Privacy

Who we are

Articarry, Inc., a Delaware corporation, provides the practice platform described on this site. Where a speech-language pathology practice is a covered entity under HIPAA and uses Articarry with their patients, the practice controls the clinical relationship and Articarry acts as their business associate, handling protected health information on their behalf and only as that agreement permits. Where a guardian uses Articarry directly, we handle their data as this notice describes.

Privacy questions, requests, and complaints: privacy@articarry.com. We answer in writing.

What Articarry stores

• Account details for the clinician and the guardian who sign in: email address, a display name, and a hashed password. The clinician's self-attested licensing line is stored as plain text on the clinician profile.
• A child's first name and the practice a clinician has assigned them. A child is never a user; a child has no login, no password, no session of their own.
• Short audio recordings a child makes while practicing. Each recording is paired with the scoring provider's response and a derived per-word score block. The audio blob and the score are kept together while the audio is retained; the score block is preserved after the audio is removed (see How long things are kept).
• An audit log of sensitive reads + writes: which clinician opened a recording's detail view, which clinician streamed a recording's audio, when a guardian granted or revoked consent, when an account or child was deleted. The audit log carries identifiers, never transcripts or names; a future compliance team can read it without that read being a privacy event.

Who can see it

A child's recordings are reachable by that child's clinician (the one whose caseload the child is enrolled on) and by their guardian (through the guardian's signed-in session). They are not shared with anyone else and they are not sold.

We do not use third-party analytics. We do not place advertising cookies. We do not send marketing email to families, or about a child. If you ask us to keep you posted about the product using the form at the foot of this page, we email you about that and nothing else, and every message unsubscribes in one click.

How long things are kept

Audio recordings are kept for 180 days, and nothing is kept longer than it needs to be. If you want something gone sooner than the schedule, ask us and we will delete it.

• Audio recordings: the audio blob is kept for 180 days. After that, the audio is removed from storage. The Recording row + the scoring provider's response + the derived per-word score block are preserved so the clinician's history of what happened stays truthful. Only the bytes are gone.
• A removed child or account: hidden from the product straight away, recoverable by the guardian from their account page in case they change their mind, and permanently removed no later than 180 days. Ask us and we do it sooner.
• The audit log: kept for the lifetime of the deployment. Audit rows are identifiers; removing them would defeat their purpose.
• Account details + the assignments a clinician has authored: kept while the account is active. Deletion of the account removes them along with everything else above.

The control a family keeps

Consent for recording is given by the guardian before practice starts, and it can be withdrawn at any time. A guardian can ask for a child's recordings to be deleted whenever they like, and they do not have to give a reason. Removing a child deletes all of their recordings; for one specific clip, email privacy@articarry.com and we remove it. The deletion path is on the account page.

A clinician can remove a child from their caseload. That ends the clinician's access; the family's account and recordings remain. Deleting a family's data is the family's call, not the clinician's.

The companies that touch the data

A short list, kept current. Anything that handles a child's audio or the records attached to it does so under a signed business associate agreement; anything that does not is kept free of that data by design, not by promise.

Articarry does not use third-party analytics, advertising, or session replay. Data is not transferred outside the United States. If this list ever changes, it changes here first.

Your rights over your data

These apply to everyone, not only where a particular law grants them. Every one of them is a button in the product rather than a request you have to write:

• See it. A guardian can read everything held about their family from their account page.
• Take a copy. Download the whole record, as a readable page or as data.
• Delete it. A child or the whole account, with a 30 day window to undo, then permanent removal.
• Withdraw permission. Stop recording at any time without deleting anything, and separately withdraw the optional permission for Articarry's own team.
• Fix it. Ask us to update anything inaccurate by writing to privacy@articarry.com.
• Object. Tell us to stop collecting anything further, and we stop.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to profile anyone. There is nothing to opt out of, because we do not do it. Consumer health data laws in some states (Washington's My Health My Data Act among them) treat a child's speech recordings as sensitive health data; we treat them that way everywhere, for everyone.

If something goes badly

If personal information is exposed, Articarry investigates immediately, tells the affected practice without unreasonable delay and no later than ten calendar days after discovering it, and supports their own notification duties. Where Articarry holds the direct relationship, we tell the affected people ourselves. The notice says what happened, when, what was involved, and what we have done, without waiting until every answer is in.

Suspected a problem? Write to security@articarry.com. We acknowledge in writing and we do not pursue good-faith researchers.

Changes to this notice

Each version is kept. If a change materially affects what we do with a child's recordings, we tell the account on file before it takes effect and, where the change goes beyond what a family already agreed to, we ask again rather than assume. The consent a guardian gives is versioned separately from this notice for exactly that reason.

Cookies and tracking

We use only essential cookies: the Django session cookie that keeps you signed in, and the CSRF cookie that protects every form. We do not use analytics cookies, advertising cookies, or third-party tracking pixels of any kind. A "cookie consent banner" would be cargo-cult here: there is nothing to consent to beyond the session that signs you in.

How to reach us

Privacy questions during the beta: privacy@articarry.com. Security disclosures: security@articarry.com. We acknowledge in writing.