Privacy Policy

1. Introduction

Lingo Therapy is a speech therapy platform operated by Kure Digital, a company registered in Ireland. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Irish Data Protection Act 2018.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have regarding your data.

2. Data Controller

The data controller responsible for your personal data is:

Company: Kure Digital
Platform: Lingo Therapy
Registered in: Ireland
Contact email: hello@lingo-therapy.ie

3. What Personal Data We Collect

3.1 Account and Profile Data

Full name, email address, phone number, date of birth, user role (patient or therapist), and for therapists: qualifications, specialisations, and professional biography.

3.2 Health and Therapy Data

Booking details (scheduled date, time, therapist assigned), session notes and therapy-related information, and communication between patient and therapist within the platform. This data is classified as special category data under Article 9 of the GDPR. We process it on the basis of your explicit consent provided during account registration and booking.

3.3 Payment and Billing Data

Payment transaction records (amount, date, status) and Stripe customer identifiers. We do not store your credit or debit card numbers. All payment processing is handled securely by Stripe, Inc., which acts as an independent data controller for card data. You can review Stripe's privacy policy at https://stripe.com/privacy.

3.4 Technical Data

IP address, browser type and version, device information, and pages visited and usage patterns. This data is collected automatically to ensure platform security and improve user experience.

4. How We Use Your Data

We use your personal data to create and manage your account, facilitate bookings between patients and therapists, process payments through Stripe, enable video therapy sessions via Google Meet, communicate with you about your bookings and account, comply with legal obligations, improve the platform and user experience, and ensure platform security and prevent fraud.

5. Legal Basis for Processing

We process your personal data under the following legal bases as defined by Article 6 and Article 9 of the GDPR:

Contract (Article 6(1)(b)): Processing necessary to provide our services, including account management, bookings, and payments.

Consent (Article 6(1)(a) and Article 9(2)(a)): For the processing of health and therapy data (special category data). You may withdraw consent at any time by contacting us.

Legitimate Interest (Article 6(1)(f)): For platform security, fraud prevention, and service improvement.

Legal Obligation (Article 6(1)(c)): Where we are required to retain data for tax, accounting, or regulatory purposes.

6. Data Sharing and Third-Party Services

We share your personal data only with the following categories of recipients, and only to the extent necessary:

Stripe (payment processing) — processes payment card details and transaction data. Privacy policy: https://stripe.com/privacy

Google Meet (video sessions) — processes video and audio data during sessions. Privacy policy: https://policies.google.com/privacy

Resend (email notifications) — processes email addresses for transactional email delivery. Privacy policy: https://resend.com/legal/privacy-policy

Supabase (database hosting) — stores account, booking, and profile data. Privacy policy: https://supabase.com/privacy

Kure Digital does not sell, rent, or trade your personal data to third parties. Data is only shared with the third-party services listed above for the purposes of operating the Platform.

7. International Data Transfers

Some of our service providers (Stripe, Google, Supabase) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including EU-approved Standard Contractual Clauses (SCCs), adequacy decisions by the European Commission, and EU-US Data Privacy Framework certifications.

8. Data Retention and Account Closure

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Account data: Retained for the duration of your account and deleted within 30 days of account closure, unless legal retention obligations apply.

Booking and session data: Retained for 7 years to comply with Irish tax and accounting obligations.

Payment records: Retained for 7 years as required by Irish Revenue regulations.

Technical logs: Retained for up to 12 months for security and troubleshooting purposes.

Clinical session notes: Therapists are responsible for retaining clinical records in accordance with their professional obligations. Kure Digital retains shared session notes on the Platform for as long as the patient's account is active, or for up to 12 months after account closure, whichever is longer.

You have the right to request access to, correction of, or deletion of your personal data at any time by contacting hello@lingo-therapy.ie. Deletion requests will be honoured subject to our legal retention obligations. We will respond to all data access and deletion requests within 30 days.

9. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15): You may request a copy of the personal data we hold about you.

Right to Rectification (Article 16): You may request correction of inaccurate or incomplete data.

Right to Erasure (Article 17): You may request deletion of your data, subject to legal retention requirements.

Right to Restrict Processing (Article 18): You may request that we limit how we use your data.

Right to Data Portability (Article 20): You may request your data in a structured, commonly used, machine-readable format.

Right to Object (Article 21): You may object to processing based on legitimate interests.

Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hello@lingo-therapy.ie. We will respond within 30 days.

You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at www.dataprotection.ie.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (TLS/SSL), row-level security policies on database tables, secure authentication and session management, environment variables and secrets stored securely (never exposed client-side), regular review of access controls and security practices, and use of trusted, enterprise-grade infrastructure providers.

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for any activity that occurs under your account.

11. Cookies and Analytics

The Platform uses essential cookies required for the platform to function (such as authentication session cookies). We do not use advertising or third-party tracking cookies.

If we introduce analytics tools or non-essential cookies in the future, we will update this policy and seek your consent where required in accordance with the ePrivacy Directive.

12. Children's Data

Our platform may be used by parents or guardians to book speech therapy sessions for children. In such cases, the parent or guardian provides consent for the processing of the child's data. We do not knowingly collect data directly from children under the age of 16 without parental consent, in accordance with Article 8 of the GDPR and Irish law.

Where a parent or guardian registers on the Platform on behalf of a child, the child's personal data (name, date of birth, and therapy history) is collected and stored with the parent's consent. This data is shared only with the Therapist booked for the child's session. Parents or guardians may request access to, correction of, or deletion of their child's data at any time by contacting hello@lingo-therapy.ie.

13. Therapist Content and Data

Therapists who register on the Platform provide profile information including their name, qualifications, biography, profile image, CORU registration number, and specialisations. This information is displayed publicly on the Platform to help patients choose a suitable therapist.

Upon termination of a Therapist's account, their profile information will be removed from the Platform within 30 days. Therapists may request earlier removal by contacting hello@lingo-therapy.ie. Anonymised or aggregated data derived from a Therapist's use of the Platform (such as session volume statistics) may be retained for analytics and platform improvement purposes.

14. Marketing and Anonymised Data

Kure Digital may use anonymised and aggregated data for marketing, promotional, and platform improvement purposes. This data does not identify any individual user. We will not use your personal information for marketing purposes without your explicit consent. You can opt out of marketing communications at any time by contacting hello@lingo-therapy.ie.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or by posting a prominent notice on the platform.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Company: Kure Digital
Email: hello@lingo-therapy.ie
Website: https://lingo-therapy.ie

You may also contact the Irish Data Protection Commission:
Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100 / 1800 437 737