The clinical companion for neurodiversity-affirming therapists

Yes. PlayFirst is built with strong technical safeguards and operates in line with POPIA (South Africa), GDPR (EU/UK), and the Australian Privacy Act 1988 (APPs). **How we protect your data:** • All data is encrypted in transit (TLS 1.3) and at rest (AES-256) • We never sell or share your data with third parties • Strict role-based access controls — only you access your client data • Audit logging for sensitive actions • Data hosted on reputable cloud infrastructure with industry-standard physical and network security **Your privacy rights and controls:** • Export all of your data at any time (JSON download) • Permanently delete your account and all associated data • You decide what is shared with parents — nothing is published without your action • Lawful basis, consent logging, and a documented Privacy Policy are built in **AI & Data Processing:** • AI features process only the minimum information needed for each request (e.g. SOAP content for a parent summary) • AI providers do not train their models on your inputs • AI requests are made over encrypted connections to reputable providers (e.g. OpenAI) **A note for therapists serving US clients (HIPAA):** PlayFirst is HIPAA-aligned at the technical level (encryption, access controls, audit logs, export/delete). However, full HIPAA compliance for US Protected Health Information (PHI) also requires a signed Business Associate Agreement (BAA) with every vendor in the data chain. We are actively working with our infrastructure and AI providers to enable a BAA-covered HIPAA configuration. **If you serve US-based clients with PHI, please contact us before onboarding them** so we can guide you through a HIPAA-compliant setup (e.g. BYO HIPAA-eligible AI key with BAA, such as Azure OpenAI or AWS Bedrock). **Best practices we recommend:** • Use a strong, unique password for your account • Review shared content before publishing to a parent portal • Maintain your practice's own data breach response plan and required regulatory documents (e.g. PAIA Manual under POPIA)

Parent access is fully controlled by you, the therapist. **The consent process:** 1. You decide whether to invite a parent to view their child's portal 2. You generate a unique invite code from the child's profile 3. You share that code with the parent (we recommend documenting this consent in your records) 4. The parent creates their own account using the code **What parents can see:** • Weekly Focus activities and goals you've published • Resources you've explicitly shared • Session notes you've marked "Share with parent" **What parents cannot see:** • Clinical reports (unless you share them) • Detailed assessment scores • Notes not marked for sharing • Other children's information **Best practice:** Include PlayFirst parent portal access in your standard informed consent documentation.

We collect only what's necessary to provide the service. **Data we store:** • Account information (email, name, practice details) • Child profiles (name, age, interests, goals - as entered by you) • Session notes and documentation you create • AI-generated content you choose to save **Data we don't store:** • Payment card details (handled securely by Stripe/Paystack) • Recordings or videos (audio features process locally) • Biometric data **Your control:** • Export your data anytime from Settings • Delete individual children or your entire account • All data is deleted within 30 days of account closure **AI & Privacy:** • AI features use OpenAI's API with data processing agreements • We don't use your data to train AI models • AI requests don't include identifying information beyond what's needed for the specific request

Yes, PlayFirst is designed specifically for pediatric speech therapy practice. **Age considerations:** • Most users work with children ages 2-12 • Parental consent is assumed as part of your standard therapy consent process • We don't collect data directly from children - all data is entered by therapists or parents **COPPA compliance:** • We don't knowingly collect personal information from children under 13 • Child profiles are created and managed by adult therapists • Parent accounts are created by adults using invite codes

You have full control over client data retention. **Options when a client leaves:** • **Archive**: Keep the profile for your records but mark inactive • **Export**: Download all notes and reports before deletion • **Delete**: Permanently remove the child's profile and all associated data **Recommendations:** • Follow your state/country's record retention requirements • Export important documentation to your primary EMR before deletion • Communicate with parents about data handling in your discharge process **Note:** Deleted data is permanently removed from our servers within 30 days and cannot be recovered.