VOIS Privacy Policy

1. Who we are

VOIS is a communication app that helps children and adults who are non-verbal, pre-verbal, or have limited speech to communicate. It is set up and managed by the adults who care for them — parents, family members, therapists, and educators — who build personalised communication boards using pictures, words, and recorded voices.

VOIS is a service of Amazing K (Pty) Ltd (registration number 2013/066820/07), a registered special-needs centre based in South Africa, trading as "VOIS". In this policy, "VOIS", "we", "us", and "our" refer to Amazing K (Pty) Ltd t/a VOIS. Under South Africa's Protection of Personal Information Act, 2013 (POPIA), we are the "responsible party" for the information you give us to create and run your account, and for the content created in individual and family accounts. Professional accounts used by schools, clinics, and therapy centres work differently: there, the institution is the responsible party for the children's and clinical information its staff enter, and VOIS acts as its "operator", processing that information on the institution's behalf. Section 7 explains this fully.

We take your privacy seriously — and we are especially mindful of it because many of the people VOIS is built for are children. This policy explains, in plain language, what information we collect, how we use and protect it, where it is stored, and what rights you have. If anything here is unclear, please contact us using the details at the end.

2. A note about children first

Because VOIS is often used by and for children, protecting their information matters more than anything else we do. A few things are worth stating clearly up front:

• Children never create accounts or enter their own information. Everything is set up by a responsible adult.
• We ask for as little as possible about a child. To create a child profile, we only need the child's first name — no surname, date of birth, ID number, or diagnosis is requested or required.

Under POPIA, a child is anyone under the age of 18, and the personal information of a child may only be processed with the consent of a "competent person" — usually a parent or legal guardian. By creating a child profile on VOIS, you confirm that you are that child's parent or guardian, or that you have the necessary authority and consent to do so. Where VOIS is used by a school, clinic, or therapy centre, that institution is responsible for obtaining parental or guardian consent before adding any child to the system, and we recommend keeping records of that consent as part of its normal enrolment process.

3. What information we collect

The information VOIS holds falls into a few simple categories:

• Account information — the email address, display name, and account type you provide when you sign up.
• Child profile information — the first name of each child profile you create.
• Board content — the categories, cards, and labels you create to build a communication board.
• Card images — photographs you take or upload to create communication cards. These may include pictures of a child and of real, everyday environments, so we treat them as sensitive and handle them accordingly.
• Clinical information — if you use a Professional account, we also store therapist names, session notes, goals, progress records, observation tags, and attendance records that you enter. Because this is a record of a child's therapy, POPIA treats it as special personal information relating to the child's health — the most strongly protected category — and we handle it accordingly (see Section 7).
• Account security information — a small amount of information needed to keep your account secure, such as authentication tokens. Your password is encrypted (hashed) and is never stored in a readable form, even by us.

We do not collect advertising or tracking data, and we do not build profiles of you for marketing.

4. What stays on your device and never reaches us

Voice recordings are the one thing that never leaves your device. When a caregiver records a voice for a card, that recording is saved only in the local storage of the device it was recorded on (using the browser's IndexedDB). It is never uploaded to our servers or the cloud. This is why a voice recorded on a phone will not appear on a tablet, and why we ask you to re-record voices on each device you use. It also means we have no way to access, recover, or restore your voice recordings — and that clearing your browser data on a device will permanently delete the recordings stored there.

App cache and offline files are also stored only on your device, to let VOIS work smoothly and offline.

5. How we use your information

We use your information only to provide and run the service you have signed up for. In practice, that means:

• syncing your communication boards across the devices you log into;
• keeping your account secure and letting you sign in;
• providing the clinical tools to Professional accounts; and
• responding to you when you contact us for support.

We do not sell or rent your personal information to anyone. We do not use it for advertising. The only marketing we may send is direct communication about VOIS itself — for example, an update about a new feature — and you can ask us to stop at any time.

6. Where your information is stored

The information that syncs to the cloud — your account details, child profile names, board content, card images, and clinical records — is stored using Supabase, our database and storage provider, on servers located in Ireland (the European Union). This means your personal information is processed outside South Africa.

POPIA permits this kind of cross-border transfer where the place the information is sent to offers protection that is substantially similar to POPIA. Ireland and the wider European Union are governed by the General Data Protection Regulation (GDPR), one of the strongest data-protection standards in the world, and our provider is bound by a data-processing agreement that requires it to protect your information. In addition, you consent to this transfer when you create an account, and the transfer is necessary for us to provide the service you have asked for.

How we keep it secure:

• All information sent between your device and our servers is encrypted using HTTPS/TLS.
• Our database uses row-level security, so each account can only ever access its own data.
• Passwords are managed securely and stored only in encrypted (hashed) form.

7. Professional accounts: schools, clinics, and therapy centres

Professional accounts work differently from home accounts, and the law treats them differently too, because they hold genuinely sensitive clinical information. When a school, clinic, or therapy centre uses VOIS, the information its staff enter about a child — session notes, goals, progress records, observation tags, and attendance — is a record of that child's therapy. Under POPIA this is special personal information relating to a child's health, which carries the highest level of protection the Act provides. The following applies to Professional accounts:

The institution is the responsible party. The school, clinic, or therapy centre decides what information to collect about each child and why, so under POPIA it is the responsible party for that information. VOIS acts as the institution's operator — we process the information only on the institution's behalf and on its instructions, in order to provide the platform. This relationship is set out in a separate Data Processing Agreement between VOIS and the institution, which applies in addition to the Terms of Use.

Parental consent is the institution's responsibility. The institution must obtain consent from each child's parent or guardian before creating a profile for that child in VOIS, and should keep a record of that consent. Because the institution is the responsible party, this responsibility sits with it, not with VOIS.

Access to children's records. Any device signed in to a Professional account can see all of the children's information held in that account. The institution is responsible for keeping its login details confidential and for ensuring that only authorised staff can access the account.

Keeping and deleting information. We keep a Professional account's information for as long as the subscription is active. If the subscription is cancelled, we retain the information for a grace period of 30 days so that the institution can export its records, after which it is permanently deleted.

A parent's right to have a child's data deleted. A parent or guardian may ask for their child's information to be deleted. Because the institution is the responsible party, this request is usually directed to the institution, and VOIS will action it as the institution's operator. VOIS provides an in-app profile deletion feature so that a child's profile and all of its associated information can be permanently removed.

8. Who we share your information with

We do not share your personal information with third parties for their own purposes. To run VOIS, we rely on a small number of trusted service providers who process information strictly on our instructions and only to keep the service working:

• Supabase — our database and image storage provider;
• Netlify — hosting for the VOIS app;
• Payfast — payment processing for VOIS subscriptions;
• Zoho Mail — for account and support email.

When you pay for a VOIS subscription, your payment is processed directly by Payfast on its own systems. Your card and banking details are entered with Payfast, not with VOIS — we do not see, collect, or store them. We may also disclose information if we are required to do so by law, or to protect the rights, safety, or property of our users or others.

9. Your rights under POPIA

You have the right to:

• Access — ask for a copy of the personal information we hold about you or your child;
• Correction — ask us to correct information that is inaccurate or out of date;
• Deletion — ask us to delete your account and the information associated with it;
• Objection — object to the way we process your information; and
• Withdraw consent — withdraw a consent you have given, at any time.

To exercise any of these rights, please contact our Information Officer using the details below. You also have the right to lodge a complaint with the Information Regulator of South Africa at https://inforegulator.org.za/

10. How long we keep your information

• We keep your information for as long as your account is active.
• When you delete your account, or ask us to delete your information, we permanently remove it from our active systems within 30 days, and from our backups within a further 90 days.
• Voice recordings are stored only on your device, so they are not affected by account deletion — you remove these yourself by clearing them on the device.

11. Cookies and local storage

VOIS does not use advertising or tracking cookies. We only use essential browser storage that the app needs to function: to keep you signed in, to store your voice recordings locally on your device, and to let the app work offline.

12. Photographs are your responsibility

When you add a photograph to VOIS, you are responsible for making sure you have permission to photograph the person in it — especially if that person is a child. We do not view, moderate, or analyse the photographs you upload; they are stored privately against your account and are only visible to you.

13. Changes to this policy

We may update this policy from time to time as VOIS develops or as the law requires. When we do, we will show you a notice in the app, and the "last updated" date at the top will change. If the changes are significant, we may ask you to read and accept the updated policy before continuing to use VOIS.

14. How to contact us

Responsible party: Amazing K (Pty) Ltd t/a VOIS (registration number 2013/066820/07)
Information Officer: Noel Ross
Email: noel.ross@getvois.co.za
Address: 22 Paul Street, Northwold, 2155