Privacy Policy

1. Who we are

CHM Solutions Pty Ltd ("we", "us", "our") develops and publishes the StroopTest iOS application. For privacy enquiries, visit our Contact Us page.

2. Who this policy applies to

This policy applies to healthcare professionals and clinical researchers ("practitioners") who use the StroopTest app to administer and score a Stroop colour-word interference test. The practitioner operates the device; the participant is the person being tested and the subject of the data described below. The app is not intended for unsupervised use by participants. Practitioners are responsible for ensuring their own use of the app complies with all applicable laws and professional obligations in their jurisdiction, including any participant consent requirements.

3. What data the app processes

3.1 Audio (Verbal mode only)

While a Verbal test is running, the app records short audio clips of the participant speaking each response using the device microphone. Recordings are used for two purposes: on-device automatic speech recognition to score the response, and optional playback during practitioner review, so the practitioner can listen back and confirm or override the automatic score.

• Speech recognition runs entirely on-device, using Apple's on-device Speech framework in on-device-only mode.
• Audio is never uploaded — no recording or transcript is sent to us, to Apple, or to any third party.
• Audio clips are saved temporarily to the device's local storage only for as long as needed for review and are excluded from iCloud/iTunes backup.

3.2 Test responses and timing

For both Verbal and Visual modes, the app records which colour was shown, which response was given or detected, whether it was correct, and reaction time in milliseconds. A practitioner can attach an optional response flag to a trial (Hesitation, Freeze, Self-correction, Premature response, or Omission) and can manually override the automatic classification. This data is used only to compute the on-screen results — accuracy, reaction-time statistics, and the Stroop interference effect.

3.3 Session recovery data

If the app is interrupted — backgrounded or closed — before the practitioner finishes reviewing a test, an in-progress session snapshot is kept in local device storage so it can be recovered and resumed. This snapshot is deleted automatically once the test is discarded, once a new test is started, or automatically after 24 hours if left unattended.

3.4 Data we do not collect

The app does not collect, transmit, or store:

• Participant names, identifiers, or demographic information
• Audio, transcripts, or test results, beyond the active session and its local review window
• Contacts, location, camera, photos, or any device data unrelated to the test itself
• Any usage analytics — the app has no analytics, advertising, or third-party tracking SDK

4. Permissions requested

• Microphone — required for Verbal-mode response recording. Usage description shown to the user: "This app uses the microphone to detect and temporarily record spoken colour responses during verbal Stroop tests."
• Speech Recognition — required for on-device automatic scoring of spoken responses. Usage description shown to the user: "On-device speech recognition is used to automatically classify spoken colour responses during verbal Stroop tests. No audio leaves this device."

Both permissions can be declined; declining them means only Visual-mode testing is available.

5. Clinical and regulatory context

5.1 HIPAA (United States)

The StroopTest app does not receive, create, maintain, or transmit electronic protected health information (ePHI) on behalf of any covered entity or business associate. Recording, speech recognition, and scoring all happen locally on the practitioner's device, and nothing is sent to CHM Solutions Pty Ltd. Because the app never transmits or stores participant data off-device, no Business Associate Agreement with CHM Solutions Pty Ltd is required for use of the app. Practitioners remain responsible for how they record and store results outside the app, under their own HIPAA obligations.

5.2 Australian Privacy Act 1988

CHM Solutions Pty Ltd is an Australian company and operates in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Audio and test data are personal (and, briefly, health-related) information, but they are captured, processed, and stored entirely on the practitioner's device and are never collected or received by CHM Solutions Pty Ltd — so most APPs are not engaged in ordinary use of the app by us. The practitioner remains responsible, as the party holding the data locally, for handling it in line with their own APP obligations. Any personal information you provide to us directly (e.g. via support requests) will be handled in accordance with the APPs and used only to respond to your enquiry.

5.3 GDPR (European Economic Area and United Kingdom)

If you are located in the EEA or UK, the following applies:

• Controller: CHM Solutions Pty Ltd acts as data controller only in respect of any personal data you send to us directly (e.g. support messages). We do not act as controller or processor for any audio or test data created within the app — these are never transmitted to us.
• Processors: The app uses no third-party analytics or data processors of any kind.
• Legal basis: Legitimate interests or contract performance for support communications only.
• Your rights: You have the right to access, rectify, erase, restrict, or port any personal data we hold about you, and to object to processing. Visit our Contact Us page to make a request.
• Health data: Audio and test results may briefly constitute special category (health-related) data while they exist on the practitioner's device. Because this data is never transmitted to or held by CHM Solutions Pty Ltd, we do not process it as controller or processor under GDPR. The practitioner, as the party capturing and locally holding the data, is responsible for its handling under GDPR from that point on.
• International transfers: No audio or test data leaves the practitioner's device, so no international transfer occurs in respect of that data. Where we receive personal data from EEA contacts directly (e.g. support enquiries), we rely on standard contractual clauses or consent as our transfer mechanism.

6. Data retention and deletion

Audio recordings and session data live only in the app's local, backup-excluded storage on the device. They are deleted when the practitioner starts a new test, when a recovered or interrupted session is explicitly discarded, and automatically after a 24-hour retention window for anything abandoned (for example, after a crash). Because nothing is transmitted off the device, there is no server-side copy to separately delete — uninstalling the app or clearing its local storage removes all data. Any personal data sent to us via support is retained only as long as necessary to resolve the enquiry, and no longer than 3 years.

7. Security

Recording, speech recognition, and scoring all take place entirely on the practitioner's device, and no audio or test data is transmitted over any network at any point. The primary responsibility for securing the device — passcode or biometric lock, timely OS updates, physical security — lies with the practitioner. We recommend practitioners follow their organisation's device management policies.

8. Clinical framing

StroopTest does not provide a diagnosis, an impairment classification, a treatment recommendation, or any percentile or normative comparison. It presents raw scoring and timing data for a qualified practitioner to interpret. Automatic speech-based scoring can be affected by pronunciation, accent, speech impairment, background noise, or microphone placement; a practitioner always has the ability to review and override every automatic score.

9. Children

The StroopTest app is a clinical tool intended for use by trained healthcare professionals. It is not directed at children. We do not knowingly collect personal information from individuals under 18.

10. Future changes

We may in future add optional export of results and audio to a companion platform, for practitioners who opt in. This is not implemented in the current version of the app. If and when it ships, we will update this policy first.

11. Changes to this policy

We may update this policy to reflect changes in the app or applicable law. Material changes will be noted on this page with a revised effective date. We encourage practitioners to review this policy periodically.

12. Contact

For privacy-related questions or to exercise your rights under applicable law, please visit our Contact Us page.