Privacy Policy
Last updated: August 15, 2026
Read this before you speak
VozClínica is an educational language-practice tool. It is not a HIPAA-covered service, we do not sign Business Associate Agreements, and the AI patients are fictional. Never say a real patient’s name, medical record number, date of birth, or any other identifying detail during a session. Your voice is streamed to a third-party AI provider and your transcript is stored on our servers, so anything you say about a real person leaves your control.
1. What we collect
- Account details — your email address, and your name if you give one. Stored by Supabase, which provides our authentication.
- Payment details — handled entirely by Stripe. We never see or store your card number; we keep only Stripe’s customer and subscription identifiers so we know whether your account is active.
- Your voice — while a practice session is running, your microphone audio is streamed live to Google’s Gemini API so the AI patient can hear and answer you.
- Session recordings — a recording mixing your voice and the AI patient’s is saved so you can replay your own answers on the review screen. It is stored in a private bucket that only your account can read.
- Transcripts and scores — the text of each session, plus the feedback and scores generated from it.
- Usage analytics — which pages and features you use, via PostHog.
- Learning data — saved vocabulary, flashcard progress, and streaks.
2. Who processes it
We use these providers to run the service. Each receives only what it needs, and each has its own privacy policy governing what it does with that data.
- Google (Gemini API) — receives your live session audio and transcripts to generate the AI patient’s replies and your written feedback.
- Supabase — our database, file storage, and login system. Holds your account, transcripts, scores, and session recordings.
- Vercel — hosts the site and runs its server code.
- Stripe — processes payments and subscriptions.
- PostHog — product analytics.
- Resend — sends account and lifecycle email.
Pronunciation scoring, which would send short audio clips to Microsoft Azure Speech, is not currently enabled. No audio is sent to Microsoft. If we turn it on, we will update this policy and this sentence before it processes anything.
We do not sell your data, and we do not share it for advertising.
3. How long we keep it
We do not currently delete data on a schedule. Your transcripts, recordings, and scores stay available until you remove them, because the point of the progress chart is that it goes back as far as your practice does. That means deletion is yours to trigger — see the next section.
4. Deleting your data
- A single session — open the session from your dashboard and use “Delete this session”. This removes the transcript, the scores, and the audio recording.
- Your whole account — go to your profile and use “Delete my account”. This removes your login, every practice session and recording, your saved vocabulary and progress, and cancels any active subscription. It cannot be undone.
- A copy of your data — go to your profile and use “Download my data”. You get a file with every transcript, score, and piece of feedback, your saved vocabulary and progress, and one-hour links to your voice recordings. No need to ask us.
Deleting removes your data from our database and storage. Providers who already processed it (Google, Stripe, PostHog) hold their own copies under their own retention rules, and Stripe keeps payment records where law requires.
5. Email you receive
Account email — password resets, receipts, and notices about your subscription — is part of the service. Practice reminders and the weekly digest are opt-in and can be switched off from your profile or by using the unsubscribe link in any of them.
6. Security
Traffic is encrypted in transit. Session recordings live in a private bucket readable only by the account that made them, and database access is restricted per-user at the row level. No system is perfectly secure, which is the reason for the warning at the top of this page: the strongest protection for patient information is not putting it into the app.
7. Children
VozClínica is intended for clinicians and health-professions students. It is not directed at children under 13 and we do not knowingly collect their data.
8. Changes
If this policy changes materially, we will update the date at the top and, where the change affects how your data is processed, tell you by email.
9. Contact
Questions, data requests, or corrections: hola@vozclinica.com.