Privacy Policy

Last updated: 27 September 2026

1. Who we are

EPSpeak (“EPSpeak“, “we“, “us“, “the app“) is a voice-wellness application operated by MANOAI Pty Ltd (ABN 48 689 793 244, ACN 689 793 244) (“the operator”), of Capital Square Towers, Level 25, Tower 3, 1 Spring Street, Perth, WA 6000, Australia (www.manoai.ai). This policy explains what personal data the app collects, why, how it is stored and protected, and the choices and rights you have.

For any privacy question or request, contact us at admin@manoai.ai.

2. EPSpeak is a wellness app, not a medical device

EPSpeak helps you record daily voice samples and track wellness, medication, and voice-pattern trends over time for your own personal awareness. It does not diagnose, treat, cure, or prevent any disease or condition, and the scores it shows are not a medical assessment. Always consult a qualified healthcare professional about any health concern. Do not use EPSpeak for emergencies.

3. What data we collect

You provide most of this data directly by using the app; some is generated automatically by your device when you record.

Data you create in the app

Voice recordings. When you record a voice sample, the app captures a lossless audio file of you reading a short affirmation aloud. This is the core input the app analyses.
Voice-analysis results. Scores derived from your recordings, including a Combined Voice Change Score (0–100).
Wellness check-ins. Your answers (each 0–3) to six self-report wellness questions, the total score, and an optional flag indicating you reviewed the check-in with your clinician.
Medication log. Medications you choose to record: name, dosage, frequency, and dates of changes.
Medication reminder responses. If you turn on reminders, each time you tap Taken or Skip we record which medication it was and when you tapped.
Mood/context labels. An optional emotion and intensity you select before recording, and the text and language of the affirmation you read.

Data collected about you

Motion-sensor readings. While — and only while — a voice recording is in progress, the app reads your phone’s motion sensors, and we derive measures of movement from those readings. The readings and the measures derived from them are uploaded, attached to that recording, and are stored and deleted on the same terms as your voice recordings (Section 8). Sensing starts when you start recording and stops when the recording stops.
Movement captures you start (optional). If you start one, the app also reads your phone’s motion sensors during a short guided walk and, on iPhone, during a longer capture worn on your leg, and we derive measures of how you walk and move. As with recordings, the readings and the measures derived from them are uploaded, and are stored and deleted on the same terms as your voice recordings (Section 8). If you never start a capture, none of this applies.
Demographic information. Provided once at first launch: sex, age range, country, the type of medication you tell us you take, and — optionally — your height, which is used only for your walking measures. You can leave it blank and use the app normally.
Identifiers. On first launch the app signs you in anonymously via Firebase Authentication and receives a randomly generated user ID (“uid”). This uid links your data to your installation. The app also derives a non-reversible hashed identifier from it. We do not collect your name, email address, phone number, or precise location.
Device and technical information. Operating-system name and version, app version, and recording-quality metrics (e.g. signal level, noise estimate).

Data we do not collect

No name, email, phone number, contacts, or precise/GPS location.
No advertising identifiers, and we do not use the app for advertising.

4. How we use your data

We use the data above only to:

Analyse your voice recordings and produce your voice-pattern scores;
Show you your trends, wellness history, and medication log over time;
Establish and refine your personal baseline so scores are meaningful for you;
Maintain and improve the reliability of the app, including recording quality;
Relate your readings to the context you record in the app, such as your medications and check-ins, so that a change can be interpreted rather than just observed;
Support the possible future development of voice-analysis models, using the data you have provided under this policy. Research use is limited to subjects who have separately and explicitly enrolled in the pilot study. Enrolment is done by us, by hand, for a named subject who has consented to it; it is not something an ordinary installation is placed into by default, and ordinary use of the app never contributes to model training.
Produce aggregate statistics about how the app is being taken up: how many installations there were in a given month, from which countries, and their age band, sex and medication-type distributions. These are counts and nothing else. They carry no identifier, and each figure covers a single characteristic rather than a combination of them, so no figure describes a small enough group to point at anybody. Because they are not personal data they are not deleted with the rest of your records — see Section 8.

We do not sell your personal data, and we do not use it for third-party advertising or profiling unrelated to the app’s function.

5. Legal bases and applicable law

The operator is an Australian company, so the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to everything described here. Under the Act, health information — which is what voice recordings, motion and movement measures, wellness answers and your medication log are — is sensitive information, and APP 3 permits us to collect it only with your consent and only where it is reasonably necessary for our functions. That is why consent is requested up front, before any collection, rather than assumed.

Where UK/EU data-protection law also applies, we rely on:

Your consent, which you give at onboarding before any data is collected, and which you can withdraw at any time (see Section 9); and
Our legitimate interests in operating and securing the app.

Voice recordings, motion-sensor measures, walking and leg-worn movement measures, and wellness and medication entries constitute health data / special-category data. We process them on the basis of your explicit consent, given at onboarding.

A note on biometric data specifically. A voice recording is capable of identifying you, and we analyse its acoustic characteristics; the same is true in principle of how you hold and move a device. We do not use either to identify or authenticate anyone, and we operate no voice- or motion-matching system — the analysis measures change in your own readings over time against your own earlier ones. Some jurisdictions nonetheless treat data of this kind as biometric regardless of that purpose, so we treat voice and motion data as special-category health data throughout this policy and process them only with your explicit consent.

6. Where your data is stored and how it is protected

Your data is stored using Google Firebase / Google Cloud Platform services (Firebase Authentication, Cloud Firestore, and Firebase Storage), which act as our data processor. Google may store and process data on infrastructure located outside your country, including in the United States.

Protections in place:

Data is transmitted over encrypted connections (HTTPS/TLS) and encrypted at rest by Google Cloud.
Access is scoped by security rules so that each installation’s data can only be read or written by that same signed-in user; one user cannot access another user’s data.

7. Sharing and disclosure

We do not share your personal data with third parties except:

Service providers who process data on our behalf and under our instructions (currently Google, for the Firebase/Cloud services above);
Where required by law, legal process, or to protect rights and safety.

We do not sell your data and we do not share it with advertisers or data brokers.

8. How long we keep your data

Voice recordings and raw sensor readings (the audio and motion files themselves) are deleted after 7 days unless you are an enrolled pilot-study subject. A scheduled job runs daily and removes them. If you are not in the study — which is the ordinary case — we do not keep these files; we keep only the scores and measures derived from them.
If you are not an enrolled pilot-study subject — the ordinary case — we delete everything else we hold for you once you have been inactive for 30 days. A scheduled job runs daily, finds the most recent dated record we hold for your installation, and if it is older than 30 days it removes the whole of your data: voice-analysis results, motion measures, walking and leg-worn movement measures, wellness entries, medication entries and demographics. There is nothing to opt into and nothing to switch off. Note what this means in practice: your cloud history is kept while you are using the app, and is cleared if you stop. The trends held on your own phone are not affected by this job.
For enrolled pilot-study subjects, that data is retained for as long as your installation exists and you continue to use the app, so long-term trends can be seen.
If you delete your data or request deletion (Section 9), we delete it as described there.
An account we hold no dated record for is kept rather than removed, because we cannot tell how old it is.
Aggregate counts are kept indefinitely, and they are not your data. When your installation is first seen we add 1 to a handful of running totals — how many installations that month came from your country, how many fell in your age band, and so on. Each total covers one characteristic on its own, never a combination, and none of them records an identifier. Note what follows from that, because it is the honest consequence rather than a loophole: deleting your data (Section 9) removes everything we hold about you, but it cannot decrement a total that no longer refers to anyone in particular. Nothing about your medications, your recordings, your check-ins or your movement data enters these totals.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to withdraw consent.

Delete all your data (in-app). Go to Settings → Privacy & data → Delete my data. This permanently and immediately erases all of your data — voice recordings, raw sensor readings, scores and movement measures, wellness check-ins, medication log, and demographics — from both your device and EPSpeak Cloud, and issues your installation a new anonymous identifier with a fresh start. Because the app uses an anonymous account tied to your device, you can perform this yourself without contacting us and without providing any identity. This action cannot be undone.
On-device controls. You can also reset just your voice baseline in Settings without deleting everything.
Access or export. Because we do not collect an email or identity, we cannot look your data up by name. For any access/export request, or if the in-app deletion fails, contact admin@manoai.ai; we will respond within 30 days (we may need information to help locate your data).
Withdraw consent. You can withdraw consent at any time by deleting your data as above and discontinuing use of the app.
Complaints (Australia). If you are not satisfied with how we have handled your personal information or a privacy complaint, you may complain to the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au, 1300 363 992. We ask that you contact us first so we have an opportunity to resolve it.

10. Children’s privacy

EPSpeak is intended for users aged 16 and over and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

11. International data transfers

As noted in Section 6, your data may be processed in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as Google Cloud’s standard contractual clauses) for these transfers.

For Australian users this is a cross-border disclosure under APP 8: we disclose your personal information to Google (Firebase / Google Cloud) as our processor, and it may be held on infrastructure outside Australia, including in the United States. We take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “Last updated” date. Material changes will be brought to your attention within the app where appropriate.

13. Contact us

MANOAI Pty Ltd — ABN 48 689 793 244, ACN 689 793 244
Capital Square Towers, Level 25, Tower 3
1 Spring Street, Perth, WA 6000, Australia
Web: www.manoai.ai
Email: admin@manoai.ai