MYNA VOICE LABS

PRIVACY POLICY

Version 1.1 — Effective Date: August 10, 2026

1. Introduction

This Privacy Policy describes how Myna Voice Labs ("we," "our," or "us") collects, uses, stores, and protects your personal information and health data when you use the MynaPD application and related services (collectively, the "Service"). MynaPD is a software application that records voice samples using a smartphone microphone and computes a defined set of deterministic acoustic voice features from those recordings. The computed feature values, and a graphical display of those values, are presented to clinicians experienced in the evaluation of movement disorders for review alongside other clinical information. The Service does not analyze or interpret the measurements, and does not detect, diagnose, screen for, monitor, or assess Parkinson’s disease or any other disease or condition. The Service returns no output derived from the computed feature values to the individual who made the recordings.

We are committed to protecting your privacy and handling your data in accordance with applicable laws, including the U.S. Health Insurance Portability and Accountability Act (HIPAA) and the European Union General Data Protection Regulation (GDPR), and in accordance with the quality management and medical device software standards described in our Terms of Use.

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

2. Data Controller Information

For the purposes of GDPR and other applicable data protection laws, Myna Voice Labs is the data controller responsible for your personal data.

Contact: privacy@mynapd.com

3. Information We Collect

3.1 Information You Provide Directly

Account information: name, email address, date of birth, phone number
Authentication data: credentials for email/password, Google Sign-In, or Apple Sign-In
Medication information: your medication state at the start of each recording session, recorded against a controlled vocabulary of timing intervals (for example, the time since your last dose). Medication state is recorded as a condition under which your recordings were made and is carried with the values computed from that session
Questionnaire responses related to your health, symptoms, and medications, where a questionnaire is presented as part of a session
Support requests and communications you submit through the Service. Where a support request attaches technical log data, the content to be transmitted is shown to you before submission, and nothing is sent without your action after it is shown
Consent records: each consent interaction is recorded with the exact version of the text you were shown, the outcome, the timestamp, the locale, and the means of acknowledgement

3.2 Voice and Audio Data

Voice recordings captured during structured, prompted recording sessions (linear PCM, 16-bit, mono, uncompressed; no lossy codec is applied at any point before analysis)
All takes of a recorded item: where an item is recorded more than once, every take is retained as a record in its own right, and exactly one is marked as the measured take
Recording metadata: capture date and time, task and prompt identity and version, the type of device used for capture, capture sample rate, recording language, audio-quality gate outcome, algorithm and software version, and the version of the controlled measure list (the Acoustic Measure Annex) in effect

3.3 Information Collected Automatically

Device information: device type, operating system version, app version
Usage and audit events: an append-only audit record of consent events, session interactions, and data access. Audit events carry a client-generated identifier so that a re-submitted event is never recorded twice, and are queued durably on your device when they cannot be submitted immediately
Request correlation identifiers, propagated across every component that handles a request, so that the handling of a recording can be reconstructed for traceability
Error-reporting and technical log data, constructed from a declared allowlist of fields. These records carry the least identifying form of any identifier that serves their purpose, and no error-reporting or technical log record carries your voice audio, speech content, questionnaire answers, medication names, computed feature values, authentication tokens, or signed URLs

3.4 Derived Data

Computed acoustic feature values: the values of a fixed, pre-specified set of deterministic acoustic voice features (for example, measures of pitch stability, amplitude stability, and harmonic-to-noise characteristics) computed from your recordings. Each value is computed by a fixed, published signal-processing algorithm; the same recording yields the same values on every execution
Not-computable outcomes: where a feature value could not be computed from a recording, the outcome and its reason are recorded as a result in their own right

The Service contains no machine learning and produces no value derived from a trained model. No feature value is compared against a reference range, and no percentile, z-score, index, or population comparison of any kind is generated.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 Service Delivery

To compute the defined set of deterministic acoustic voice features from your recordings, together with the conditions under which the recordings were made
To generate, on demand, the measurement report presented to the clinicians authorised for you. Reports are generated when requested and are not stored; the underlying values and metadata are what is retained
To conduct audio-quality checks at capture time, so that a recording that cannot support reliable computation is identified and can be re-recorded

4.2 Account and Service Management

To create and manage your account, verify your identity, and enforce access controls
To communicate with you about the Service, including updates and changes to this Privacy Policy
To maintain the append-only audit trail of consent and session interactions required by applicable regulations

4.3 Safety and Compliance

To comply with HIPAA, GDPR, applicable medical device regulations, and our quality management system obligations
To identify, prevent, and address security incidents, fraud, and technical issues, including through security event logging
To maintain the traceability of every reported value to the recording it was computed from

4.4 Research (Separate, Optional Consent)

Any research use of your recordings is consented to separately from your consent to use the Service. Declining research participation does not prevent the Service from operating and does not alter any value it reports. Research data flows are separated from the Service’s data path and produce no value that reaches a clinician through the Service.

5. Legal Basis for Processing (GDPR)

For individuals located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

Legal Basis	Purpose
Explicit Consent (Art. 9(2)(a))	Processing of health data (voice recordings, medication information, questionnaire responses) for the delivery of the Service, and — under a separate, declinable consent — for research
Contract Performance (Art. 6(1)(b))	Providing the Service, managing your account, computing and delivering the measurement report to your authorised clinicians
Legitimate Interest (Art. 6(1)(f))	Service security, fraud prevention, and product improvement using data reduced to the least identifying form that serves the purpose
Legal Obligation (Art. 6(1)(c))	Compliance with medical device regulations, HIPAA, record retention obligations, and applicable data protection laws

6. Data Storage and Security

We implement technical and organisational measures designed to protect your data:

6.1 Encryption

Recordings, recording metadata, computed feature values, reports, and consent records are encrypted in transit and at rest throughout their retention period, including in any export or backup
All data is encrypted in transit using TLS
Authentication tokens and credentials held on your device are stored in the platform’s protected keystore (iOS Keychain or Android Keystore), are unreadable by other applications, and are unavailable while the device is locked. No credential is written to application preferences, caches, or logs

6.2 Access Controls

Authorisation is per patient, not per role: a clinician can retrieve only the records of participants explicitly assigned to them, and role membership alone grants access to no one’s data. This restriction is enforced at the server, not in the presenting client
Recordings, metadata, and reports are accessible only to the participant they concern, the clinicians authorised for that participant, and the service roles required to operate the Service
Database and object-storage rules restrict every record to the subject it belongs to and to principals holding a stored relationship with that subject; no rule grants access on the basis of being authenticated alone
Audio files are accessible only via time-limited signed URLs generated by the backend; no signed URL is ever written to a log
Account provisioning is controlled and auditable, and deactivating an account withdraws its access
The Service declares a minimum supported client version and refuses service to app versions below it, so that a version with a known security weakness cannot continue submitting recordings

6.3 Audit and Traceability

Append-only audit trail of all consent events, session interactions, and data access
Identifiers in audit and error-reporting records are reduced, before the record is written, to the least identifying form that serves the record’s purpose
Request correlation identifiers across all API calls for complete traceability
No log written by any component contains an authentication token, a signed URL, speech content, or a computed feature value

6.4 Infrastructure

All data is hosted on Google Cloud Platform (GCP) and Firebase infrastructure, which maintain SOC 2, ISO 27001, HIPAA, and FedRAMP certifications. Our primary data regions are in the United States (us-central1, us-east1).

7. Data Sharing and Disclosure

We do not sell your personal data. We may share your information in the following circumstances:

Healthcare providers: The clinicians authorised for you within the platform — including the clinician experienced in the evaluation of movement disorders who interprets your measurements, and any provider who referred you for evaluation and reviews the measurements as part of the referral process — may access your measurement report, recording metadata, medication information, and questionnaire responses. Every such access is subject to the per-patient authorisation described in Section 6.2
Service providers: Google Cloud Platform and Firebase (infrastructure, authentication, and storage), Apple and Google (sign-in providers), and providers of error-reporting and support ticketing services. These providers are bound by data processing agreements, and what reaches an error-reporting or support system is constrained to a declared allowlist of fields as described in Section 3.3
Research collaborators: Data may be shared with research partners only where you have given the separate research consent described in Section 4.4, subject to appropriate data sharing agreements and ethics review
Legal requirements: We may disclose your data if required by law, regulation, legal process, or enforceable governmental request

A note on exported reports: a measurement report that a clinician exports or prints leaves the Service’s control, and its subsequent handling is the responsibility of the recipient and their organisation.

8. International Data Transfers

Your data may be transferred to and processed in the United States and other countries where Google Cloud Platform maintains infrastructure. For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary technical measures (encryption, identifier reduction) to ensure an adequate level of data protection.

9. Data Retention

We declare a retention period, and the basis for it, for each class of record the Service creates: recordings, superseded takes, recording metadata, computed feature values, not-computable outcomes, consent events, and audit events. The following principles apply:

Recordings — including superseded takes — and the metadata and feature values derived from them are retained together for the same period, for at least the period required by applicable medical records law and by our quality system obligations. Metadata is never removed while the values it qualifies remain, and each reported value remains resolvable to the recording it was computed from for the full retention period
Consent events are retained for at least six years from the later of their creation or last effective date, and never for less time than the records the consent authorises
Audit events are retained for at least six years from creation
Reports are not a stored record class: a report is generated on demand from the retained values and metadata
A deletion you request is logical: the record is marked deleted with a timestamp and the identity of the requester, is excluded from ordinary use, and is retained until its retention period elapses. Physical purging is a separate, authorised, logged operation that removes every artefact of a record together, leaving nothing orphaned
No ordinary participant or clinician action shortens a retention period, and any record subject to a legal hold or an open investigation is retained until released

10. Your Rights

10.1 Rights Under GDPR (EEA/UK Residents)

If you are located in the EEA or UK, you have the following rights under GDPR:

Right of access (Art. 15): Request a copy of your personal data
Right to rectification (Art. 16): Request correction of inaccurate data
Right to erasure (Art. 17): Request deletion of your personal data, subject to the legal and quality-system retention requirements described in Section 9
Right to restriction (Art. 18): Request limitation of processing in certain circumstances
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interests
Right to withdraw consent (Art. 7(3)): Withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal

10.2 Rights Under U.S. Privacy Laws

Depending on your state of residence, you may have additional rights under state privacy laws (such as the California Consumer Privacy Act or similar state legislation), including the right to know what data we collect, the right to request deletion, and the right to opt out of certain data sharing practices.

10.3 HIPAA Rights

To the extent that the Service processes your Protected Health Information (PHI) as defined by HIPAA, you have rights under HIPAA to access, amend, and receive an accounting of disclosures of your PHI. Requests should be directed to privacy@mynapd.com.

10.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@mynapd.com. We will respond within 30 days (or the applicable statutory period). We may need to verify your identity before processing your request. Please note that the application itself presents no computed feature value to the individual who made the recordings; requests concerning your data, including your recordings and the values computed from them, are handled through the contact above.

11. Consent

Before using the Service, you will be presented with a multi-step consent flow that includes:

A disclosure describing what the Service is and what it does not do
Terms of Use agreement
This Privacy Policy for your review
Where research participation is offered, a separate, declinable research consent

Each step must be acknowledged and accepted. Each consent interaction is recorded append-only with the exact text you were shown, the labeling version it was generated from, the outcome, the timestamp, and the means of acknowledgement, and that text remains retrievable for the lifetime of the record. A material change to the intended use, to the description of what the Service does, or to the set of features it reports will require your consent to be taken again before your next session. You may withdraw your consent and discontinue use at any time by contacting us.

12. Age Restriction and Children's Privacy

The Service is not for anyone under 21 years of age, and is not directed at children. We do not knowingly collect personal information from anyone under 21. If we become aware that we have collected data from an individual under 21, we will take steps to address it promptly, including deletion where required. If you believe such an individual has provided us with personal data, please contact us at privacy@mynapd.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of material changes by posting the updated policy within the app and, where required, requesting your renewed consent before your next session. The "Effective Date" at the top of this policy indicates when the latest version took effect. Continued use of the Service after an update constitutes acceptance of the revised policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Myna Voice Labs
Email: privacy@mynapd.com
Website: https://mynapd.com