Data Protection Statement

MiVoiceApp Ltd

Last updated: 5 May 2026

1. PURPOSE OF THIS STATEMENT

This Data Protection Statement is addressed to professional users of the MiVoiceApp platform: teachers, careers counsellors and other educational professionals. It explains how data protection responsibilities are shared between MiVoiceApp Ltd and professional users, and what professional users must do to use the platform lawfully.

This statement supplements our Privacy Policy, which covers the processing of professional users' own account data.

2. THE NATURE OF DATA PROCESSED ON THE PLATFORM

The MiVoiceApp platform is designed to support educational professionals in understanding the communication preferences and needs of non-verbal children and children with verbal communication difficulties. In using the platform, professional users may enter and process the following data about students:

- Student first name

- School name

- Professional notes

- Interview responses (selections made by or on behalf of students during structured preference interviews)

- Photographs uploaded in connection with interview questions

This data relates to children (individuals under 18) and may reveal or imply information about disabilities, special educational needs or health conditions. Such data constitutes special category data under Article 9 of the UK GDPR and is subject to heightened protection requirements.

3. DATA CONTROLLER AND DATA PROCESSOR ROLES

The UK GDPR distinguishes between data controllers (who determine why and how personal data is processed) and data processors (who process data on behalf of controllers).

Professional users are data controllers for all student data they enter into the MiVoiceApp platform. This means professional users:

- Determine which students' data is entered into the platform

- Determine the purposes for which that data is processed

- Are responsible for ensuring that a lawful basis exists for processing

- Are responsible for obtaining any required consent from parents or guardians

- Are responsible for responding to any data subject rights requests from students, parents or guardians

- Are responsible for ensuring their use of the platform complies with their employer's data protection policies and any applicable sector-specific obligations

MiVoiceApp Ltd is a data processor for student data. We process student data only on the instructions of professional users, solely for the purpose of providing the platform's services. We do not access, use or analyse student data for any other purpose.

4. LAWFUL BASIS FOR PROCESSING STUDENT DATA

Professional users must ensure that a valid lawful basis exists under Article 6 of the UK GDPR before entering student data into the platform, and, because student data may constitute special category data, a valid condition under Article 9 of the UK GDPR.

The most appropriate bases are likely to be:

Article 6 lawful basis:

- Article 6(1)(e): processing necessary for the performance of a task carried out in the public interest, where the professional is employed by a public educational institution

- Article 6(1)(f): legitimate interests of the educational institution, where this is not overridden by the interests of the child

Article 9 special category condition:

- Article 9(2)(a): explicit consent from the parent or guardian of the child

- Article 9(2)(b): processing necessary for carrying out obligations in the field of employment, social protection or education law, where authorised by law

We strongly recommend that professional users obtain explicit written consent from a parent or guardian before entering any student data into the platform. The platform requires professional users to confirm that appropriate consent has been obtained at the point of creating each student profile.

5. PROFESSIONAL USER OBLIGATIONS

By using the MiVoiceApp platform, professional users accept the following obligations.

5.1 Consent and Legal Basis

- Obtain and document appropriate consent from parents or guardians before entering student data into the platform

- Ensure the purpose for which student data is entered is clearly communicated to parents or guardians

- Not enter data about a student where consent has been refused or withdrawn

5.2 Data Minimisation

- Enter only the minimum student data necessary for the platform's purpose

- Not enter student surnames, dates of birth, home addresses or any other data not required for the interview and report generation process

5.3 Accuracy

- Ensure that student data entered into the platform is accurate and kept up to date

- Delete or correct data that is inaccurate or no longer relevant

5.4 Access and Security

- Keep your platform login credentials secure and do not share them with unauthorised persons

- Enable and maintain multi-factor authentication on your account

- Log out of the platform when not in use, particularly on shared devices

- Notify us immediately at info@mivoiceapp.com if you suspect your account has been compromised

5.5 Data Subject Rights

- Respond promptly to any requests from students, parents or guardians to access, correct or delete student data

- Use the platform's deletion functionality to remove student data when requested or when no longer needed

- Not retain student data beyond the period for which the professional relationship with the student exists

5.6 Institutional Compliance

- Ensure your use of the platform is consistent with your employer's data protection policies, information governance frameworks and any applicable safeguarding obligations

- Obtain any internal approvals required by your institution before using the platform to process student data

6. DATA STORED ON THE PLATFORM

Student data entered into the platform is stored on secure, EU-based infrastructure (Supabase, AWS eu-west-2, Ireland). Row-Level Security ensures that only the professional user who entered the data can access it.

MiVoiceApp Ltd does not share student data with any third party except as strictly necessary to provide the platform's services. During PDF report generation, a student's first name and the professional's report notes are transmitted to our PDF generation sub-processor (CraftMyPDF, via EU-hosted infrastructure in Frankfurt, Germany) solely for the purpose of generating the report.

A full list of sub-processors is available in our Privacy Policy at https://mivoiceapp.com/privacy-policy.

7. RETENTION AND DELETION

Professional users should delete student data from the platform when:

- The student leaves the professional's caseload

- The purpose for which the data was collected has been fulfilled

- Consent is withdrawn by a parent or guardian

- The professional's subscription is cancelled

Student data can be deleted at any time using the platform's built-in deletion functionality. Upon account termination, all data will be permanently deleted within 30 days.

MiVoiceApp Ltd does not retain any independent copy of student data beyond what is held within the professional user's account. When data is deleted by the professional user, it is permanently removed from our systems.

8. DATA BREACHES

If a professional user becomes aware of, or suspects, a personal data breach involving student data on the platform (for example, if their account credentials are compromised) they must:

- Notify MiVoiceApp Ltd immediately at info@mivoiceapp.com

- Notify their employer's Data Protection Officer or information governance team

- Assess whether the breach requires notification to the ICO and/or affected individuals under Articles 33 and 34 of the UK GDPR

As data controllers for student data, professional users bear primary responsibility for breach notification obligations in relation to that data.

9. SAFEGUARDING

Professional users who work with children have safeguarding obligations that exist independently of the UK GDPR. Nothing in this statement or in the platform's Terms of Service diminishes or replaces those obligations. If a professional user becomes aware of information suggesting a child is at risk, they must follow their institution's safeguarding procedures regardless of any data protection considerations.

10. CONTACT AND FURTHER INFORMATION

If you have questions about your data protection obligations in connection with the platform, please contact us at info@mivoiceapp.com.

For general guidance on data protection in educational settings, the following resources may be helpful:

- Information Commissioner's Office: https://ico.org.uk

- ICO guidance on children's data: https://ico.org.uk/for-organisations/guide-to-data-protection/key-dp-themes/children/

- Department for Education data protection guidance: https://www.gov.uk/guidance/data-protection-in-schools

MiVoiceApp Ltd

Companies House No: 15227377

Prime Apartments, 483 Green Lanes, London, N13 4FG

Email: info@mivoiceapp.com

Website: https://mivoiceapp.com

Governed by the laws of England and Wales.

Supervisory authority: Information Commissioner's Office (ICO), https://ico.org.uk