data request, email info@voicebloom.ca

We respond to all data rights requests within 30 days. For full details about your rights, see our Your Privacy Rights page.

10. Cookies

VoiceBloom uses essential cookies required for authentication (keeping you logged in) and security. With your consent, we also set optional analytics cookies (Vercel Analytics, Google Analytics, and HeyCatch) to understand how the site is used. You can decline these by choosing "Essentials only" in the cookie banner, and you can change your choice at any time using "Manage cookies" in the footer. We do not use advertising cookies, and we do not use cookies for cross-site advertising or behavioral targeting. The apps do not use cookies for analytics.

11. Security

We protect your data using industry-standard safeguards including TLS encryption in transit, encryption at rest provided by our infrastructure providers, and row-level access controls ensuring users can only access their own data. Our infrastructure providers hold SOC 2 Type II certifications. For full details, see our Security and Compliance page.

Despite these measures, no internet transmission is 100% secure. If you suspect your account has been compromised, please contact us immediately.

12. International Transfers

VoiceBloom is a Canadian business, and our data is stored in the United States. Our database and file storage are hosted on Amazon Web Services in the us-east-1 region through Supabase, and our serverless functions that handle account and child data run on Vercel in the United States (iad1). Stripe and most of our other service providers are in the United States as well. This includes student information from school board accounts. Each provider is bound by contract to protect that information and to use it only to operate VoiceBloom for us, with safeguards consistent with PIPEDA requirements. For users in the European Economic Area (EEA) or UK, transfers are governed by Standard Contractual Clauses.

13. Changes to This Policy

We will notify you of material changes to this policy by email and by posting a notice in the app at least 14 days before changes take effect. Your continued use of VoiceBloom after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

VoiceBloom is operated by a Canadian business. Counter-party legal details (registered business name, BIN, CRA numbers) are provided on signed agreements upon request.

Privacy Officer / data requests: info@voicebloom.ca
General / support: info@voicebloom.ca
HIPAA / BAA requests: info@voicebloom.ca
EU / UK GDPR representative: to be appointed and listed before public launch in EU/UK markets

You also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca), and, depending on your residence, your local data protection authority (e.g., your EU supervisory authority for GDPR matters, the ICO in the UK, or the California Privacy Protection Agency for CCPA matters). If your child's profile was created by an Ontario school board, raise your concern with the board first, and then with the Information and Privacy Commissioner of Ontario (ipc.on.ca).