What Happens to Your Data in a Learning or Therapy App?

A learning or therapy app may handle more than the information typed into a visible form. Depending on the service and settings, questions can arise about recordings, uploaded documents, account details, usage information and material shared with other people. A useful privacy review follows the actual task and asks where each kind of information goes.

This guide provides questions for families, adult users, schools and service providers. It does not assess a named app’s compliance or determine which privacy law applies to an individual situation. A store listing, recommendation or paid subscription is not enough on its own to answer the questions below.

Map the actual activity

Begin with a plain-language description: “record a reading practice,” “upload a worksheet” or “share a communication page with a support worker.” List the information involved, including details about other people who may appear in recordings, images or documents.

Ask which steps are necessary and which are optional. Could the task be tried with a fictional example or a short non-sensitive sample? Does the app require an account for the desired feature, and is a school-managed account different from a personal one?

A general promise of personalization is not a complete explanation. Ask what information produces the personalization, whether it can be turned off and what changes if the user declines. Record the answer for the actual account and feature rather than assuming every version of the service works identically.

Read more than the store label

Apple’s explanation of App Store privacy information states that developers report the information and that disclosures can cover different uses or versions of an app. The policy may provide more detail about those differences. Treat a label as a useful starting point, not a complete independent audit of the service.

Google Play’s Data safety explanation similarly describes developer disclosures covering app versions, with practices potentially varying by use, region and age. It also explains that its collection and sharing categories have defined exceptions. A short label therefore should not be read as a universal statement that information never leaves the device.

Locate the current privacy policy and identify which organization provides the service. Look for information specific to children, school accounts, clinical use or the particular feature when relevant. If a policy is unclear, ask a focused question rather than filling the gap with an assumption.

Check permissions in context

The Office of the Privacy Commissioner of Canada’s mobile-app guidance advises comparing requested permissions with the policy and the app’s purpose. This longstanding resource, dated 2014, supplies general questions; it is not a current walkthrough of every operating system’s permission controls.

For a reading task, microphone access may have an understandable function if the app records speech. Ask whether recording is optional, when the microphone is active and what happens to the result. The presence of a permission request does not explain storage, reuse or who can listen later.

Review camera, photo, file, location and contact access in the same task-based way. Use the actual device’s available choices and check what remains usable when optional access is declined. Do not disable an essential access method without discussing a workable alternative with the person.

Follow the information beyond capture

These are questions to investigate, not statements that every app performs every listed activity. Record answers as confirmed, unclear or not applicable. An unanswered question should remain visible in the decision rather than being silently treated as reassuring.

Clarify sharing and account roles

Ask who owns or administers the account and who may change permissions. A teacher, clinician, parent, support worker and adult user may have different roles. Clarify which person can invite others, download content or remove access when a relationship changes.

Review the actual sharing controls before adding identifiable information. A link intended for one supporter may have a broader access setting than expected. Use a harmless sample to understand the workflow, and ask the organization to explain managed settings that the user cannot inspect.

Include the person whose information is involved in an accessible conversation about the arrangement. Explain what will be recorded, who is expected to see it and how they can raise a concern. A helper’s convenience should not replace the person’s understanding and appropriate participation.

Separate a recommendation from organizational approval

If a school or service asks someone to use an app, ask which account and features have been approved and who can answer privacy questions. A staff member’s informal recommendation may not describe the organization’s full review or permitted data use.

Ask what alternative is available if the proposed feature requires information the person does not wish to provide or if an access barrier prevents use. The answer may involve a different workflow, another tool or an organizational decision. Do not assume the family or user must solve every concern alone.

For therapy-related records or other sensitive content, clarify the responsible service’s process before uploading. This guide cannot decide whether consent, another authority or a particular contract is sufficient in that setting. Obtain a specific answer from the appropriate privacy contact where needed.

Plan for ending use before it becomes urgent

Ask how to retain useful work in an accessible format and test an export with sample material. A file that downloads successfully may still omit recordings, symbols or structure the person relies on. Check the result in the intended destination.

Distinguish uninstalling an app, cancelling a subscription, closing an account and requesting deletion of stored information. Do not assume one action completes the others. Read the service’s current instructions and ask about records that may remain and the reasons given.

For a school-managed or clinical account, coordinate with the responsible organization before removing material that must be retained or belongs to someone else. Keep a record of the request and response without making unnecessary additional copies of sensitive information.

A practical example

In this fictional example, a family is considering an app that records reading practice. They first test it with a short invented passage and ask whether recordings stay on the device, who can access them and how they can be deleted.

The school clarifies which account arrangement it supports and which sharing feature should be used. One question about retention remains unresolved, so the family keeps using the existing reading routine while the appropriate contact obtains an answer.

The review is focused on the actual activity. It does not depend on assuming that every app is unsafe or that a store label answers every question.

Common questions