Last updated September 20, 2026.

This Policy applies to visitors to the public website of iSpeax Tech Inc. (“iSpeax,” “we,” or “us”) and to our account registration, software service, support, billing, and related communications. Accounts are offered to eligible users in the United States. This Policy explains how we handle information in those activities and how we process client and student records on behalf of our Customers.

1 Introduction

iSpeax provides software for therapists, special educators, practices, agencies, and educational organizations. The individual professional or organization identified during registration is the “Customer” under the iSpeax Terms of Service (“Terms”).

The Terms apply to Customers and account use. This Policy applies to public-site visitors as well as Customers and account users. For Customer Records, it is supplemented by the FERPA Compliance and HIPAA Compliance provisions (“HIPAA/FERPA Policy”). For protected records, an applicable Business Associate Agreement (“BAA”), school data agreement, or other duly entered data-processing agreement applies.

2 Information and Roles

“Account Information” includes a Customer’s registration details, name, professional or organizational affiliation, account contacts, credentials and role information, subscription choices, and communications about the account. “Website and Operational Information” includes device, browser, network, log, usage, security, and support information generated when people visit our public site or use the Service. “Payment Information” includes billing and transaction information associated with a separately authorized paid purchase.

“Customer Records” are client and student records and professional documentation submitted, maintained, or created through the Service on a Customer’s behalf, including profiles, goals, schedules, session information, notes, reports, and associated record history. A client, patient, or student whose information appears in Customer Records is not necessarily an account user or a party to the Terms. Account or operational information that contains protected clinical or education-record data remains subject to the protections applicable to those records.

iSpeax determines the purposes for handling its own website, account, billing, support, and business communications information. For Customer Records, iSpeax acts on the responsible Customer’s lawful instructions and under applicable data agreements. An educational agency or institution retains its control over FERPA education records, including where an authorized service provider uses iSpeax on that agency’s behalf.

3 Information We Collect

We collect information people provide when they register, administer an account, ask for support, communicate with us, choose a paid subscription, or exercise a privacy request. This can include names, email addresses, professional or organizational details, account settings, messages, and billing contact or transaction details. We collect the information needed to document acceptance of applicable agreements and payment authorizations, including the accepting person, date, and document version.

When someone visits our public website or uses the Service, we may receive IP address, device and browser characteristics, pages or functions used, timestamps, diagnostic events, security logs, and similar operational information. Cookies and similar technologies may supply some of this information as described in Section 6. We also receive Customer Records when an authorized Customer or user enters or generates them through the Service. Customers determine which client and student information they lawfully submit, subject to the Service’s functions, the Terms, and applicable agreements.

We may receive information from an organization that administers a user’s account, a payment provider following a paid purchase, a provider involved in authorized Service delivery, or a person who contacts us about a record or account. We do not ask clients or students to create accounts in order for authorized professionals to maintain their records.

4 How We Use Information

We use Account Information, Website and Operational Information, and Payment Information to register and administer accounts; authenticate users; provide and support the Service; deliver notices; process separately authorized purchases; respond to inquiries; protect people, records, and systems; diagnose faults; maintain records of consent and transactions; improve our website and non-record product operations; and meet lawful obligations. Marketing communications use account or website contact information only in accordance with applicable law and available opt-out choices. Opting out of marketing does not stop essential service, security, legal, or billing notices.

We process Customer Records only as reasonably necessary to provide, support, and secure the Service, perform authorized Customer instructions, and satisfy applicable legal obligations, subject to the controlling BAA or school data agreement and the HIPAA/FERPA Policy. A requested AI feature may process authorized record information to produce an output for the Customer, subject to the same restrictions. iSpeax does not use, or authorize its processors or subcontractors to use, client or student information to train AI or other models. We do not sell Customer Records or use them for targeted marketing or behavioral advertising. We do not use Customer Records for unrelated product improvement or commercial profiling.

5 Disclosure of Information

We disclose information to persons authorized by the Customer, to contracted providers that perform functions for us, and when a lawful instruction or applicable legal requirement permits or requires it. The functions may include hosting, data storage, authentication, AI processing requested through the Service, communications, customer support, security, payment processing, and operational measurement. Providers receive only information appropriate to their function and must be subject to applicable confidentiality, security, permitted-use, and return or deletion terms. A provider that creates, receives, maintains, or transmits PHI on iSpeax’s behalf must have a BAA where HIPAA requires one.

Customer Records may be disclosed to the responsible Customer and recipients it lawfully authorizes, including its professional users; to appropriately contracted processors performing authorized services; or as permitted by a controlling agreement and law. A Customer’s access to records is limited by its own permissions and lawful authority. We do not treat an account administrator’s access as authority to disclose records. If we receive a legal demand for protected records, we notify the responsible Customer and, where applicable, the responsible educational agency unless prohibited by law, and limit any disclosure to the lawful scope.

If iSpeax is involved in a merger, reorganization, or sale of relevant business assets, information may transfer subject to applicable law, required notices or consents, and continuing record-protection obligations. The transaction does not independently expand permitted Customer Record uses. We may disclose account or website information with a person’s consent or as otherwise permitted by law. We do not disclose Customer Records merely because a general website visitor accepts this Policy.

6 Cookies, Analytics, and Advertising Technologies

Our website and application use cookies or similar identifiers as needed for sessions, authentication, preferences, fraud prevention, and security. The public website uses third-party analytics to measure visits and interactions. Those analytics services may receive IP addresses, device and browser identifiers, pages visited, referral sources, and interaction information. Within the application, we use service-usage and performance information to monitor and operate the Service. Information generated through these technologies is handled under this Policy and any applicable legal notice or choice.

Customer Records are not used for behavioral advertising or targeted marketing. Analytics or advertising technologies must not receive protected clinical or education-record information through the professional record workflows. A public-site notice or cookie choice does not itself authorize a disclosure of PHI or FERPA-protected information that otherwise requires a BAA, institutional authorization, or another lawful basis. Browser settings may allow people to block some cookies; blocking those needed for login or security can prevent portions of the Service from working.

7 Payment Processing

When an authorized Account Owner chooses a paid subscription, payment details and related billing information may be provided to the payment processor used at checkout. iSpeax receives the transaction and subscription information needed to administer the account, provide receipts, address payment failures, and meet legal and accounting obligations. The checkout notice identifies the price, renewal terms, and cancellation process. Payment providers handle information under their own applicable notices and contracts. The Terms govern payment authorization and cancellation.

8 Retention, Export, and Deletion

We maintain Account Information and Website and Operational Information for the period reasonably needed for the purposes described here, including account administration, security, transaction records, dispute resolution, and legal obligations. The period depends on the type of information, the reason it was collected, applicable requirements, and whether a legitimate preservation need remains. We restrict and delete information when the retention basis ends under our documented processes.

During service, an authorized Customer can request a secure export or assisted return of Customer Records. After beta or paid account access ends, an authorized representative has 30 calendar days from the access-end date to retrieve stored Customer Records through the secure export or assisted-return process described in the Terms. Ordinary account functions and a read-only workspace do not continue during that return period. A temporary suspension alone does not start permanent deletion.

After that period, iSpeax initiates secure deletion of Customer Records, subject to applicable law, an outstanding timely return or access request, a documented preservation duty, and a controlling BAA or school data agreement. Records needed to complete a timely authorized request delayed by iSpeax remain protected until return is completed. Routine backup copies expire or are securely deleted through a documented, bounded lifecycle. This Policy does not impose one universal retention period for every medical or education record. Customers retain their own professional and institutional recordkeeping duties.

9 Security and Incidents

iSpeax maintains reasonable and appropriate administrative, technical, and physical safeguards designed to protect Customer Records, including access restrictions, encryption in transit and at rest, security logging, personnel confidentiality requirements, and appropriate processor obligations. No electronic system can be guaranteed completely secure, but that fact does not reduce any safeguard, incident-response, or record-return obligation imposed by law or a controlling agreement. Customers must use their own authorized credentials and manage access to their accounts and records.

If we become aware of an incident involving Customer Records, we assess and contain it, mitigate appropriate harms, and notify the affected Customer and responsible educational agency as required by law or the controlling agreement, without unreasonable delay and within applicable deadlines. We cooperate with their response and supplement initial information as it becomes available. Suspected unauthorized account access or security issues may be reported to support@ispeax.com. Do not send protected records in ordinary email; request secure submission instructions.

10 Location of Processing

The Service is offered to eligible account users in the United States. Processing and storage locations depend on the specific services and providers used to deliver the Service and on any applicable Customer or school agreement. This Policy does not guarantee that every processor or system is located in one state or country.

11 Privacy Requests and Choices

For Account Information or other information iSpeax handles for its own purposes, contact privacy@ispeax.com to request access, correction, deletion, or another privacy choice available under applicable law, or to appeal a decision on a request where an appeal right applies. We may verify identity and account authority before acting and may retain information where a lawful exception or obligation applies. Where a state privacy law applies to iSpeax and to the information involved, we honor its applicable rights, including any appeal or opt-out right it requires. We do not discriminate for exercising a legally protected privacy right.

For client or student records, direct requests to the responsible practice, agency, professional provider, or educational agency. They determine the applicable record rights and lawful response. iSpeax routes requests it receives and assists as required by law and the controlling agreement. A request concerning a student’s education record should go to the responsible educational agency; a request concerning a clinical record should go to the responsible healthcare provider or organization. This does not waive a patient’s, parent’s, eligible student’s, or other person’s independent legal rights.

You can unsubscribe from marketing email using its unsubscribe link or by contacting us. Essential account, service, security, billing, and legal notices continue as allowed or required. Browser controls may affect cookies as described in Section 6. Requests about an organization’s records may require verification with that organization before any disclosure.

12 Children and Student Records

The website and Service are not intended for minors as account users; accounts are for adults who meet the professional or organizational eligibility rules in the Terms. Authorized Customers may nevertheless maintain records concerning minors, including students and clients, when they have the requisite legal and institutional authority. Such records receive the protections applicable to Customer Records, including FERPA or HIPAA where each law applies. If a child appears to have created an account or submitted information directly without authorization, contact privacy@ispeax.com so we can assess the situation.

13 Third Party Links

The public website may link to sites or services that iSpeax does not operate. Those third parties’ privacy practices are governed by their own notices. A link does not authorize a third party to receive Customer Records; integrations and record disclosures remain subject to the Terms, applicable agreements, and law.

14 Changes to This Policy

iSpeax may update this Policy prospectively and will post the current version with its last-updated date. Material changes receive notice as stated in the Terms, including any applicable advance-notice and affirmative-acceptance requirements. A Policy change does not independently expand permitted Customer Record uses or override a BAA, school data agreement, or nonwaivable law. If a material change affects a Customer’s obligations or the handling of protected records, any additional consent or agreement required by law or the controlling agreement must be obtained before the change applies.

15 Contact Us

For privacy questions or requests about iSpeax’s handling of personal information, contact privacy@ispeax.com. For account, billing, service, security, export, or other non-privacy matters, contact support@ispeax.com. For a client’s clinical record or student’s education record, contact the responsible practice, agency, professional provider, or educational agency first. Legal notices to iSpeax follow the Terms or the applicable controlling agreement. Do not include identifiable client or student records in ordinary email.