Version September 17, 2026

iSpeax Tech Inc. (“iSpeax”) provides software services to individual professional service providers, small private practices, home care agencies, and educational agencies and institutions (collectively, “Customers”). “Customer Records” means client and student records processed through iSpeax on a Customer’s behalf. iSpeax processes Customer Records in accordance with its Terms of Service and Privacy Policy and any applicable Business Associate Agreement or applicable written agreements, using only information reasonably necessary to provide, support, and secure the authorized services.

For purposes of the FERPA provisions of this policy, “EA” means an educational agency or institution subject to the Family Educational Rights and Privacy Act (“FERPA”) on whose behalf iSpeax processes education records. Where a Customer provides services to an EA, iSpeax shall process personally identifiable information (“PII”) from such records only for purposes lawfully authorized by the EA and permitted under FERPA and any applicable school data agreement. The Customer must possess the requisite authority to disclose such records to iSpeax and ensure that all required authorizations and arrangements governing the use and maintenance of those records are in place. Account registration or acceptance of iSpeax’s Terms of Service does not, by itself, confer authority to disclose or process FERPA-protected records.

iSpeax may receive personally identifiable information from education records pursuant to the school-official exception in 34 CFR §99.31(a)(1)(i)(B) only where it performs an outsourced institutional service or function for which the EA would otherwise use employees and is subject to the EA’s direct control with respect to the use and maintenance of those records. The EA is responsible for specifying, in its annual FERPA notification, the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest, as required by 34 CFR §99.7(a)(3)(iii). Access is restricted to authorized personnel with a legitimate educational interest in performing the contracted function, subject to the applicable use and redisclosure restrictions in 34 CFR §99.33.

iSpeax does not use or redisclose PII from education records except for the authorized purpose and as permitted by the applicable agreement and FERPA. An EA-directed transfer between record systems is performed only pursuant to lawful instructions and the applicable FERPA requirements.

iSpeax processes Customer Records to provide, support, and secure the contracted services, carry out authorized Customer instructions, and meet applicable legal obligations, subject to the controlling agreement, any required EA authorization, and law. Customer Records are not sold or used for targeted marketing or behavioral advertising. iSpeax handles account and operational information in accordance with its Privacy Policy and Terms of Service. Account or operational information containing protected clinical or education-record data remains subject to the corresponding record protections and any applicable BAA or school data agreement.

iSpeax does not use, or authorize its third-party processors or subcontractors to use, client or student data to train AI or other models. Processing records through an AI feature to produce requested goals, notes, summaries, or reports is distinct from model training. Authorized professionals must review and verify AI outputs before approving or relying on them.

iSpeax maintains reasonable and appropriate administrative, technical, and physical safeguards designed to protect Customer Records against unauthorized access, use, and disclosure. These include access restrictions, encryption in transit and at rest, and security logging. Personnel access is limited by authorized duties and confidentiality requirements. Third-party processors and subcontractors handling records on iSpeax’s behalf shall be subject to appropriate security, permitted-use, and return or deletion obligations, including business associate agreements where required by HIPAA. Customers must protect credentials and restrict account access to authorized persons.

iSpeax does not acquire ownership of Customer Records. Customers retain their applicable rights in those records, and the responsible EA retains its rights and control over FERPA education records. These rights remain subject to applicable law and the rights of patients, parents, eligible students, and other entitled parties.

If iSpeax receives a legal demand for education records, it promptly notifies the responsible EA unless notification is prohibited by law. Records are disclosed only pursuant to lawful EA instructions, valid legal requirements, or another permitted basis under the controlling agreement and applicable law. A request, subpoena, or instruction does not eliminate applicable FERPA consent, notice, or objection requirements. Disclosure is limited to the authorized scope.

The EA remains responsible for responding to requests by parents and eligible students to inspect, obtain, or amend education records. iSpeax provides assistance as required by law and the applicable agreement and routes requests it receives to the responsible EA.

If iSpeax becomes aware of a breach, unauthorized access, use, or disclosure, or other security incident involving Customer Records, it promptly assesses the event and takes appropriate containment and mitigation measures. iSpeax provides any notices required by applicable law to the designated contact of the affected Customer and responsible EA, as applicable, without unreasonable delay and within the applicable deadlines.

Upon the permanent ending of beta or paid account access, the responsible Customer or its authorized representative has 30 calendar days from the access-end date to retrieve stored Customer Records through a designated secure export or assisted-return process in a usable electronic format. The process verifies the recipient’s authority for the responsible Customer or EA and does not provide an ongoing read-only workspace. The normal beta-ending notice is governed by the Terms of Service. Temporary suspension alone does not trigger permanent deletion.

After the ordinary export period, iSpeax initiates secure deletion subject to applicable law and controlling BAA or applicable written agreements. Routine backup copies expire or are securely deleted through a documented, bounded lifecycle. They remain protected, with access and use restricted to authorized backup or recovery purposes and applicable requirements; deletion instructions are reapplied after restoration. Only relevant records are preserved for a documented legal hold, required retention, controlling contractual duty, or outstanding applicable access or inspection request. Preserved records remain safeguarded and restricted until the preservation basis ends and they become eligible for deletion.

For requests concerning client-record content, access, or correction, contact the responsible practice, agency, or professional service provider. For FERPA education records, contact the responsible EA. For questions about iSpeax’s handling of records, contact privacy@ispeax.com. Do not include identifiable client or student records in ordinary email; request secure submission instructions. iSpeax may update this policy prospectively to reflect legal requirements or changes to its services.

HIPAA Compliance

FERPA-protected education records and qualifying treatment records described in 45 CFR §160.103 are excluded from HIPAA’s definition of protected health information (“PHI”). Classification depends on the responsible organization and the relationship in which records are maintained. An independent healthcare provider’s clinical records concerning a student may instead be PHI where HIPAA applies.

Where iSpeax processes PHI on behalf of a covered entity or another business associate, it acts as a business associate or subcontractor business associate, as applicable. This includes services for individual healthcare providers, private practices, and home care agencies where HIPAA applies. iSpeax and the responsible Customer must enter the required Business Associate Agreement (“BAA”) before PHI is processed. The accepting individual professional or organizational representative must have authority to contract for the responsible professional, practice, or agency.

iSpeax handles PHI only for the purposes permitted by the controlling BAA and applicable law, maintains the required safeguards, imposes applicable business associate obligations on PHI-processing subcontractors, and provides required incident and breach notices. iSpeax assists the responsible Customer with applicable access, amendment, and disclosure-accounting obligations.

PHI may be electronically disclosed for authorized service purposes to the responsible Customer, authorized recipients, and iSpeax’s contracted processors or subcontractors, only as permitted by the controlling BAA and applicable law. Where law requires separate individual authorization, that authorization must be obtained before the electronic disclosure.

The secure export, return, and deletion process applies to clinical records subject to the controlling BAA and law. Maintained PHI is not withheld to resolve payment disputes. Where return or destruction is infeasible, retained PHI remains protected under the BAA, with uses and disclosures restricted to the purposes making return or destruction infeasible. Company compliance documentation follows separate applicable retention requirements. Customers remain responsible for their professional and legally required recordkeeping.