Privacy Policy

1. Introduction

Lingo Therapy is a speech therapy platform operated by Kure Digital, a company registered in Ireland. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Irish Data Protection Act 2018.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have regarding your data.

2. Data Controller

The data controller responsible for your personal data is:

Company: Kure Digital
Platform: Lingo Therapy
Registered in: Ireland
Contact email: hello@lingo-therapy.ie

3. What Personal Data We Collect

3.1 Account and Profile Data

Full name, email address, phone number, date of birth, user role (patient or therapist), and for therapists: qualifications, specialisations, and professional biography.

3.2 Health and Therapy Data

Booking details (scheduled date, time, therapist assigned), session notes and therapy-related information, notes and materials your therapist shares with you through the Platform, documents you upload to share with your therapist, messages you send to our support team, and written reports or letters your therapist prepares for you through the Platform. This data may include special category data under Article 9 of the GDPR, for example health information about you or your child. We process it on the basis of your explicit consent provided during account registration, booking, and when you choose to share it.

Documents you upload are stored securely and shared only with the therapist you are working with, under the same access rules as the rest of your record. Please upload only what is relevant to your child's therapy.

3.3 Payment and Billing Data

Payment transaction records (amount, date, status) and Stripe customer identifiers. We do not store your credit or debit card numbers. All payment processing is handled securely by Stripe, Inc., which acts as an independent data controller for card data. You can review Stripe's privacy policy at https://stripe.com/privacy. Where you buy a block or package of sessions, we hold the prepaid amount and record each session against it.

3.4 Technical Data

IP address, browser type and version, device information, and pages visited and usage patterns. This data is collected automatically to ensure platform security and improve user experience.

We keep a record of the transactional emails we send you (such as booking confirmations and notifications), including delivery status, so we can confirm messages were sent and troubleshoot delivery problems.

4. How We Use Your Data

We use your personal data to create and manage your account, facilitate bookings between patients and therapists, process payments through Stripe, process, deliver, and store reports and letters you request from your therapist, and take and hold payment for them, enable video therapy sessions via Google Meet, communicate with you about your bookings and account, respond to and manage messages you send to our support team through the Platform, comply with legal obligations, improve the platform and user experience, and ensure platform security and prevent fraud.

5. Legal Basis for Processing

We process your personal data under the following legal bases as defined by Article 6 and Article 9 of the GDPR:

Contract (Article 6(1)(b)): Processing necessary to provide our services, including account management, bookings, and payments.

Consent (Article 6(1)(a) and Article 9(2)(a)): For the processing of health and therapy data (special category data), and for sending you marketing communications and setting non-essential cookies where you have opted in. You may withdraw consent at any time.

Legitimate Interest (Article 6(1)(f)): For platform security, fraud prevention, and service improvement.

Legal Obligation (Article 6(1)(c)): Where we are required to retain data for tax, accounting, or regulatory purposes.

6. Data Sharing and Third-Party Services

We share your personal data only with the following categories of recipients, and only to the extent necessary:

Stripe (payment processing), processes payment card details and transaction data. Privacy policy: https://stripe.com/privacy

Google Meet (video sessions), processes video and audio data during sessions. Privacy policy: https://policies.google.com/privacy

Resend (email notifications), processes email addresses for transactional email delivery. Privacy policy: https://resend.com/legal/privacy-policy

Supabase (database hosting), stores account, booking, and profile data. Privacy policy: https://supabase.com/privacy

Google (advertising measurement and site analytics), where you accept non-essential cookies, Google Ads conversion tracking is used to measure the performance of our advertising and Google Analytics (GA4) is used to understand aggregated site usage. Privacy policy: https://policies.google.com/privacy

Microsoft (Clarity analytics), where you accept non-essential cookies, Microsoft Clarity is used to understand how visitors use the site, through aggregated usage analytics and session replay. Privacy policy: https://privacy.microsoft.com/privacystatement

Your therapist. Where a message you send our support team raises something your therapist needs in order to help you, we may share the relevant part of that message with your therapist. We share only what is necessary for your care or to answer your query.

Kure Digital does not sell, rent, or trade your personal data to third parties. Data is only shared with the third-party services listed above for the purposes of operating the Platform.

Where you request a report or letter, your therapist prepares it and it is made available to you through the Platform. The report is accessible to you and to Lingo, and is stored securely with access restricted in the same way as other health and therapy information we hold about you.

7. International Data Transfers

Some of our service providers (Stripe, Google, Microsoft, Supabase) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including EU-approved Standard Contractual Clauses (SCCs), adequacy decisions by the European Commission, and EU-US Data Privacy Framework certifications.

8. Data Retention and Account Closure

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Account data: Retained for the duration of your account and deleted within 30 days of account closure, unless legal retention obligations apply.

Booking and session data: Retained for 7 years to comply with Irish tax and accounting obligations.

Payment records: Retained for 7 years as required by Irish Revenue regulations.

Technical logs: Retained for up to 12 months for security and troubleshooting purposes.

Clinical session notes: Therapists are responsible for retaining clinical records in accordance with their professional obligations. Kure Digital retains shared session notes on the Platform for as long as the patient's account is active, or for up to 12 months after account closure, whichever is longer.

Reports and letters: Retained for as long as your account is active and for a limited period afterwards, then deleted, subject to any professional or legal retention obligations that apply to clinical records.

Uploaded documents: Retained for as long as needed for your therapy and your account, then deleted in line with the above, subject to legal retention obligations.

Support messages: Retained for as long as your account is active and for a limited period afterwards to resolve any follow-up queries, then deleted, subject to any legal retention obligations.

You have the right to request access to, correction of, or deletion of your personal data at any time by contacting hello@lingo-therapy.ie. Deletion requests will be honoured subject to our legal retention obligations. We will respond to all data access and deletion requests within 30 days.

9. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15): You may request a copy of the personal data we hold about you.

Right to Rectification (Article 16): You may request correction of inaccurate or incomplete data.

Right to Erasure (Article 17): You may request deletion of your data, subject to legal retention requirements.

Right to Restrict Processing (Article 18): You may request that we limit how we use your data.

Right to Data Portability (Article 20): You may request your data in a structured, commonly used, machine-readable format.

Right to Object (Article 21): You may object to processing based on legitimate interests.

Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hello@lingo-therapy.ie. We will respond within 30 days.

You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at www.dataprotection.ie.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (TLS/SSL), row-level security policies on database tables, secure authentication and session management, environment variables and secrets stored securely (never exposed client-side), regular review of access controls and security practices, and use of trusted, enterprise-grade infrastructure providers.

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for any activity that occurs under your account.

11. Cookies and Analytics

The Platform uses cookies and similar technologies, grouped as follows:

Essential cookies: Required for the Platform to function, such as authentication and session cookies. These are always active and do not require consent.

Analytics and advertising (non-essential): With your consent, we use Microsoft Clarity to understand how visitors use the site, through aggregated usage analytics and session replay, Google Analytics (GA4) to understand aggregated site usage such as which pages are visited, and Google Ads conversion tracking to measure the performance of our advertising. These are not set unless you accept them.

When you first visit the site we ask for your choice through a cookie banner, where you can accept all cookies or reject non-essential ones, in line with the Irish ePrivacy Regulations and the GDPR. Non-essential tools are only loaded if you accept. You can change or withdraw your choice at any time through the cookie settings. These tools may share data with Google and Microsoft as described in Sections 6 and 7.

12. Children's Data

Our platform may be used by parents or guardians to book speech therapy sessions for children. In such cases, the parent or guardian provides consent for the processing of the child's data. We do not knowingly collect data directly from children under the age of 16 without parental consent, in accordance with Article 8 of the GDPR and Irish law.

Where a parent or guardian registers on the Platform on behalf of a child, the child's personal data (name, date of birth, and therapy history) is collected and stored with the parent's consent. This data is shared only with the Therapist booked for the child's session. Parents or guardians may request access to, correction of, or deletion of their child's data at any time by contacting hello@lingo-therapy.ie.

Therapists can only access a patient's record where they have a current or recent session with that patient that requires it. Access is limited to what the therapist needs to provide and follow up on care.

13. Therapist Content and Data

Therapists who register on the Platform provide profile information including their name, qualifications, biography, profile image, CORU registration number, and specialisations. This information is displayed publicly on the Platform to help patients choose a suitable therapist.

Upon termination of a Therapist's account, their profile information will be removed from the Platform within 30 days. Therapists may request earlier removal by contacting hello@lingo-therapy.ie. Anonymised or aggregated data derived from a Therapist's use of the Platform (such as session volume statistics) may be retained for analytics and platform improvement purposes.

14. Marketing and Anonymised Data

Marketing communications: We send marketing communications, such as tips, resources, and updates, only where you have given your explicit consent. You can give or withdraw this consent at any time: through the marketing preference in your account profile settings, using the unsubscribe link in any marketing email, or by emailing hello@lingo-therapy.ie. Withdrawing marketing consent does not affect the transactional messages we send about your bookings and account, which are part of providing the service.

Anonymised and aggregated data: We may use anonymised and aggregated data, which does not identify any individual user, for marketing, promotional, and platform improvement purposes.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or by posting a prominent notice on the platform.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Company: Kure Digital
Email: hello@lingo-therapy.ie
Website: https://lingo-therapy.ie

You may also contact the Irish Data Protection Commission:
Website: www.dataprotection.ie
Phone: +353 (0)1 765 0100 / 1800 437 737