Your data, in plain words.
This policy names the companies that process your data, says where that data lives, and tells you the route that actually works for getting it back. Your data is stored in Ireland, it is encrypted, and we keep it for three years.
In short
EaseTalk is a speech practice app. To work, it needs your account details, a record of the practice you do, and the things you write about how it went.
During a live practice your microphone is streamed to our servers so your speech can be recognised. No audio recording is kept against your session. The Sound Setup check measures the room and your voice level and keeps those measurements on your own device.
Your data stays in the EU. It lives in Microsoft Azure's North Europe region in Dublin, with backups in Sweden. The AI runs on Azure AI Foundry, in North Europe or Sweden Central depending on capacity. It is encrypted, and we keep it for three years.
Your therapist only sees anything if you agree separately, and even then they do not see the full transcript of your conversations.
We do not sell your data and we do not advertise to you. This website sets no cookies and loads nothing from anyone else. Signing in sets one cookie, which keeps you signed in and does nothing else.
To ask for your data, correct it, delete it, or take back a permission, email easetalkai@gmail.com with Data request in the subject. We reply within one month.
1In short
The box at the top of this page is the short version, written to be read rather than survived. It is a summary and nothing more. Where the summary and the sections below appear to differ, the sections below are what applies.
This policy covers the EaseTalk mobile app, the therapist portal, and this website. It was last updated on 7 August 2026.
2Who we are
EaseTalk is a speech and communication practice product developed at University College Cork, Western Road, Cork, Ireland. For the personal data described in this policy, EaseTalk decides why and how the data is processed, which makes it the controller under the GDPR.
How to contact us about data protection. Email easetalkai@gmail.com. That is the address monitored for privacy requests, and it is the same one on our contact page. If you would rather write to a named person directly, use mfaggiani@ucc.ie.
You can also write to us at University College Cork, Western Road, Cork, Ireland.
3What EaseTalk is, and is not
Not a medical device
EaseTalk supports communication practice and confidence building. It is not a medical device, a diagnostic tool, or a substitute for care from a qualified speech and language therapist or other healthcare professional. It does not diagnose, it does not decide or recommend treatment, and it does not monitor for crises or emergencies. Your therapist keeps clinical responsibility.
We say this here because it changes how you should read the rest of the policy. The data described below exists to support practice and to let a clinician review that practice. It is not a clinical record and it is not an assessment.
4What we collect, and why
The list below follows how the app actually works. Everything in it is something the product uses. There is no separate collection for marketing, profiling, or advertising, because we do none of those things.
Account and identity
Your user id, email address, first name, last name, an avatar image address if you set one, and which kind of account you have. There are three kinds: person practising, therapist, and internal developer accounts. A person practising may be linked to a therapist, by redeeming an invite from them, or may sign up on their own and stay unlinked.
Why: to create and run your account. Basis: performance of our contract with you, Article 6(1)(b).
Consent records
Three consents are recorded on our servers, each stored as the moment you gave it:
- Terms of service. Required.
- Saving your practice. Required. This covers keeping your conversations, exercise results, how often you practise, and your progress over time.
- Sharing with your therapist. Optional, and only for people practising. It shares the detail of how your practice is going with the therapist you are linked to. Section 10 sets out exactly what that covers and what they see either way. You can take it back.
Why: so we can show that consent was given, as Article 7(1) requires. Basis: legal obligation, Article 6(1)(c).
The app's consent screen also shows a fourth item, described as research and analytics. That item is not currently sent to or stored on our servers, and no processing is carried out on the basis of it. Until it is either implemented or removed from the screen, please treat it as having no effect. We would rather tell you that than let you believe you have granted or refused something that was never recorded.
Practice data
The text of your practice conversations, session details, results against the goals set for an activity, exercise results, your reflections, your mood log, your planner entries, and your progress over time. Our servers also store safety information relating to a session.
Why: to give you the service, to show you your own progress, and, if you have agreed, to let your therapist review it. Basis: your consent, Article 6(1)(a), and because this relates to your health, your explicit consent under Article 9(2)(a).
Technical data
Your device model and operating system, the app version, and a push notification token if you have notifications turned on.
Why: to deliver the app correctly to your device, to fix faults, to keep the service secure, and to send you the notifications you asked for. Basis: performance of our contract, Article 6(1)(b), and our legitimate interest in a working and secure service, Article 6(1)(f).
Audio
Covered on its own in section 5, because it is the part people most want a straight answer about.
Held only on your device
Some things never leave your phone unless you send them. Your sign in tokens are held in the operating system's secure storage, the Keychain on iOS and the Keystore on Android. Your preferences, notification settings and accessibility settings are stored in ordinary app storage. Your Sound Setup measurements, being the room noise level, your voice level and the calibration bands, are held in secure storage on the device.
Cookies
We use one cookie, and only one.
- Signing in. When you sign in to EaseTalk on the web, we set an authentication cookie. It holds your access token and your refresh token, which together are what keep you signed in rather than being asked for your password on every screen. That is the whole of its job.
It is what the rules call a strictly necessary cookie: the service you asked for cannot work without it, so it does not need a consent banner. It is not used for analytics, advertising, profiling or tracking you anywhere, and it goes when you sign out.
This marketing website sets no cookies at all. It also loads no fonts, scripts, images or anything else from another company's servers, which is why you are not asked to accept anything to read it.
What we do not collect
The app contains no analytics toolkit, no crash reporting toolkit, no advertising toolkit, and no third party tracking library. It does not use Firebase Firestore or Firebase Authentication. Google's Firebase Cloud Messaging is present for push notifications and nothing else.
5Audio, specifically
Three separate things happen with sound, and they are worth keeping apart.
During a live practice conversation
While it is your turn, your microphone is captured and streamed to our servers, where speech recognition runs using Microsoft Azure's speech service inside the EU. What comes back to your phone is the generated speech of the character you are talking to, and the conversation itself.
Our servers keep the conversation text, encrypted. They do not attach an audio recording to your stored session. The audio of your turn is cleared rather than filed against the session record.
Sound Setup
The one minute microphone check measures the noise in your room and a comfortable level for your voice. It takes measurements only and does not save a recording. Those measurements stay in secure storage on your own device.
Practice done on the device
Some parts of the app use the speech recognition and speech synthesis built into your own phone, which means that part happens on the device itself and does not reach us at all.
6Our legal bases
Under Article 6 of the GDPR we need a lawful basis for each purpose, and under Article 9 we need a further condition for anything that reveals information about your health. A transcript of the speech of somebody receiving speech and language therapy is health data. We treat it as such.
| What we do | Article 6 basis | Article 9 condition |
|---|---|---|
| Create and run your account | 6(1)(b) contract | Not applicable |
| Keep records of your consents | 6(1)(c) legal obligation | Not applicable |
| Save your practice data, including conversation text, reflections and mood | 6(1)(a) consent | 9(2)(a) explicit consent |
| Recognise your speech during a live practice | 6(1)(a) consent | 9(2)(a) explicit consent |
| Share progress summaries with your linked therapist | 6(1)(a) consent, separate and optional | 9(2)(a) explicit consent |
| Keep the service working, secure and supportable | 6(1)(b) contract and 6(1)(f) legitimate interests | Not applicable |
| Send push notifications you have turned on | 6(1)(b) contract | Not applicable |
Where we rely on consent, you can take it back at any time, and doing so does not make anything we did beforehand unlawful. Withdrawing the required consents means we can no longer provide the app, because there is nothing left to run it on. Section 13 explains how to withdraw.
7AI processing
The conversations in EaseTalk are produced by AI. So that they work, some of what happens in a practice is sent to the AI service. Specifically, the following reaches the AI during a session:
- the words the speech recogniser detected;
- the conversation so far;
- the definition of the scenario you are practising;
- the goals set for that practice;
- relevant account details, including your name.
What comes back is the reply of the character you are speaking to, along with generated speech, and the material used to build summaries and reflection prompts.
Where this happens. The AI models run on Microsoft Azure AI Foundry inside the EU, in the North Europe region in Dublin or in Sweden Central, depending on where capacity is available at the time. Speech recognition runs on Azure in the EU as well. Generated character voices are produced by ElevenLabs.
We do not use your identifiable data to train AI models, and the AI service is configured so that your content is not used to train the underlying models either.
Our AI terms set out what the AI is for and where it stops. Our AI ethics page explains how we handle the fact that speech recognition mishears atypical speech more often than typical speech.
8Who else processes your data
Our previous policy declined to name these companies for security reasons. That is not a basis recognised by the GDPR, and Article 13(1)(e) expects you to be told the recipients or at least the categories of recipient. So here they are, by name, with where the processing happens.
| Who | What they do for us | Where |
|---|---|---|
| Microsoft Azure | Hosts the EaseTalk service and stores your account and practice data | North Europe, Dublin, Ireland. Backups in Sweden |
| Microsoft Azure AI Foundry | Runs the language models behind the conversations, summaries and reflection prompts | North Europe (Dublin) or Sweden Central |
| Microsoft Azure Speech | Speech recognition during a live practice | North Europe (Dublin) or Sweden Central |
| ElevenLabs | Turns a character's words into speech. Receives that text, not your audio | See section 9 |
| Google, Firebase Cloud Messaging | Push notifications only. No other Firebase service is used | Google infrastructure, see section 9 |
| Microsoft Forms | Hosts the feedback and help forms that the app links out to | Microsoft infrastructure |
| Apple and Google | App store billing, if and when paid subscriptions are switched on | Under their own terms |
When this list changes. We will update this table and change the date at the top of this policy before a new provider begins processing your data. If a change materially affects how your data is handled, we will also tell you in the app.
9Where your data lives
An earlier version of this policy claimed EU based infrastructure without being able to show it. Here is the actual position.
Stored in Ireland, and it stays in the EU
Your account and practice data are held in Microsoft Azure's North Europe region, in Dublin. Backups are held in Sweden. The AI models and speech recognition run on Azure in North Europe or Sweden Central, depending on where capacity is available at the time. Every one of those is inside the European Union.
Two services sit outside that picture, and we would rather name them than let the paragraph above imply more than it should.
- ElevenLabs receives the text that a character speaks, so that it can be turned into a voice. It does not receive your audio. We are completing the record of where that processing takes place and will name the region here.
- Firebase Cloud Messaging delivers push notifications. It receives a device token and the notification, and nothing about your practice.
Where any transfer outside the European Economic Area does occur, it is covered by the transfer terms in our agreement with that provider. If you would like the detail for a particular service before you use EaseTalk, ask us and we will send it.
10Sharing with your therapist
Some things are always visible to a therapist you are linked to, and some things only reach them if you give the optional sharing consent. The line between the two is whose information it is.
Always visible, because the assignment is theirs
If your therapist assigned you practice, they can see whether you did it. That means how many activities are assigned to you and how many you have completed. This is the status of their own assignment rather than a report about you, and it is shown whether or not you have given the sharing consent. A therapist who sets homework is entitled to know whether it came back.
That is the whole of it. Assigned, and completed.
Only with the sharing consent
Everything about how the practice actually went needs your separate permission:
- how you got on with the objectives in the speaking scenarios you practised;
- detailed results for individual activities;
- progress summaries and trends over time;
- confidence and difficulty patterns;
- your reflections.
Without the consent, none of that reaches your therapist. They see that an activity was completed and nothing about what happened inside it.
Your therapist never sees the full transcript
The complete text of your practice conversations is not shown to your therapist, with the consent or without it. The app tells you this, and it needs to keep being true. Practice is meant to be a place where you can get it wrong in private.
Sharing is optional. Refusing it does not stop you using EaseTalk and does not stop your therapist assigning you practice. You can take it back at any point, and your therapist stops receiving the detail from then on.
How to take it back today. The control inside the app is not working yet and shows a message saying it is coming. Until it works, the route that does work is to email easetalkai@gmail.com with the subject Withdraw therapist sharing consent, and we will action it. We would rather tell you the working route than point you at a button that does nothing.
We do not share your personal data with anyone else, other than the processors named in section 8, and except where we are required to by law.
11How long we keep things
We keep your data for three years. That covers your account details, your consent records, and your practice data, being conversation text, goal results, reflections, mood entries and planner entries.
The clock is there so that you and your therapist can look back over a course of therapy rather than losing it at the end of a fortnight. If you ask us to delete your account sooner, we do that instead, and we will tell you if anything has to be kept because the law requires it.
Backups are held in Sweden and are overwritten on their own cycle, so a copy of something you deleted can persist in a backup for a short period before it is gone.
12Security
What we can state plainly:
- Your data is encrypted, both while it travels between your device and our servers and while it is stored.
- Your sign in tokens are held in your device's own secure storage, the Keychain on iOS and the Keystore on Android, rather than in ordinary app storage.
- Audio from a live practice is not attached to your stored session record.
- Access to the therapist portal depends on the account being linked to you, and on the separate sharing consent.
- The service runs inside Microsoft Azure in the EU, and inherits the platform controls that come with it.
We are not going to describe this as military grade or unbreakable, because no honest security section says that. Security is work that continues rather than work that finishes.
If you believe you have found a security problem, please email us at the address in section 17 and give us a chance to fix it before telling anyone else.
13Your rights, and how to use them
Under the GDPR you have the right to ask for a copy of your data (Article 15), to have it corrected (Article 16), to have it erased (Article 17), to restrict how we use it (Article 18), to receive it in a portable form (Article 20), and to object to certain processing (Article 21). You can also withdraw any consent you have given (Article 7(3)), and complain to a supervisory authority (Article 77).
This page is the route, not a button in the app
The app used to show buttons for exporting and deleting your data. They did not work, so in August 2026 they were removed rather than left there looking functional. Requests now come to us directly, which is why the address below matters and is monitored.
How to make a request. Email easetalkai@gmail.com with Data request in the subject line. Tell us the email address on your account and what you would like us to do. We may need to check it is really you before we act, which is a protection for you rather than an obstacle.
How long we take. We respond within one month, as Article 12(3) requires. If a request is complex we may extend that by up to two further months, and if we do, we will tell you inside the first month and explain why.
What it costs. Nothing, in normal circumstances.
14Children and young people
EaseTalk is intended for adults, and our terms of service set a minimum age of 13.
If you are under 16 and living in Ireland, the law requires that consent to process your personal data is given or authorised by a parent or guardian, because Ireland sets the digital age of consent at 16. If that applies to you, please ask them to go through the consent screens with you.
If you believe a child has given us personal data without the right permission, contact us and we will deal with it.
15The pilot programme
EaseTalk is in pilot with clinical partners. That means the product is still being built, features change, some things arrive before others, and occasionally something in the app is ahead of or behind what the servers can do. Where we know about such a gap and it affects your data, we have said so on this page rather than waiting until it is tidy.
Taking part is voluntary. You can stop at any time, and you can ask us to delete your data when you do.
16Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how your data is handled, for example a new provider in section 8 or a change of legal basis, we will tell you in the app, and where consent is required we will ask again rather than assume.
We keep the previous version available on request, so you can see what changed.
17Contact and complaints
Contact us. Email easetalkai@gmail.com, or use the privacy route on our contact page. For a named person directly, email mfaggiani@ucc.ie. By post, write to University College Cork, Western Road, Cork, Ireland.
Complain to a supervisory authority. If you are unhappy with how we have handled your data, you can complain to the Data Protection Commission, the Irish supervisory authority, at dataprotection.ie. If you live in another EU or EEA country, you can complain to the supervisory authority there instead. You do not have to come to us first, though we would like the chance to put it right.