NeuroGeneces Privacy Policy

Version v1.2 - Effective 2026-08-05

Introduction

NeuroGeneces® is committed to protecting your privacy and personal information. This Privacy Policy (this "Policy") explains what information we collect from you, how that information is used, stored, and protected, when that information may be disclosed, and the decisions that you can make about your information. It is important for you to understand the privacy practices we follow for our products and services, including the NeuroGeneces website located at https://neurogeneces.com or any successor website (the "Website"), the NeuroInsight® EEG patch (the "Device"), the NeuroInsight Brain Age Report® (the "Report"), the NeuroGeneces mobile application (the "App"), the NeuroGeneces web application (the "Web App"), and any other related services provided by NeuroGeneces, Inc. (each, a "Service" and collectively, the "Services"). NeuroGeneces, Inc. may be referred to in this Policy as "NeuroGeneces," "we," "us," or "our."

We may update this Policy from time to time. We will notify you of any changes by posting the new Policy in the App and on the Website, and updating the Effective Date above. In some cases we may also notify you via the contact information you have provided to us. Your continued use of the Services after changes indicates acceptance of the updated Policy.

If you have any questions or concerns about this Policy, you can contact us at privacy@neurogeneces.com

Information We Collect

Information You Provide to Us:

  • Customer Account Information: When you create a customer account, we collect your name, date of birth, and email address. Account authentication is performed via one-time password (OTP) sent to your registered email address. You may optionally provide an SMS phone number for OTP authentication as an alternative to email. If you choose to use SMS for OTP authentication, you must explicitly opt-in and consent to receive SMS messages during the account creation process. Standard messaging rates may apply. You may opt out of SMS authentication at any time by updating your account settings.

  • Customer Purchase Information: When you purchase the Services, we, or our third party payment processor, collect your payment information, such as your payment method, credit or debit card information, billing, shipping, and contact details, the product purchased, the date and time of the order, the price of the order, whether payment was made, and purchase history (e.g, whether you are re-ordering the Services).

  • User Medical, Health and Wellness Information: When you and/or your authorized health care provider complete our intake questionnaire, we collect:

    • Your sex assigned at birth.

    • Medical screening information including disease history.

    • Diet and exercise information.

    • Other health and lifestyle related responses you provide.

    In certain circumstances, this information may be considered "protected health information" under state laws and federal laws such as HIPAA and HITECH. It may also be considered "sensitive data" or "personal data" under state laws.

  • Health Care Provider Account Information: If you are a health care provider, when you create a provider account we collect information about you, your medical practice and any staff members or other care providers you choose to add to the account. This information includes: provider or staff names, email addresses, and NPI1 numbers; practice name, address, contact information, and NPI2 number; and concierge networks membership, if applicable.

  • Communications: If you are a customer or a health care provider who contacts us for support, we may record, log or monitor your communications to address your concerns, and for quality assurance and training purposes. Support ticket submissions may include images you choose to attach. If you agree to receive marketing, informational, or educational information from us, we will retain your contact information and preferences.

Information Collected Automatically:

  • Device Information: the Device type, operating system version, and unique Device identifiers.

  • App and Web App Data: Features used, actions taken, and time spent in the App.

  • Sensor Data: Physiological data obtained by the sensors in the Device, including brain activity (using electroencephalogram or EEG), and accelerometer measurement of movement, head position, and breathing patterns. This information may be considered "sensitive data" or "neural data" under state laws and federal laws such as HIPAA and HITECH.

  • Personal Device Data: The Internet Protocol (IP) address of the iPhone or other personal mobile device you use to access the Services, the date and time when you sync your personal device with our servers, and how long you use your personal device to access the Services.

  • Crash Reports: Information about app crashes and errors to improve stability.

  • Website Data: Information about how you use the Website, including the content you view or engage with, the features you use, the timing, frequency, and duration of your activity, the personal device you use to access the Website.

  • Cookies and Tracking Technologies. When you use the Services, we collect certain information automatically, such as through cookies (text files sent to and stored on your personal devices when you access our website), server log files, web beacons, your personal device ID (if you use our App) and programming code that collects information about your interaction with the Services. You can set your web browser or personal device settings to notify you when you receive a cookie or to decline certain tracking technologies. To learn more about cookies, visit www.aboutcookies.org. Although some web browsers include a Do Not Track feature, because these features are not available on all browsers and the signals are not uniform, we do not respond to Do Not Track signals.

Information We Do NOT Collect

  • We do not collect location data.

  • We do not access your contacts, camera, or photos, except for images that you provide with support ticket submission.

  • We do not collect profile photos or images.

App Permissions

Our App only requests permissions that are necessary for its functionality. Network access is required to sync your data with our servers and provide app functionality. We will always request your explicit consent before accessing any personal device features and clearly explain why we need each permission.

How We Use Your Information

We use the information we collect to provide, maintain, and enhance the Services, including:

  • Creating and managing customer and provider accounts.

  • Generating the NeuroInsight Brain Age Report.

  • Providing personalized analysis of health and lifestyle insights that may be impacting Brain Age and targeted recommendations to enhance brain health.

  • Tracking trends over time with repeated testing.

  • Generating and managing the provider portal, including patient ordering, assessment and completion updates.

  • Responding to customer and provider comments, questions, and customer service requests, and enhancing the customer and provider experience.

  • Sending technical notices and support messages.

  • Conducting scientific research.

  • Performing inventory management and other typical business purposes.

  • Detecting, investigating and preventing fraudulent or illegal activities.

  • Complying with legal obligations.

Information Sharing and Disclosure

We use and disclose your information only as described in this Policy and as permitted by law.

No Sale, Targeted Advertising, or Profiling

  • We do not sell or rent your information to third parties.

  • We do not process or share your information for targeted advertising.

  • We will not process or otherwise make your information available for profiling for any decision that results in the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, healthcare services, or access to essential goods or services.

Information Shared with or Disclosed to Others

We do not share your personal information with third parties, except in the following circumstances:

  • Trusted Third Party Partners. We may contract with certain third party partners to perform the following functions related to the Services, enabling us to provide the Services to you:

    • Cloud hosting and data storage (Amazon Web Services HIPAA-compliant accounts "AWS").

    • Website hosting (AWS).

    • Order and payment processing (Shopify).

    • Shipping and related logistics (USPS, UPS, FedEx or similar package delivery services).

    • Customer relationship management, including marketing, sales tracking and communications (HubSpot).

    • Customer support (ZenDesk).

    • Financial, accounting, insurance, legal, and other professional services.

    These third parties will be given only the information they need to perform their designated functions. Any third party with which we share personal information must agree to safeguard it in substantially the same manner as described in this Policy and in accordance with all applicable laws. If you have questions about which categories of personal information may be shared with each type of third party listed above, please contact us at privacy@neurogeneces.com.

  • Legal Requirements: We may disclose information if required by law or in response to valid legal requests.

  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new owner.

  • With Your Consent: We may share information with your explicit consent.

De-Identified Data

We may remove personal identifiers from your data, or generate aggregated data, so that your identity is not linked to and cannot be determined from the data. We may use or disclose this de-identified and/or aggregated data for any purpose and to any party in our sole discretion, including without limitation to improve our Services, train our proprietary AI/Machine Learning models, or to conduct research programs. Your acceptance of this Policy includes consent to use and disclosure of your de-identified data.

Expanded Purpose

We will not process your information for a material new purpose that is neither reasonably necessary to or compatible with providing the Services or other purposes disclosed in this Policy unless we obtain your consent.

Data Minimization

We limit collection of your information to what is adequate, relevant, and reasonably necessary for providing, maintaining, and enhancing the Services.

Information Retention and Ownership

We retain your personal information:

  • For as long as your account is active.

  • As needed to provide you the Services.

  • As necessary to comply with legal obligations.

  • As necessary to resolve disputes and enforce agreements.

When we no longer have a legitimate business need to retain your personal information or if you withdraw your consent, we will either delete your personal information or render it impossible to use to identify you. If we cannot delete or de-identify your personal information, then we will archive and protect it from any further use until deletion or de-identification is possible.

Please note that all de-identified physiological data recorded using the Device will remain the property of NeuroGeneces. In addition, should you provide input and feedback regarding the Services, your experience, or NeuroGeneces, that input and feedback will become our property and you assign to us all rights in the same. We may use that information for our business or other purposes (including continuing to improve the Services) without providing any compensation or other consideration.

Information Security

We implement appropriate physical, technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. We periodically conduct and document data protection assessments and update our privacy practices. Your health and lifestyle information is stored securely using industry-standard encryption. However, no method of transmission over the Internet or electronic storage is 100% secure and we cannot guarantee that a security breach will not occur. It is important that you also use appropriate security measures to protect your personal information when using the Services.

Children's Privacy

Our Services are not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@neurogeneces.com

International Data

The information we collect is stored and processed solely in the United States. At this time, NeuroInsight is not available for purchase by EU or EEA consumers or other individuals outside the United States.

Your Rights and Choices

In addition to understanding what information we collect, how we use it and under what circumstances we share that information, as described in this Policy, you have the right to:

  • Review, update, and/or correct inaccuracies in your personal information that we maintain in the App or the Web App.

  • Access personal data that we have collected about you, including inferences about you derived from the data, which we provide within 45 days.

  • Obtain a copy of your personal data in a portable and readily usable format that allows you to transfer the data with ease.

  • Withdraw consent for data processing at any time, and/or request deletion of your data, although this may affect your ability to use the Services.

Exercising your privacy rights under this Policy will not result in discriminatory treatment with respect to your use of or access to the Services. To exercise these rights, please contact us at privacy@neurogeneces.com

Account and Data Deletion

To delete your account and all associated information (other than de-identified data), contact us at support@neurogeneces.com with your account deletion request. We will verify your identity and process your request within 45 days. Once deleted, your data cannot be recovered. Please note that your information may not be deleted if, and for as long as, it is:

  • Needed to complete the transaction for which it was collected or to provide the Services requested by you.

  • Used in the context of our business relationship with you.

  • Required to perform a contract.

  • Used to detect security incidents and protect against malicious, fraudulent or illegal activity.

  • Required to comply with a legal obligation or applicable laws.

Requesting account or data deletion before completing your recordings and receiving your Report will void the Services. You will still be required to return the Device and may forfeit any applicable refund.

State Privacy Law Compliance

Several states have enacted privacy laws that include special protections for neural data, such as the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Montana Genetic Information Privacy Act. These laws specify the type of information that must be provided to you about your data, and the rights that you possess with respect to your data. Although these laws only apply to residents of the specific state, and some may not yet apply to NeuroGeneces, this Policy is intended to give all of our customers the enhanced privacy protections described in those laws. If you are a resident of California, Colorado, Connecticut or Montana and wish to exercise any rights you may have under the applicable state law, please contact us at privacy@neurogeneces.com

Contact Us

If you have questions or concerns about this Policy or our privacy practices, please contact us at:

NeuroGeneces, Inc.
Email: privacy@neurogeneces.com
Address: 1012 Marquez Place, Suite 207A, Santa Fe, NM 87505 USA