Privacy Policy

Swaya is an AI-powered learning and therapy companion for children in special education, built by KORTIQ. The Swaya platform includes the child-facing companion and the dashboards used by parents, doctors, teachers, and administrators.

KORTIQ is responsible for the personal data processed in the Swaya platform (the “data controller”). For any privacy question or request, contact us at kortiq.tech@gmail.com or through the in-dashboard support channel.

To deliver a personalised, safe experience, Swaya collects:

• Child profile information — first name, age, interests, and clinical notes entered by the care team.
• Facial-recognition photos Biometric — a photo used to recognise a child at the start of a session, and photos used to authenticate administrators who sign in with Face ID.
• Voice and video recordings Sensitive — audio and video captured during a session so the companion can respond and so sessions can be reviewed.
• Session & clinical data Health — AI-generated session reports, therapy plans, progress notes, emotional and engagement observations, and mood check-ins.
• Account information — for parents, doctors, teachers, and admins: name, username, role, a securely hashed password, and an optional profile photo.
• Usage & security data — activity and audit logs, sign-in records, and basic technical/telemetry information used to keep the platform running and secure.

• To run guided sessions that adapt in real time to a child’s mood, attention, and pace.
• To recognise a returning child and load the right profile and settings.
• To generate progress and clinical reports for the child’s care team.
• To authenticate administrators securely using Face ID.
• To provide support, keep the platform secure, and meet our legal obligations.

We do not sell personal data, and we do not use children’s data for advertising.

Swaya uses artificial intelligence to power conversations, transcribe speech, synthesise the companion’s voice, recognise faces, and draft session reports.

• Face recognition runs within our own system using on-device/on-server models — a child’s or admin’s face images are matched locally and are not sent to third-party AI providers for recognition.
• Conversation, transcription, and report drafting send the relevant text or audio to trusted AI service providers to generate a response. We share only what is needed for that task.

Where laws such as the GDPR apply, we rely on:

• Explicit consent — from a parent or legal guardian for processing a child’s biometric, voice/video, and health data. This consent can be withdrawn at any time.
• Performance of a contract — to provide the platform to the organisations and families that use it.
• Legitimate interests — to keep the platform secure and functioning, balanced against individual rights.
• Legal obligation — where we must retain or disclose data by law.

Protecting children is the heart of what Swaya does. We only create a child’s profile and process their data when a parent or legal guardian has given verified consent, typically arranged through the child’s school, clinic, or care provider.

• A parent or guardian can review the data held about their child, request changes, or ask for it to be deleted at any time.
• Withdrawing consent stops further processing and, on request, removes the child’s profile, photos, recordings, and reports.
• We collect only what is needed to support the child, and nothing more.

Access is limited by role, so people only see what they need:

• Parents see the data and reports for their own child.
• Doctors and teachers see the children assigned to their care.
• Administrators maintain the platform; admin access itself is protected by Face ID.

We do not share personal data with anyone outside the child’s care team except the service providers below, or where required by law.

We use a small set of trusted providers to run Swaya, each handling data only as needed and under appropriate agreements:

• AI language & speech providers — to generate conversation responses and transcribe speech.
• Voice synthesis — to give the companion its spoken voice.
• Cloud storage & hosting — to securely store reports and run the platform.

We keep personal data only as long as needed for the purposes above or as required by law, and then delete or anonymise it. Session recordings and reports are retained to support ongoing therapy and progress tracking, and are removed when a profile is deleted or consent is withdrawn. Security and audit logs are kept for a limited period.

• Passwords are stored only as salted, hashed values — never in plain text.
• Administrator access is protected by Face ID, and access is restricted by role.
• Data is transmitted over encrypted connections, and actions are recorded in an audit log.

No system is perfectly secure, but we work continuously to protect this data and will notify affected people and the relevant authorities of a breach where the law requires.

Depending on where you live, you (or a child’s parent/guardian) may have the right to:

• Access the personal data we hold, and receive a copy in a portable format.
• Correct inaccurate data or complete incomplete data.
• Delete data and withdraw consent, including a child’s biometric, recording, and clinical data.
• Object to or restrict certain processing.
• Lodge a complaint with your local data-protection authority.

To exercise any of these, email kortiq.tech@gmail.com. We respond within the timeframe required by law.

Some service providers may process data in other countries. Where personal data is transferred across borders, we take steps to ensure it stays protected under applicable law, using providers with recognised safeguards and appropriate contractual protections.

We may update this policy as Swaya and the law evolve. We will revise the “Last updated” date above and, for significant changes affecting children’s data, provide a clearer notice and seek fresh consent where required.

Questions, concerns, or a request about your data or your child’s data? Please reach out — we take this seriously.