Privacy Policy

1. Introduction

Talk2Sofia ("we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explain how we collect, use, store, and process your personal data when you use our website, wellbeing chat, and voice session services.

We process data in accordance with the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018.

2. Personal Data We Collect

To provide our AI wellbeing support service, we collect and process the following categories of personal data:

• Account Details: Full Name, email address, password, and age (verified 21+ at registration).
• Special Category Data (Screening Results): Scores and inputs from GAD-7 anxiety level assessments, PHQ-9 depression level assessments, and custom clinical risk ratings.
• Conversation transcripts: Wellbeing chat message history and voice call interaction records.
• Technical Logs: IP address, device type, operating system, and session identifiers.
• Billing Data: Secure payment transactions processed via Stripe. We do not store raw card numbers.

3. Lawful Basis & Special Category Data

Under UK GDPR, our lawful basis for processing standard personal data is the performance of a contract to provide you with the services you sign up for.

Because our wellbeing assessments and chat transcripts relate to your mental wellbeing, they constitute Special Category (Health) Data. We process this special category data strictly based on your explicit consent (Article 9(2)(a) UK GDPR), which you grant during signup and the onboarding assessments. You can withdraw your consent at any time by closing your account.

4. Data Retention Periods

We retain your personal data and conversation histories only as long as your account is active.

If you request account deletion or data erasure through your Settings panel, we will permanently purge all related screening results, chat transcripts, voice session summaries, credentials, and profile attributes from our active databases and storage systems.

5. Third-Party Processors & Location

We share relevant details with vetted third-party data processors to keep our application running securely:

• Cloud Hosting & DB: AWS and Vercel (data hosted securely in Europe/UK regions).
• AI Inference: Google Gemini API (conversations are sent securely for response generation. Under our agreement, your conversations are confidential and are never used to train Google's models).
• Payments Gateways: Stripe (processes subscription billing securely).

6. Your Rights under UK GDPR

You possess specific legal rights under the UK GDPR regarding your personal data:

• Right to Access: You can request a summary export of all your chat histories and profile settings.
• Right to Deletion (Erasure): You can permanently wipe your account and logs at any time from your settings page.
• Right to Rectification: You can edit your name, profile, and settings inside your account dashboard.
• Right to Portability: You can request a machine-readable copy of your personal data.