Privacy Policy

Introduction

Welcome to Gestalts. We built this app from our lived experience to help families like ours navigate the GLP journey. We understand how precious your child's information is because we're parents first.

This Privacy Policy explains how TLG Digital Solutions Pty Ltd ("TLG Digital," "we," "us," or "our") collects, uses, stores, and protects your personal information when you use the Gestalts mobile application ("App," "Service," or "Gestalts"). We are committed to transparency and protecting your family's privacy.

Our commitment:

1. Information We Collect

1.1 Information You Provide Directly

Account Information:

• Email address
• First and Last name
• Password

Child Profile Information:

• Child's first name
• Current GLP stage (optional)
• Interests (optional, to personalize AI interactions)

Memories & Tracking Data:

• Journal Entries: Text or voice-transcribed notes you create about observations, feelings, and daily experiences
• Milestones: Developmental markers you record with dates and optional notes
• Words & Phrases (Gestalts): Language samples you track, including phrases, sources, and contexts
• Appointment Notes: Questions and notes you prepare for speech pathologists or allied health practitioners, including supported audio attachments where enabled

Practitioner Profiles:

• Practitioner name and type (e.g., "Speech Pathologist")
• Contact information (optional)
• Notes about sessions

1.2 Automatically Collected Information

Usage Data:

• Coarse app features accessed, screen/page views, counts, durations, and non-identifying mode/type fields (to improve reliability and aggregate product quality)
• Error logs and crash reports (to fix bugs and improve stability)
• Device type and operating system version (to ensure compatibility)
• Operational telemetry for billing, entitlement checks, rate limits, abuse prevention, security, diagnostics, and reliability where needed

We do NOT collect:

• Precise location data
• Contacts or other device data unrelated to App functionality
• Browsing history outside the App
• Identifiable information for advertising purposes
• Stable user identifiers, child profile identifiers, child names, report/story/memory IDs, prompts, transcripts, free text, or child observations in product analytics events

1.3 Information from Third-Party Services

To provide AI-powered features, we connect to third-party services through Gestalts-managed service credentials rather than a user's personal consumer-AI account. Supported generative-AI text routes replace configured identifiers with random request-specific labels and use Google Cloud Sensitive Data Protection at a Sydney regional endpoint to detect and replace additional common identifiers before a model call. These controls reduce direct identifiers but do not make free-text context anonymous or untraceable to Gestalts. Audio must first be sent to the approved speech-to-text processor; the resulting transcript is protected before later generative-AI use.

2. How We Use Your Information

We use collected information to:

• Authenticate your account and maintain secure access
• Store and organize your memories, milestones, and tracking data
• Generate personalised GLP Companion responses
• Organize play-session observations for educational review
• Create custom storybook avatars and narratives
• Generate parent-controlled reports from your saved memories

2.2 What We DON'T Do With Your Data

We will NEVER:

• Sell your personal information to third parties
• Share your child's data with advertisers
• Use your data for targeted advertising
• Share identifiable information with researchers without explicit consent
• Publicly disclose your content

3. Data Processing and Storage

3.1 Where Your Data is Stored

User data is stored on Google servers with encryption at rest (AES-256) and in transit (TLS/SSL). The App caches some data locally on your device for offline access, protected by your device's security measures.

3.2 Cross-Border Data Transfers

For Australian users, we strive to store data in Australian data centers where possible. Some data processing occurs on servers outside Australia (e.g., AI processing). Cross-border transfers comply with Australian Privacy Principles and are protected by encryption and contractual safeguards.

3.3 AI Processing and User Images

Gestalts offers one optional photo-to-character route after a versioned notice and authority/AI-processing confirmations. The App re-encodes the image, Gestalts handles it only in request memory, and Google Vertex AI processes it globally under current provider terms. General image refinement and arbitrary image inputs remain disabled. Generated characters are stored only if you choose Save and remain until you delete them.

For supported text routes, known identifiers such as a child's or parent's name are replaced with random labels that exist only for that request. An additional sensitive-data check is then applied before the text reaches the generative model. Only feature-approved identifier types may be restored in a response. This is pseudonymisation and data minimisation, not anonymisation: details entered in free text may still identify a person, and Gestalts retains the account and operational records needed to provide and secure the service.

Production activation of the residual inspection control is fail-closed: if the approved regional inspection service is unavailable or not configured, the protected generative-AI request is rejected rather than sent without that inspection. Provider retention, logging, caching, training restrictions, and processing locations remain governed by current provider terms, configuration, and our data-processing agreements; Gestalts does not make a blanket Zero Data Retention claim for every AI route.

4. Data Sharing and Disclosure

4.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information or your child's information to third parties for marketing purposes. Your family's privacy is paramount.

4.2 With Third-Party Service Providers

We share limited data with service providers who help us operate the App: Google (database, authentication, storage, Sensitive Data Protection, text-based AI, text-to-image generation, and voice narration via Google Cloud Text-to-Speech). User photos are not accepted for AI processing. Provider obligations and our current DPA status are described in our sub-processor records and remain subject to legal review.

4.3 Legal Requirements

We may disclose information if required by law, court order, or to protect rights, safety, or property. We will notify you if legally permitted before disclosing your data and will challenge overly broad requests.

5. Your Rights and Choices

You have the right to:

• Access: Request a copy of all personal data we hold about you
• Portability: Export your data in a machine-readable format (PDF, CSV)
• Correction: Update or correct inaccurate information
• Deletion: Delete individual entries or your entire account
• Marketing Opt-out: Unsubscribe from non-essential emails

To exercise these rights, contact us at info@gestalts.com.au

6. Security Measures

We implement technical and organisational safeguards including:

• AES-256 encryption for all stored data
• TLS 1.2+ encryption for all data transmission
• Multi-factor authentication available
• Google Cloud security rules restricting data access

7. Children's Privacy

7.1 General Approach

The App is intended for parents/guardians (18+ years old). Children do not create their own accounts. Parents manage child profiles and provide child information. We do not collect data directly from children. Parents have full control over child data and can delete it at any time.

7.2 Australian and EU Users

For Australian users, we comply with the Privacy Act 1988 (Cth) and Australian Privacy Principles regarding children's information. For EU/EEA/UK users, we comply with GDPR requirements for processing children's data. Parents act as the responsible party for all child data.

7.3 United States Users

For US users, we comply with the Children's Online Privacy Protection Act (COPPA). While children do not create their own accounts, we recognize that the App facilitates collection of children's information through parent-controlled profiles.

Parental Rights and Control:

• Parents provide verifiable consent by creating an account and accepting these terms
• Parents have full control over child data and can access, modify, or delete it at any time
• We do not knowingly collect personal information directly from children under 13
• Parents can contact us at info@gestalts.com.au to review, modify, or delete their child's information

We collect only the minimum information necessary to provide the Service, as described in Section 1 of this Privacy Policy. We do NOT condition a child's participation on disclosure of more information than is reasonably necessary.

8. Third-Party Links and Services

The App may contain links to external resources. We are not responsible for external sites' privacy practices. Review their privacy policies before sharing information.

9. International Users

For Australian users, we comply with the Privacy Act 1988 (Cth) and Australian Privacy Principles. For EU/EEA/UK users, we comply with GDPR. Our legal basis for processing includes contract fulfillment, consent, and legitimate interest.

10. Changes to This Privacy Policy

Material changes will be notified via email and in-app notification. Continued use constitutes acceptance of changes. If you disagree with changes, you may delete your account before they take effect.

11. Contact Us

Gestalts Privacy Team Email: info@gestalts.com.au

Company: TLG Digital Solutions Pty Ltd Australia

12. Definitions

• "Personal Information": Information that identifies or can reasonably identify an individual
• "Processing": Any operation performed on data (collection, storage, use, deletion, etc.)
• "User," "You," "Your": The parent/guardian who creates and manages the Gestalts account
• "Child": The child whose profile is created within your account
• "TLG Digital," "We," "Us": TLG Digital Solutions Pty Ltd

13. Data Breach Notification

We take data security seriously and have implemented robust measures to protect your information. However, in the unlikely event of a data breach affecting your personal information:

• Notification Timeline: We will notify affected users within 72 hours of discovery of the breach
• Notification Content: Our notification will include the nature of the breach, types of data affected, steps we're taking to address the breach, and recommended actions you should take to protect yourself
• Regulatory Reporting: We will report breaches to relevant authorities as required by applicable law, including the Office of the Australian Information Commissioner (OAIC) for Australian users and supervisory authorities for EU users
• Remediation: We maintain incident response procedures and cyber insurance to address and mitigate the impact of any security incident

Our commitment is to transparency and swift action to protect your family's information. If you have concerns about the security of your data, please contact us immediately at info@gestalts.com.au.

Conclusion

We built Gestalts because we needed it for Olivia. We understand the trust you place in us when you share your child's journey. We treat your data with the same care we'd want for our own daughter.

If you have questions, concerns, or suggestions about privacy, please reach out. We're parents first, and we're here to listen.

Email: info@gestalts.com.au