Privacy Policy

Last updated: October 26, 2026

1. Who this policy applies to

falatheo has two parts with different data handling practices:

• falatheo mobile app — the free app for iOS and Android, used by the person communicating.
• Web platform (falatheo.com.br) — the portals for parents, professionals, clinics and teachers, which require an account.

2. The mobile app

The falatheo app was designed to be someone's voice, and someone's voice should not depend on the internet nor be monitored. That's why:

• It works 100% offline; the board, symbols and voice itself stay on the device.
• There is no login and no account needed in the app.
• We do not use analytics tools, crash reporting, advertising SDKs or trackers. We do not use the advertising ID or location.
• Unpaired, the app sends nothing: what is tapped, typed or spoken, photos and preferences (voice, colors, language) stay only on the device. Uninstalling the app removes that data.
• Own-voice recordings ("Record my voice") always stay on the device and are never sent, even when the device is paired.

2.1 Pairing (optional)

A guardian can connect the device to a professional, clinic or school with a code or QR code generated in the portal. Pairing happens in Settings → Connection (with the caregiver PIN, if one is set). From then on:

• the app downloads the boards configured in the portal, with their images and audio, and keeps them on the device so they work offline;
• the app uploads edits made on the device to boards that came from the portal (for example words, spoken text, order and category names and colors) and the photos a caregiver adds to those boards (including routine-step photos), which are stored on falatheo's server and visible to the linked team; photos added to the built-in boards are not uploaded;
• the server stores the device name (the device model by default, e.g. “Moto G8”; editable on the pairing screen), the operating system and its version, the app version, the usage context (home, school or clinic), the pairing and last-sync dates, and a device access token. The app does not use notifications.

2.2 Usage data (optional, off by default)

Only if the family authorizes usage data for that patient in the portal, a paired device sends usage events to falatheo's server: which symbols were tapped, the sentences and text spoken or typed (the words said), board opens and usage sessions, the time of each event, the board and item identifiers, and the context (home, school or clinic). This data is visible to the team linked to the patient (professionals, clinic, family and authorized teachers) and is summarized as weekly metrics (for example, how many different words were used and in which context).

While the authorization is off, no usage event is sent or kept for sending. We never send voice recordings, microphone audio, photos or location. The authorization can be withdrawn at any time in the portal (the patient's "Uso" section, under "Comunicação"); from then on nothing new is sent. Each change is recorded, including who made it.

How long: detailed usage events (with the words and phrases) are deleted automatically after 12 months. Weekly metrics are kept while the account exists and are deleted with it.

2.3 How to disconnect and delete

• In the app: Settings → Connection → Disconnect (asks for the caregiver PIN, if one is set). The device token stops working and nothing else is sent; the boards stay on the device.
• In the portal: the family or the team can revoke the device, turn usage data off and remove photos and boards.
• By e-mail: to delete data sent by the device (usage events, photos, device data), write to privacidade@falatheo.com.br or contato@falatheo.com.br. When the clinic or professional is the controller of that data, we forward the request to them (see section 7 on records that must be kept).
• Uninstalling the app deletes everything stored on the device.

3. The web platform (with account)

When using the portals on falatheo.com.br, we process only the data necessary for the service:

• Registration: name, email and password (stored encrypted).
• Platform use: boards, symbols, photos and settings you create to track communication, and data sent by paired devices (section 2).
• Technical data: minimal records needed for security and operation (for example, IP address in access logs).
• Health and care data: when a clinic or professional records it (diagnosis, goals, assessments, notes, reports). The clinic or professional is the controller and falatheo processes this data on their behalf as processor. The most sensitive fields are stored encrypted.
• Invitations: name and email of the invited person (family, professional, teacher or team member) and who invited them. Invitations expire after 14 days; access only starts once accepted.
• Consents: we record which terms were accepted, the version, date and IP address.

We use this data only to provide and improve the service and to send essential communications about your account. We do not use platform data for advertising.

3.1 Portal usage statistics

To learn where people struggle in their first steps on the portal (for example, how many add a first patient or skip the tutorial), we count a few steps anonymously and in aggregate: only the kind of step, the portal type (clinic, professional, family or teacher), the role in the account and the day. These counts do not include names, e-mail addresses, a person identifier, IP addresses or patient data, and they are not used for advertising or shared. They stay on our own server, with no third-party analytics tools, and are deleted after 180 days. The communication app does not send these statistics.

4. Data sharing

We do not sell your personal information. We share data only when strictly necessary to operate the service (for example, hosting providers and email services) or when required by law. These vendors process data under our instruction.

5. Children

falatheo is often used by children. Unpaired, the mobile app sends no data. When paired, sending is set up by an adult in caregiver mode, and usage data is only sent with the family's authorization (section 2); there are no ads, no tracking and no commercial profiling. On the web platform, accounts are created and managed by parents, guardians or professionals who are responsible for the data of patients in their care. When accepting a clinic's invitation, the guardian gives a specific and highlighted consent for the child's health data (LGPD, art. 14). Invited teachers only see boards, goals and notes shared with the school for the students they are linked to.

6. Security

We adopt technical and organizational measures to protect data against unauthorized access, alteration or destruction, including password hashing, HTTPS traffic, encryption of the most sensitive health fields and an audit log of important actions.

7. Your rights (LGPD)

Under Brazil's General Data Protection Law (Law No. 13,709/2018), you can access, correct, export or delete your personal data, as well as revoke consents. To exercise these rights, contact us at privacidade@falatheo.com.br or contato@falatheo.com.br.

Some clinical records that professionals keep on the platform (for example, session notes and reports) may have to be retained by the professional or clinic for the period required by their professional council. The LGPD allows data to be kept to meet a legal or regulatory obligation (art. 16, I). In those cases we offer an export before the account is closed and delete everything that does not need to be kept.

8. App stores

falatheo is distributed free through the App Store (Apple) and Google Play (Google). When downloading the app, the store may handle its own download data under Apple's and Google's privacy policies, which are separate from this policy.

9. Changes

We may update this policy from time to time. Relevant changes will be indicated by the "Last updated" date at the top of this page.

10. Contact

Questions about this policy? Write to contato@falatheo.com.br or use our Contact page.