Encryption at Rest
Data is encrypted at rest using AES-256. Data in transit uses TLS 1.2 or higher.
Safety and privacy
We collect only what is needed, encrypt stored data and data in transit through our platform services, keep sharing under parent control, and never sell your data.
Protection
Practical controls for child data, family notes, and parent-approved sharing.
Data is encrypted at rest using AES-256. Data in transit uses TLS 1.2 or higher.
All data transmission between your device and our servers uses TLS 1.2 or higher encryption, preventing interception during transfer.
Primary Firestore data and production app file storage are configured in Sydney. Some backend, authentication, analytics, and AI processing may occur in provider-managed, US, or global regions.
Access controls are used to limit who can access production systems and supporting cloud infrastructure.
Support Circle sharing is controlled by the parent and scoped by data type. Sensitive note content stays inside the authenticated app; email notifications ask recipients to sign in instead of including child details.
After a specific notice and confirmations, one optional photo can create a character. Gestalts does not save the source to your account; Google Vertex AI processes it globally under current provider terms. Other user-image and refinement inputs remain disabled.
Supported generative-AI text routes replace known identifiers with request-specific labels and run an additional sensitive-data check before the model call. This reduces direct identifiers, but free-text details may still identify someone.
AI requests use Gestalts-managed service credentials rather than your personal consumer-AI account. This limits provider-side account linkage to you, but it does not make a request anonymous or untraceable within Gestalts.
Privacy
How we approach data collection, choice, and transparency.
Your family's information will never be sold, rented, or traded to third parties for marketing purposes. Period.
Access, modify, export, or delete supported data from the app, or contact us if you need help with a data request.
We collect what is needed to provide the service and avoid unnecessary identifiers for children wherever possible.
Our Privacy Policy and Terms are written to be understandable, with internal data maps and processor lists maintained for review.
Compliance
The privacy, consumer, and data-protection standards that guide our work.
We are built to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
For European users, our practices are designed to align with GDPR data minimisation and erasure requirements.
For US users, our practices are designed to align with the Children's Online Privacy Protection Act.
Our Terms are written to meet Australian Consumer Law and transparency standards.
Transparency
How we assess, contain, and communicate security concerns.
Security concerns are triaged for scope, affected data, and user impact
Affected users receive practical information about what happened and what to do next where required
Reports are made to the OAIC and other relevant bodies when notification obligations apply
We prioritise containment, credential rotation, audit review, and follow-up fixes
Practitioner directory
The Gestalts practitioner directory lists health practitioners who have registered on the platform and indicated relevant experience working with gestalt language processors (GLPs).
Practitioners enter their own credentials, qualifications, and experience, and attest to their accuracy when they apply.
Listing in the Gestalts practitioner directory does not constitute:
When choosing a practitioner from the directory:
We know finding the right speech pathologist can be a long road - we have lived it. For practical guidance from our own family's experience, see our resources on choosing a speech pathologist, managing waiting lists, and what you can do while you wait, at gestalts.com.au/resources.
Different professions in the directory are regulated differently:
TLG Digital Solutions Pty Ltd:
Any professional relationship formed through the directory is between you and the practitioner directly.
If you have concerns about a practitioner listed in the directory:
For questions about the practitioner directory:
Email: info@gestalts.com.au
This disclaimer is not legal advice. Always exercise your own judgment when choosing a health practitioner for your child.
| Version | Date | Summary |
|---|---|---|
| 1.1-draft | 19 July 2026 | Added "Credentials Are Self-Reported by Practitioners" section. Corrected the regulatory framework: speech pathologists are self-regulated via Speech Pathology Australia (CPSP), not AHPRA; AHPRA guidance now applies only to AHPRA-registered professions. Added "do your own research" guidance with links to family resources on finding a speech pathologist and managing waiting lists. |
| 1.0 | 4 April 2026 | Initial version. |