Privacy Policy
Sist oppdatert: 27 September 2026
1. Who is the data controller?
DialogSkills AS, company reg. no. 937 545 401, is the data controller for the personal data processed in MI-lab.
Contact: stian@arbeidspsykolog.no · Parkveien 4 B, 5007 Bergen, Norway.
2. What MI-lab is
MI-lab is a training tool for professionals learning Motivational Interviewing (MI). You practise by talking to an AI-generated, fictional client. The conversation partner is not a real person, and the conversations do not concern real patients.
MI-lab also has an MI recorder, where you can record and get an analysis of a role-play. It must never be used on real client or patient conversations — this is stated in the terms of use, and the app requires you to confirm it before a recording can start. We therefore do not process health data about patients.
3. What data we process
When you get an account:
- Your email address (used for one-time-code sign-in)
- Time of creation and last sign-in
When you use the training part:
- The content of your training conversations with the fictional clients
- Which exercises and cases you have completed, and your progress
- The feedback and assessments the system gives you on your MI practice
- Time and duration of the sessions
If you use voice exercises:
- Audio from your microphone, converted to text on the fly. This applies only to your own voice in role-play with the fictional client — we do not record real conversations or real patients.
- The audio goes directly from your browser to the speech-to-text service and never touches our servers. We never store audio.
Technical: usage statistics (number of sessions, which features are used) and error messages, so we can fix problems.
On the front page and the course-provider page we measure visits with Google Analytics (Google Ireland Ltd.), which sets cookies there. Once you are logged in, no cookies are used for tracking or marketing.
4. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Give you access and let you train | Contract (Art. 6(1)(b)) |
| Show you your own progress and feedback | Contract (Art. 6(1)(b)) |
| Operation, security and error correction | Legitimate interest (Art. 6(1)(f)) |
| Improve content and exercises (aggregated/anonymised) | Legitimate interest (Art. 6(1)(f)) |
| Respond to access requests | Contract/pre-contract (Art. 6(1)(b)) |
5. Important note on the AI providers
To deliver the service we send the conversation content to external AI services that generate the client's replies and your feedback.
We have data processing agreements ensuring that your content is not used to train the providers' AI models, that the providers process the data only on our instructions, and that everyone with access is bound by confidentiality.
6. Who we share with
We never sell personal data. We use these data processors:
| Provider | Task | Country |
|---|---|---|
| Hetzner Online GmbH | Servers and storage | Germany (EU) |
| OpenAI | Language model | USA |
| Google Cloud | Language model | EU (Belgium) |
| Soniox Inc. | Speech to text | EU |
| Resend | Sending email | USA |
| Stripe Payments Europe, Ltd. | Payment | Ireland (EU) |
| Google Ireland Ltd. | Visit statistics on the front page (Google Analytics) | USA |
Transfer outside the EU/EEA: for providers in the USA the transfer is safeguarded by the EU Standard Contractual Clauses (SCC) and, where applicable, the EU–US Data Privacy Framework.
A data processing agreement is in place with the providers above. For OpenAI the contracting party is OpenAI Ireland Ltd. ⚠️ Note that where a company is registered is not the same as where the data is processed — the country column above shows where processing actually takes place.
7. How long we store it
- Training conversations, analyses and progress: 12 months after your last activity in the lab — as long as you keep using the lab, everything is kept
- Dormant account: if your access expires, your data is kept untouched for 12 months so you can come back and continue where you left off. After that your personal data is deleted
- If you have access through an employer or educational institution: if you leave, or the agreement ends, your data is deleted after 90 days
- If you ask for deletion yourself: we handle the request within 30 days
- Audio: never stored
- Error log: 90 days
You can ask to have your conversations deleted at any time by contacting us.
What is not deleted: when your account is deleted, your training conversations, analyses, your own cases and your progress are removed. Certain operational and security logs are kept — usage statistics, error messages and an audit trail of who did what in the system. They do not contain the content of your conversations, but they may contain your user number. We keep them because an audit trail must not be deletable.
8. Who can see your conversations
Your training conversations are yours. No other users can open them.
If you take part through an employer or a course, the administrator in your organisation can see how far you have progressed — that is, how many modules you have completed, and how much the service has been used. The administrator cannot read the content of your conversations, your analyses, or the cases you create.
We at DialogSkills AS have technical access to the data for operation and error correction. Such access is limited to what is necessary.
9. Security
Data is stored on servers in Falkenstein, Germany (EU). All transfer is encrypted. You sign in with a one-time code by email, or with a username and password — passwords are always stored encrypted (hashed), never in clear text.
10. Your rights
You have the right to access, rectification, erasure, restriction, data portability, and to object to the processing. Contact us at stian@arbeidspsykolog.no and we will reply within 30 days.
If you believe we process your data in breach of the rules, you may complain to the Norwegian Data Protection Authority (Datatilsynet) or to your local supervisory authority.
11. Changes
We update this policy when things change. Material changes are notified by email.