Privacy

VOICE STUDY PRIVACY NOTICE

Last updated: 28 September 2026

H3lix AI Ltd., trading as Helix, is running this study. This notice explains what we collect from you, what we do with it, how long we keep it, and what you can ask us to do about it.

The study is narrow: we record you reading short sets of digits aloud, and we use those recordings to teach a computer to estimate a speaker's age range and sex from the sound of their voice.

If you have any questions before, during or after the study, write to us at privacy@helix.id.

1. What we collect

Your voice recordings. Five short audio clips each time you take part, each about four to eight seconds, in which you read four digits aloud, with different digits in each clip. You can take part up to three times, and we ask that each time you use a different device or microphone. We do not ask you to say your name or anything else about yourself, and we do not record anything before you press record or after you stop. In this notice, "your recording" means every clip you make, across all the times you take part.

Your age and sex, and your Prolific ID. These reach us from Prolific rather than from you. Prolific gives us your answers to its own screening questions along with the ID it assigns you.

A record that you consented, with the date and your Prolific ID.

Technical information from serving the app. Our providers process your IP address while a page loads or a recording uploads, because that is how a request over the internet works. We do not keep it in our own records and we do not use it for anything.

Information about your device and microphone. With each recording we store the browser and operating system you used, the type of device, your screen size, language setting and time zone, the name your device gives the microphone, an identifier your browser assigns to that microphone, and the audio settings it reported. We also store the digits you were asked to read and when you recorded. We use this to check that the models work equally well across devices and microphones. None of it identifies you, and we do not use it for anything else.

We treat your voice recording as biometric information, and the protections in this notice apply to it.

We do not collect your name, email address, postal address or phone number, and we never learn who you are. We can tell your recording apart from everyone else's, because we keep the ID Prolific assigns you alongside it. That ID is how we find your recording if you ask us to delete it, and §4 says how long we hold it.

2. What we use it for

One purpose: training and testing machine-learning models that estimate a speaker's age range from their voice.

Those models support age assurance, which lets an online service check that a user is old enough for age-restricted content without asking them to hand over an ID document. The models are our commercial product. Your recording is not, and we never sell it.

We will not:

try to work out who is speaking, or recognize your voice as yours
build a voiceprint, voice template or speaker gallery from your recording
compare it against any other recording, ours or anyone else's
link it to any other information about you
use it to generate synthetic speech or clone your voice
make any automated decision about you
use it for marketing, advertising or profiling

Anything we publish about this work reports statistics across many speakers. We never publish individual recordings.

3. Our legal basis

Your consent. Nothing here happens unless you agree to it first.

Before any recording begins we show you a consent screen setting out what we are collecting, what we will use it for, how long we will keep it, and how to change your mind. You consent by a separate, deliberate action about the recording itself. Agreeing to Prolific's terms is not consent for this, and neither is clicking past a page. If you do not consent, no recording starts and you can leave the study.

You can withdraw your consent at any time, including after the study is over, and withdrawing is as easy as giving it. Withdrawing means we delete your recording, within 30 days. It does not affect what we did before you withdrew, and it does not affect your Prolific payment for work you have already completed.

4. How long we keep it

Your voice recording: Kept for as long as we are developing and evaluating these models. We review at least every 12 months and delete when we no longer need it
The link between your Prolific ID and your recording: Deleted at the same time as the recording
Your age and sex: Held with the recording, deleted at the same time
Information about your device and microphone: Held with the recording, deleted at the same time
The record that you consented: Held for 24 months after the recording is deleted, so we can show consent existed. Your Prolific ID and a date, nothing else

We hold the link between your Prolific ID and your recording so we can find your recording if you ask us to delete it. Once that link is gone we can no longer tell which recording is yours.

If you ask us to delete your recording, we do it within 30 days, including copies in our backups. We will also remove any voice embedding or templates derived from those voice recordings.

We keep the models. A model that has already been trained stays, and we do not delete it when we delete a recording. What that model holds is what it learned across many thousands of speakers, not your voice. It cannot be used to reconstruct your recording, reproduce your voice, or identify you. We cannot un-train a model either.

5. How we store it and keep it secure

Your recording is stored in a single private Amazon Web Services S3 bucket in the US (Oregon, us-west-2).

Encrypted at rest with AES-256 server-side encryption.
Encrypted in transit, everywhere it travels, including the upload from your browser.
Not publicly reachable. Public access is blocked at both account and bucket level. There is no public link to your recording and no route to it from the internet.
Your Prolific ID is held separately from the audio, so the recording file itself carries no identifier.
Access is restricted to a small number of named machine-learning engineers and our Chief Technology Officer, through named accounts requiring single sign-on and multi-factor authentication. We review that list quarterly and remove access the same day someone leaves.
Every access is logged, giving a per-file audit trail.
Recordings are never downloaded to personal devices.

We apply at least the same standard of care to your recording as we apply to any other confidential information we hold.

No system is perfectly secure and we are not going to claim otherwise. If something happens that affects your recording and puts you at risk, we will tell you through Prolific and notify the authorities we are required to notify.

6. Who else sees it

Nobody outside Helix, other than the providers below, who act only on our instructions and cannot use anything for their own purposes.

Amazon Web Services: What it does: Stores the recordingsWhat it receives: Your recording
AWS Amplify: What it does: Runs the study web appWhat it receives: The recording passes through it on its way to storage
PostHog: What it does: Analytics on how the app is usedWhat it receives: Usage events. Not your recording

We do not sell your recording, we do not license it, and we do not share the dataset with anyone. We will not disclose your recording to anyone else without your consent unless we are required to.

If Helix is acquired, or merges with or sells the business to another company, your recording may pass to the buyer as part of that business. We would tell you through Prolific if it happened, and this notice continues to apply to your recording in the buyer's hands.

Prolific recruits you and handles your payment. We set the reward for this study and pay it from our Prolific researcher account, and once we approve your submission Prolific applies that reward to your account. Anything you give Prolific directly is covered by Prolific's own Participant Privacy Notice, not by this notice.

7. Your rights

You can ask us to:

Delete your recording, and everything we derived from it
Withdraw your consent, which means we delete it
Give you a copy of your recording and the information we hold with it
Correct anything inaccurate
Stop or limit what we do with it
Tell you whether we hold anything about you at all

All of these are free, and we respond within 30 days. If we need longer we will tell you within 30 days, and why.

How to ask. Message us through Prolific, quoting your Prolific ID. We ask you to use Prolific rather than email because it shows the request is yours. Your Prolific ID is the only thing connecting you to your recording, and anyone could type someone else's into an email. For deletion alone you can email privacy@helix.id with your Prolific ID if you prefer.

We will not ask you for your name, your address or any other identifying information, and please do not send it to us.

Your recording is genuinely locatable and deletable. Our company-wide notice says we cannot locate an individual's recordings in the voice corpora we license from other providers, and that is true of those. This study is different, because we collected the recording from you and kept the ID that finds it.

If you are unhappy with how we have handled your recording, tell us at privacy@helix.id. If we refuse a request you can appeal to the same address and we will explain our decision in writing. You can also complain to your state Attorney General, or to the data protection authority where you live.

8. Children

This study is for adults only. Prolific does not allow anyone under 18 to take part in studies, and we do not knowingly collect recordings from anyone under 18. If you are under 18, please do not take part.

9. Changes to this notice

If we want to use your recording for anything beyond what §2 describes, we will contact you through Prolific and ask you again.

We keep every previous version of this notice and will provide an earlier one on request, so you can see what applied when you took part. The date at the top tells you which version you are reading.

10. Helix, and our wider privacy notice

H3lix AI Ltd., trading as Helix, incorporated in Delaware.
1301 N Broadway St, #32355, Los Angeles, CA 90012, United States.
Telephone +1 213 340 6080. Email privacy@helix.id.

Internal responsibility for data protection sits with our Data Protection Responsible Person, currently our Chief Technology Officer. Write to the postal address above marked for their attention, or email privacy@helix.id.

Our company-wide privacy notice covers everything else Helix does with personal information, including the age-assurance product itself, our international arrangements, and our representative for people in the UK and EU: https://helix.id/privacy.

Where this notice and the company-wide notice differ, this notice governs the recording you make in this study.

This study recruits participants in the United States, and your recording is stored in the United States. If you are taking part from outside the United States, the company-wide notice explains our arrangements and how to reach our representative.