Privacy Policy

Introduction

Welcome to Gestalts. We built this app from our lived experience to help families like ours navigate the GLP journey. We understand how precious your child's information is because we're parents first.

This Privacy Policy explains how TLG Digital Solutions Pty Ltd ("TLG Digital," "we," "us," or "our") collects, uses, stores, and protects your personal information when you use the Gestalts mobile application ("App," "Service," or "Gestalts"). We are committed to transparency and protecting your family's privacy.

Our commitment: We collect only what's necessary to provide value. We don't sell data. We don't track you for advertising. We treat your child's information the way we'd want Olivia's information treated.

1. Information We Collect

1.1 Information You Provide Directly

Account Information:

• Email address
• First and Last name
• Password

Child Profile Information:

• Child's first name
• Current GLP stage (optional)
• Interests (optional, to personalize AI interactions)

Note: We deliberately keep child profiles minimal. We don't ask for surnames, addresses, medical record numbers, or other identifying information beyond what's needed for the App to function.

Memories & Tracking Data:

• Journal Entries: Text or voice-transcribed notes you create about observations, feelings, and daily experiences
• Milestones: Developmental markers you record with dates and optional notes
• Words & Phrases (Gestalts): Language samples you track, including phrases, sources, and contexts
• Appointment Notes: Questions and notes you prepare for specialists, including optional attachments (images, audio)

Specialist Profiles:

• Specialist name and type (e.g., "Speech Therapist")
• Contact information (optional)
• Notes about sessions

1.2 Automatically Collected Information

Usage Data:

• App features accessed (to improve user experience)
• Session duration and frequency (to understand engagement)
• Error logs and crash reports (to fix bugs and improve stability)
• Device type and operating system version (to ensure compatibility)

We do NOT collect:

• Precise location data
• Contacts or other device data unrelated to App functionality
• Browsing history outside the App
• Identifiable information for advertising purposes

1.3 Information from Third-Party Services

To provide AI-powered features, we connect to third-party services via API: Google (authentication, database, cloud storage, text-based AI, image generation), ElevenLabs (voice AI).

2. How We Use Your Information

We use collected information to:

• Authenticate your account and maintain secure access
• Store and organize your memories, milestones, and tracking data
• Generate personalised AI Coach responses
• Analyse play sessions and provide developmental feedback
• Create custom storybook avatars and narratives
• Generate specialist reports from your saved memories

2.2 What We DON'T Do With Your Data

We will NEVER:

• Sell your personal information to third parties
• Share your child's data with advertisers
• Use your data for targeted advertising
• Share identifiable information with researchers without explicit consent
• Publicly disclose your journal entries, milestones, or other private content

3. Data Processing and Storage

3.1 Where Your Data is Stored

User data is stored on Google servers with encryption at rest (AES-256) and in transit (TLS/SSL). The App caches some data locally on your device for offline access, protected by your device's security measures.

3.2 Cross-Border Data Transfers

For Australian users, we strive to store data in Australian data centers where possible. Some data processing occurs on servers outside Australia (e.g., AI processing). Cross-border transfers comply with Australian Privacy Principles and are protected by encryption and contractual safeguards.

3.3 Photo Processing for Avatar & Storybook Creation

4. Data Sharing and Disclosure

4.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information or your child's information to third parties for marketing purposes. Your family's privacy is paramount.

4.2 With Third-Party Service Providers

We share limited data with service providers who help us operate the App: Google (database, auth, storage, text-based AI, image generation), and ElevenLabs (voice AI). All service providers are contractually obligated to protect your data.

4.3 Legal Requirements

We may disclose information if required by law, court order, or to protect rights, safety, or property. We will notify you if legally permitted before disclosing your data and will challenge overly broad requests.

5. Your Rights and Choices

You have the right to:

• Access: Request a copy of all personal data we hold about you
• Portability: Export your data in a machine-readable format (PDF, CSV)
• Correction: Update or correct inaccurate information
• Deletion: Delete individual entries or your entire account
• Marketing Opt-out: Unsubscribe from non-essential emails

To exercise these rights, contact us at info@gestalts.com.au

6. Security Measures

We implement technical and organisational safeguards including:

• AES-256 encryption for all stored data
• TLS 1.2+ encryption for all data transmission
• Multi-factor authentication available
• Google Cloud security rules restricting data access

7. Children's Privacy

7.1 General Approach

The App is intended for parents/guardians (18+ years old). Children do not create their own accounts. Parents manage child profiles and provide child information. We do not collect data directly from children. Parents have full control over child data and can delete it at any time.

7.2 Australian and EU Users

For Australian users, we comply with the Privacy Act 1988 (Cth) and Australian Privacy Principles regarding children's information. For EU/EEA/UK users, we comply with GDPR requirements for processing children's data. Parents act as the responsible party for all child data.

7.3 United States Users

For US users, we comply with the Children's Online Privacy Protection Act (COPPA). While children do not create their own accounts, we recognize that the App facilitates collection of children's information through parent-controlled profiles.

Parental Rights and Control:

• Parents provide verifiable consent by creating an account and accepting these terms
• Parents have full control over child data and can access, modify, or delete it at any time
• We do not knowingly collect personal information directly from children under 13
• Parents can contact us at info@gestalts.com.au to review, modify, or delete their child's information

We collect only the minimum information necessary to provide the Service, as described in Section 1 of this Privacy Policy. We do not condition a child's participation on disclosure of more information than is reasonably necessary.

8. Third-Party Links and Services

The App may contain links to external resources. We are not responsible for external sites' privacy practices. Review their privacy policies before sharing information.

9. International Users

For Australian users, we comply with the Privacy Act 1988 (Cth) and Australian Privacy Principles. For EU/EEA/UK users, we comply with GDPR. Our legal basis for processing includes contract fulfillment, consent, and legitimate interest.

10. Changes to This Privacy Policy

Material changes will be notified via email and in-app notification. Continued use constitutes acceptance of changes. If you disagree with changes, you may delete your account before they take effect.

11. Contact Us

We will respond within 5 business days for general inquiries and 30 days for formal data access/deletion requests.

12. Definitions

• "Personal Information": Information that identifies or can reasonably identify an individual
• "Processing": Any operation performed on data (collection, storage, use, deletion, etc.)
• "User," "You," "Your": The parent/guardian who creates and manages the Gestalts account
• "Child": The child whose profile is created within your account
• "TLG Digital," "We," "Us": TLG Digital Solutions Pty Ltd

13. Data Breach Notification

We take data security seriously and have implemented robust measures to protect your information. However, in the unlikely event of a data breach affecting your personal information:

• Notification Timeline: We will notify affected users within 72 hours of discovery of the breach
• Notification Content: Our notification will include the nature of the breach, types of data affected, steps we're taking to address the breach, and recommended actions you should take to protect yourself
• Regulatory Reporting: We will report breaches to relevant authorities as required by applicable law, including the Office of the Australian Information Commissioner (OAIC) for Australian users and supervisory authorities for EU users
• Remediation: We maintain incident response procedures and cyber insurance to address and mitigate the impact of any security incident

Our commitment is to transparency and swift action to protect your family's information. If you have concerns about the security of your data, please contact us immediately at info@gestalts.com.au.

We built Gestalts because we needed it for Olivia. We understand the trust you place in us when you share your child's journey. We treat your data with the same care we'd want for our own daughter.

If you have questions, concerns, or suggestions about privacy, please reach out. We're parents first, and we're here to listen.

Email: info@gestalts.com.au