นโยบายความเป็นส่วนตัว

• Data controller: Uphasia Artificial Intelligence Co., Ltd. (head office), tax ID 0105568085390, 278 Lat Phrao 109, Khlong Chan, Bang Kapi, Bangkok 10240, Thailand
• Data Protection Officer (DPO): Panitan Kwankaew, speak@speechelephant.com or the address above

This policy covers the Speech Elephant practice app on Android, iPhone, iPad and at app.speechelephant.com, the clinician web app at slp.speechelephant.com, and this website. Speech Elephant is a practice tool used with a speech-language pathologist. It is not a medical device and does not diagnose.

• Account: Email and password. The password is stored one-way hashed by the authentication service; we cannot read it.
• Personal details: Name, date of birth, gender, handedness, occupation, your clinician's reference code, and notes you enter about family or other circumstances.
• Health information (sensitive data): Type of aphasia, date of onset, assessment scores, clinical notes and exercise scores.
• Practice data: Assigned exercises, completions, daily streak, sugarcane earned and elephant cosmetics.
• Consent records: When consent was given or withdrawn, the policy version, and who gave it.
• Clinicians: Email, display name, reference code and the exercises they create.

Without an email and password we cannot create an account. Without the consents in section 04 we cannot provide the practice service to you, because your health information is essential to it: every exercise and every score is built from it. You can still receive therapy from your speech-language pathologist in the usual way without the app.

When you press speak, microphone audio is sent to your operating system's or browser's speech recognition service (Google's service on Android and in Chrome, Apple's service on iPhone and iPad) to be turned into text. Speech Elephant does not record, store or receive the audio. We receive only the text, compare it with the target word and keep only the score; the text is not stored. You can skip speaking on any exercise. If the app ever records audio, we will update this policy and ask for separate consent before it starts.

• Your speech-language pathologist: Only the clinician you linked with their reference code can see your data and results.
• Company administrators: Access only as needed to run the system, fix problems and carry out your rights requests.
• Processors: Supabase (database, authentication, image storage), Amazon Web Services (web hosting), Google and Apple (speech recognition), Cloudflare, OpenTyphoon and Google Gemini (exercise generation), and Cloudflare, Hugging Face and Google (images from words, no patient data). Processors act on our instructions under each provider's data processing terms.
• Authorities: Only when the law or a court order requires it.

Your data is stored and processed outside Thailand:

• The database is in Seoul, Republic of Korea
• AI services and Google's and Apple's speech recognition may process data in the United States and other countries the providers use
• The website and web apps are hosted on Amazon Web Services

These destinations may not meet the standard of protection set by Thailand's Personal Data Protection Committee. We therefore ask for your consent under s.28(2) before any transfer, and every transfer is encrypted in transit. Before the clinical trial with real patients begins, we will move the database to Thailand and tell you.

• Account, personal, health and practice data are kept while the account exists
• You can delete your account immediately in the app, from the top-left menu, "ลบบัญชีและข้อมูลทั้งหมด" (Delete account and all data)
• Deletion requests through the website are completed within 30 days
• Accounts inactive for 24 months are notified by email and deleted 30 days after notice (reviewed quarterly)
• Consent and rights-request records are kept 1 year as proof of compliance, unlinked from deleted accounts
• The database provider's backups are overwritten on the provider's own cycle
• Exercises a clinician created for you (words and pictures) may remain with your name removed

• Access your data and get a copy, or ask how we obtained it (s.30)
• Receive your data, or have it sent, in a machine-readable format such as JSON (s.31)
• Object to collection, use or disclosure (s.32)
• Have your data erased, destroyed or anonymised (s.33)
• Have its use restricted (s.34)
• Have it corrected and kept up to date (s.35); you can edit it yourself in your profile
• Withdraw consent at any time (s.19); see section 11
• Complain to the Office of the Personal Data Protection Committee (s.73)

Use these rights from “ความเป็นส่วนตัวของฉัน” (My privacy) in the app, or email the DPO at speak@speechelephant.com from your registered address. We answer within 30 days of receiving the request. If we refuse a request, we tell you why and record it as the law requires.

Withdrawing consent is as easy as giving it: from “ความเป็นส่วนตัวของฉัน” (My privacy) in the app, or by emailing the DPO. Withdrawal does not affect processing lawfully done before it. Its effect is that the practice features stop working, and we offer to delete your account and all data, or to restrict use of your data, as you choose.

The app is for adults aged 18 and over. At sign-up the person registering confirms that they are the patient and 18 or over, or the patient's legal representative. If the patient has been declared incompetent or quasi-incompetent, the guardian or curator gives consent and exercises rights on the patient's behalf (s.20). If we find a minor's data held without consent from a person exercising parental power, we delete it.

All data travels over encrypted connections (HTTPS). The database enforces row-level access rules: patients see only their own data, and clinicians see only the patients linked to their reference code. If a personal data breach occurs, we notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and if the risk to your rights and freedoms is high, we tell you without delay together with the remedies available (s.37(4)).

• We do not sell data, show ads or use data for marketing
• We do not use your data to train AI models
• We do not collect location, contacts, photos or advertising IDs, and the app has no analytics or tracking SDK

Policy version 2026-10-v2. If it changes materially, we tell you in the app before the change takes effect, and ask for consent again when a purpose changes. Contact the DPO at speak@speechelephant.com. Deletion requests: speechelephant.com/delete-account.