Privacy Policy
Last updated: 5 October 2026
1. Who is the data controller?
DialogSkills AS, company reg. no. 937 545 401, is the data controller for the personal data processed in MI-lab.
Contact: stian@arbeidspsykolog.no · Parkveien 4 B, 5007 Bergen, Norway.
2. What MI-lab is
MI-lab is a training tool for professionals learning Motivational Interviewing (MI). You practise by talking to an AI-generated, fictional client. The conversation partner is not a real person, and the conversations do not concern real patients.
MI-lab also has an MI recorder, where you can record and get an analysis of a role-play. It must never be used on real client or patient conversations — this is stated in the terms of use, and the app requires you to confirm it before a recording can start. We therefore do not process health data about patients.
3. What data we process
When you get an account:
- Your email address (used for one-time-code sign-in)
- Time of creation and last sign-in
When you use the training part:
- The content of your training conversations with the fictional clients
- Which exercises and cases you have completed, and your progress
- The feedback and assessments the system gives you on your MI practice
- Time and duration of the sessions
Reflection exercises about yourself: a few exercises, such as the coach conversations in card 18, ask you to talk about your own experiences and strengths rather than a fictional client. What you write there is stored and processed like your other practice conversations, and no analysis is made of it. Share only what you are comfortable with, and no health information.
If you use voice exercises:
- Audio from your microphone, converted to text on the fly. This applies only to your own voice in role-play with the fictional client — we do not record real conversations or real patients.
- The audio goes directly from your browser to the speech-to-text service and never touches our servers. We never store audio.
Technical: usage statistics (number of sessions, which features are used) and error messages, so we can fix problems.
Cookies: On the front page we ask whether you accept cookies. If you accept, we measure visits with Google Analytics and see which ads (from Google and Meta) brought you here. If you decline, none of these services are loaded, and the app works the same. You can change your mind at any time via the «Cookies» link at the bottom of the page.
If you have consented, we measure whether you signed up or bought, to see which ads work. We never measure what you do in your training.
4. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Give you access and let you train | Contract (Art. 6(1)(b)) |
| Show you your own progress and feedback | Contract (Art. 6(1)(b)) |
| Operation, security and error correction | Legitimate interest (Art. 6(1)(f)) |
| Improve content and exercises (aggregated/anonymised) | Legitimate interest (Art. 6(1)(f)) |
| Respond to access requests | Contract/pre-contract (Art. 6(1)(b)) |
| Measure visits, sign-ups and purchases to see which ads work | Consent (Art. 6(1)(a)) |
5. Important note on the AI providers
To deliver the service we send the conversation content to external AI services that generate the client's replies and your feedback.
We have data processing agreements ensuring that your content is not used to train the providers' AI models, that the providers process the data only on our instructions, and that everyone with access is bound by confidentiality.
6. Who we share with
We never sell personal data. We use these data processors:
| Provider | Task | Country |
|---|---|---|
| Hetzner Online GmbH | Servers and storage | Germany (EU) |
| OpenAI | Language model | USA |
| Google Cloud | Language model | EU (Belgium) |
| Soniox Inc. | Speech to text | EU |
| Resend | Sending email | USA |
| Stripe Payments Europe, Ltd. | Payment | Ireland (EU) |
| Google Ireland Ltd. | Visit and ad measurement (Google Analytics, Google Ads) — only if you have consented | USA |
| Meta Platforms Ireland Ltd. | Ad measurement (Meta pixel) — only if you have consented | USA |
Transfer outside the EU/EEA: for providers in the USA the transfer is safeguarded by the EU Standard Contractual Clauses (SCC) and, where applicable, the EU–US Data Privacy Framework.
A data processing agreement is in place with the providers above, except Google and Meta for ad measurement, who process the data under their own terms. For OpenAI the contracting party is OpenAI Ireland Ltd. ⚠️ Note that where a company is registered is not the same as where the data is processed — the country column above shows where processing actually takes place.
7. How long we store it
- Training conversations, analyses and progress: 12 months after your last activity in the lab — as long as you keep using the lab, everything is kept
- Dormant account: if your access expires, your data is kept untouched for 12 months so you can come back and continue where you left off. After that your personal data is deleted
- If you have access through an employer or educational institution: if you leave, or the agreement ends, your data is deleted after 90 days
- If you ask for deletion yourself: we handle the request within 30 days
- Audio: never stored
- Error log: 90 days
- Your cookie choice: remembered for 6 months, then we ask again
You can ask to have your conversations deleted at any time by contacting us.
What is not deleted: when your account is deleted, your training conversations, analyses, your own cases and your progress are removed. Certain operational and security logs are kept — usage statistics, error messages and an audit trail of who did what in the system. They do not contain the content of your conversations, but they may contain your user number. We keep them because an audit trail must not be deletable.
8. Who can see your conversations
Your training conversations are yours. No other users can open them.
If you take part through an employer or a course, the administrator in your organisation can see how far you have progressed — that is, how many modules you have completed, and how much the service has been used. The administrator cannot read the content of your conversations, your analyses, or the cases you create.
We at DialogSkills AS have technical access to the data for operation and error correction. Such access is limited to what is necessary.
9. Security
Data is stored on servers in Falkenstein, Germany (EU). All transfer is encrypted. You sign in with a one-time code by email, or with a username and password — passwords are always stored encrypted (hashed), never in clear text.
10. Your rights
You have the right to access, rectification, erasure, restriction, data portability, and to object to the processing. Contact us at stian@arbeidspsykolog.no and we will reply within 30 days.
If you believe we process your data in breach of the rules, you may complain to the Norwegian Data Protection Authority (Datatilsynet) or to your local supervisory authority.
11. Changes
We update this policy when things change. Material changes are notified by email.