Effective date: October 23, 2026 · Last updated: October 23, 2026
At a glance
- Your recordings stay with you. Your voice recording and optional video never leave your device. VOXA extracts numeric measurements in your browser and sends only those, encrypted, to its analysis engine, which returns your results and does not store them.
- We collect only what we need to run your subscription: your first and last name, country, phone number and e-mail address when you register, and what you write to us through the contact form.
- Payments are handled by Stripe on Stripe's own secure pages. We never see or store your full card number.
- No advertising, no selling or sharing of personal information for cross-context behavioural advertising.
- Website analytics only with your permission. If you click “Accept analytics”, Google Analytics counts visits to this website so we can see which pages help. It is never used for advertising and never runs inside the VOXA application. You can change your choice anytime via “Cookie settings”.
- You have rights to access, correct, delete and export your data, among others. E-mail support@mobilehealthcheck.online.
1. Who we are
This website (mobilehealthcheck.online) and the VOXA service are operated by Nonlinear Platform Development, Montréal, Québec, Canada (“we”, “us”). We are the controller of the personal information described in this policy (the “organization” responsible under Canadian privacy law). Our Privacy Officer — the person in charge of the protection of personal information under Québec's Law 25, a role held by the most senior executive of Nonlinear Platform Development — can be reached at support@mobilehealthcheck.online (subject line “Privacy officer”).
This policy is written to meet the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and applicable U.S. state privacy laws including the California Consumer Privacy Act (CCPA/CPRA).
2. What we collect and why
| Information | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Registration details — first name, last name, country, phone number, e-mail address, a registration ID, the time you registered and your confirmations (Terms, Privacy Policy, 18+ and Medical Disclaimer) | To create and administer your trial and subscription, give you access, contact you about your account, and match your registration to your Stripe subscription. | Performance of a contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) |
| Billing information received from Stripe — name, e-mail, billing country/postal code, subscription status, invoices, card brand and last four digits | To manage billing, trial reminders, renewals and cancellations, and keep accounting records. | Contract; legal obligations (tax and accounting) |
| Contact-form messages — first name, last name, country, e-mail address, topic and message | To answer your question and keep a record of our correspondence. | Legitimate interests (Art. 6(1)(f)); steps prior to a contract |
| Security and anti-spam data — IP address, browser type, time of request, a one-time security challenge, and short-lived hashed rate-limit counters | To protect our forms from abuse, fraud and automated spam. | Legitimate interests (keeping the service secure) |
| Website usage statistics (Google Analytics, only if you accept analytics cookies) — pages viewed on this website, how you arrived (referring site, without its query string), approximate location (country/city, derived from your IP address, which Google Analytics does not store), device and browser type, and a random cookie identifier | To understand how many people visit, which pages are useful, and improve the website. Not used for advertising, profiling or remarketing; Google signals and advertising features are switched off. | Consent (Art. 6(1)(a)), and consent for cookies under the ePrivacy rules |
| Server logs kept by our hosting provider — IP address, requested page, date/time, referrer and browser | To operate, secure and troubleshoot the website. | Legitimate interests |
We do not ask for, and you should not send us, health information through our forms. We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles.
3. Voice, video and analysis data in the VOXA app
VOXA is designed so that your most sensitive material — your actual recordings — never leaves your device.
- Recordings stay on your device. Your voice recording and any optional face video are opened and processed inside your browser. The audio and video files themselves are never uploaded to us or anyone else.
- Only numeric measurements are analysed. Your browser converts the recording into acoustic and facial measurements (for example pitch, timing, spectral and colour-signal values). To compute your results, the app sends these measurements over an encrypted (HTTPS) connection to VOXA's analysis engine, which runs on Cloudflare's infrastructure. Each request also carries your licence key, so the engine can confirm your subscription, and the name and birth details you choose to enter in the app, which some modules use.
- Not stored. The analysis engine uses the measurements only to compute and return your results; it does not store them, your results or your reports after the response is returned.
- Your results stay with you. Read-outs and reports are kept in your browser's memory, and in its local storage only if you choose to save them. Exports go only where you save or send them. You can clear them at any time.
- AI-written summary (optional). If you ask for a summary, your analysis results and the name and birth details you entered are sent through the analysis engine to the AI model provider that generates the text, which processes it under its API terms. Nothing is sent unless you request a summary.
- Optional online sources. Some exploratory features request random numbers from public randomness services (no personal information is included) or send the latitude and longitude you enter to a public scientific service to retrieve geomagnetic values.
- Helper libraries. The app loads standard open-source libraries (for PDF, spreadsheet and image export) from a public content-delivery network, which receives your IP address as part of any web request.
Legal basis. Measurements derived from your voice and face can reveal information about your health and may be biometric data. We process them only on the basis of your explicit consent (GDPR Art. 9(2)(a); express consent under Canadian and Québec law), which you give when you start an analysis in the app. You can withdraw consent at any time simply by not running further analyses; no measurements are kept by us, so there is nothing further to delete on our side.
4. Cookies and browser storage
This website uses strictly necessary storage, plus Google Analytics cookies only if you click “Accept analytics” in our cookie banner. There are no advertising or social-media cookies. You can change your choice at any time with the Cookie settings link at the bottom of every page; if you withdraw consent we delete the analytics cookies from your browser. Analytics never runs inside the VOXA application.
| Name | Type | Purpose | Duration |
|---|---|---|---|
voxa_sid | First-party cookie (HttpOnly, Secure, SameSite=Lax) | Holds the one-time security challenge while you complete the registration or contact form. | Until you close your browser |
voxa_consent_v2 | Local storage | Remembers your cookie choice (analytics accepted or declined), so the banner is not shown on every page. | Until you clear it or change your choice |
_ga, _ga_N0QL4MMN23 | First-party cookies set by Google Analytics — only with your consent | Distinguish visits and sessions with a random identifier so we can count visitors and see which pages are used. | 13 months, or until you decline / clear cookies |
voxa_reg | Session storage | Keeps your registration reference while you are sent to checkout. | Until you close the tab |
qbrs_license_key | Local storage (VOXA app) | Remembers your licence key so you don't have to re-enter it. | Until you clear it or the key is rejected |
| Saved results (optional) | Local storage (VOXA app) | Keeps results or history in your browser only if you choose to save them. | Until you clear them |
When you continue to checkout, you leave this site for Stripe, which sets its own cookies to process payments securely and prevent fraud, as described in Stripe's Privacy Policy. Until you accept analytics, Google Analytics runs in a restricted, cookieless mode (Google Consent Mode): no cookies are set and no identifiers are stored; Google may receive basic signals without identifiers — such as the page viewed and that consent was not given — which it uses only in aggregate. We never enable Google's advertising features and never sell or share personal information for advertising, so Global Privacy Control signals are honoured automatically.
5. Who we share data with
We do not sell personal information and do not share it for cross-context behavioural advertising. We disclose it only to service providers who process it on our behalf under contract, and where the law requires:
- Stripe, Inc. and its affiliates — payment processing, subscriptions and invoicing.
- Our web-hosting and e-mail providers — to host this website, run our form endpoints, store private backup copies of form submissions and deliver e-mail to our support inbox.
- Cloudflare, Inc. — runs VOXA's analysis engine (which processes measurements without storing them) and delivers the app's open-source helper libraries.
- An AI model provider — only if you request an AI-written summary, to generate that text.
- Google LLC / Google Ireland Ltd. — Google Analytics, as our processor, only if you accept analytics cookies (see section 4). Google's advertising features and data-sharing for Google's own products are switched off.
- Professional advisers and authorities — accountants, lawyers, or public authorities when required by law, to protect our rights, or to prevent fraud.
- A successor business — if VOXA is sold or reorganised, subject to equivalent protection.
6. International transfers
We are based in Canada, which the European Commission recognises as providing adequate protection for organisations subject to PIPEDA. Stripe, Google (for website analytics, if you accept it) and some infrastructure providers may process data in the United States and other countries. Where personal information of people in the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, it is protected by appropriate safeguards such as the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. Québec residents: before any transfer outside Québec we assess whether the information will receive adequate protection, as Law 25 requires.
7. How long we keep data
| Data | Retention |
|---|---|
| Registration and subscription records | For as long as your subscription is active, then up to 6 years after it ends where required for tax, accounting and legal purposes |
| Registrations that never complete checkout | Deleted within 12 months |
| Contact-form messages and replies | Up to 24 months after the conversation ends |
| Anti-spam rate-limit counters (keyed by a salted hash, never the raw IP) | Expire after one hour and are purged automatically |
| Security challenges (session) | Single use; expire after 30 minutes or when you close your browser |
| Website analytics data (only if you accept analytics) | Cookies expire after 13 months; Google Analytics event data is deleted automatically after 14 months |
| Voice and video recordings | Never received by us — kept only on your device for as long as you choose |
| Measurements sent for analysis, and the results | Not stored by the analysis engine; results stay in your browser for as long as you choose |
8. Security
The site is served only over HTTPS with strict security headers. Form submissions are validated, rate-limited and protected by a layered anti-spam check (a visual code, a browser proof-of-work task, a hidden honeypot field and timing checks). Backup copies of submissions are kept in a non-public directory. Card data is handled exclusively by Stripe, which is certified to PCI DSS Level 1. No system is perfectly secure; if we become aware of a breach that creates a risk of serious harm, we will notify you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you have some or all of these rights:
- Access — get a copy of the personal information we hold about you.
- Correction — have inaccurate or incomplete information corrected.
- Deletion — ask us to delete your information (subject to legal retention duties).
- Portability — receive your information in a structured, commonly used format.
- Restriction and objection — limit or object to processing based on our legitimate interests.
- Withdraw consent — where we rely on consent, at any time, without affecting earlier processing. For website analytics, use “Cookie settings” at the bottom of any page and choose “Decline”.
- Québec residents — also the right to be informed of, and to request de-indexation of, information, and the rights described in Law 25.
- California and other U.S. state residents — the right to know, delete and correct, and to opt out of the sale or sharing of personal information (we do neither), and freedom from discrimination for exercising your rights.
To exercise any right, e-mail support@mobilehealthcheck.online with the subject “Privacy request”, or use our contact form (topic “Privacy & data request”). We may need to verify your identity, and we respond within 30 days (or one month under the GDPR), free of charge in most cases.
10. Children
VOXA is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has registered, contact us and we will delete the information.
11. Changes to this policy
We may update this policy as our service or the law changes. We will post the new version here with a new effective date and, for material changes, notify registered users by e-mail before they take effect.
12. Contact and complaints
Nonlinear Platform Development (VOXA), Montréal, Québec, Canada · support@mobilehealthcheck.online
If you are not satisfied with our response you may complain to your local authority: in the EU/EEA, your national data protection authority; in the UK, the Information Commissioner's Office (ICO); in Canada, the Office of the Privacy Commissioner of Canada; in Québec, the Commission d'accès à l'information du Québec; in California, the California Privacy Protection Agency.