Privacy Policy

This Privacy Policy describes how NeuroAtlas ('we', 'our', or 'us') collects, uses, stores, shares, and protects information about you when you use the NeuroAtlas mobile application ('App') and related services. By accessing or using NeuroAtlas, you agree to the practices described in this Policy.

If you are using NeuroAtlas through your organisation's enterprise account, additional terms in your organisation's agreement with us may also apply.

1. Information We Collect

We collect information to deliver personalised cognitive performance experiences and improve our services. The categories of data we collect include:

1.1 Information You Provide Directly

• Account Registration: Name, email address, password, and role/industry (for individual sign-ups).
• Profile & Preferences: Performance goals, focus areas, occupation level, and personalisation settings you configure during onboarding.
• Journal Entries: Text-based reflections, guided journal responses, and emotional check-in inputs you voluntarily submit within the App.
• Invite Code: Beta invite codes entered during the initial access phase.
• Enterprise SSO: Organisational identity credentials passed via your employer's single sign-on system (we receive only what your identity provider shares).
• Support Communications: Any messages you send us via in-app support or contact channels.

1.2 Information Collected Automatically

• Usage Data: Screens visited, features used, session duration, toolkit and module interactions, streaks, and milestone completions.
• Device Information: Device model, operating system (iOS/Android), unique device identifiers, and app version.
• Crash & Performance Logs: Error reports and performance telemetry to diagnose and resolve technical issues.
• Notification Interactions: Whether you open, dismiss, or act on in-app and push notifications.

1.3 Health & Biometric Data (Optional, User-Initiated)

NeuroAtlas may request optional integration with Apple Health (HealthKit) or Google Fit to read select wellness metrics such as heart rate, sleep data, and activity levels. This integration is:

• Entirely optional — the App functions without it.
• Enabled only with your explicit permission via the operating system's consent dialogue.
• Used solely to personalise session recommendations and readiness insights within the App.
• Never sold, shared with third-party advertisers, or used for insurance or employment purposes.

You may revoke health data access at any time through your device's privacy settings.

1.4 Organisational Data (Enterprise Users)

If your employer has deployed NeuroAtlas, we may receive basic organisational context (e.g., department, team, employee tier) to enable features such as the Boardroom Analytics dashboard. This data is governed by our agreement with your employer.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Delivering Core Services: Personalising toolkits, sessions, and content recommendations based on your goals, usage patterns, and (where enabled) biometric data.
• Journaling & Emotional Tracking: Storing your journal entries and emotional check-in history to provide a searchable personal record and trend insights.
• Progress & Analytics: Calculating streaks, milestones, focus scores, and cognitive performance trends displayed in your personal dashboard.
• Notifications & Reminders: Sending opt-in reminders and progress nudges via push notifications (subject to your preferences).
• Boardroom Mode: Delivering rapid, context-aware neuro-toolkit activations before high-pressure events.
• AI Personalisation (Phase 2+): Using aggregated behavioural and (optional) biometric data to power predictive recommendations and the Atlas AI coaching experience.
• Account Security: Authenticating users, managing sessions, and detecting fraudulent or unauthorised access.
• Product Improvement: Analysing anonymised usage patterns to improve content, features, and performance.
• Legal Compliance: Meeting obligations under applicable data protection laws.

3. Lawful Basis for Processing (GDPR / UK GDPR)

Where applicable, we rely on the following legal bases to process your personal data:

• Contract Performance: To provide the services you signed up for.
• Legitimate Interests: To improve our App, ensure security, and deliver relevant features — balanced against your privacy rights.
• Consent: For optional health data integration, marketing communications, and any processing beyond what is strictly necessary.
• Legal Obligation: To comply with applicable laws and regulations.

For sensitive health or biometric data, we rely on your explicit consent only.

4. Data Sharing & Disclosure

We do not sell your personal data. We may share information only in the following limited circumstances:

4.1 Service Providers

We engage trusted third-party providers to operate our infrastructure, including cloud hosting (e.g., AWS), analytics tools, crash reporting services, and payment processors. These providers process data only under our instruction and are contractually bound to protect it.

4.2 Enterprise Administrators

If you access NeuroAtlas through your employer, administrators within your organisation may have access to aggregated (not individual journal) engagement data, such as module completion rates and overall usage metrics, as defined in the enterprise agreement.

4.3 Legal & Safety

We may disclose data when required by law, court order, or to protect the rights, safety, or property of NeuroAtlas, our users, or the public.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, user data may be transferred as part of the transaction. We will notify you prior to such transfer and give you the opportunity to delete your account.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specific retention periods include:

• Active Account Data: Retained for the lifetime of your account plus a 30-day grace period post-deletion request.
• Journal Entries: Deleted permanently upon account deletion request, within 30 days.
• Health/Biometric Data: Deleted immediately upon revoking consent or deleting your account.
• Anonymised Analytics: May be retained indefinitely in aggregated, de-identified form.
• Legal Hold: Data may be retained longer if required by law or active legal proceedings.

6. Your Rights & Choices

Depending on your location and applicable law, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete information in your profile.
• Erasure ('Right to be Forgotten'): Request deletion of your account and associated personal data.
• Data Portability: Request your journal entries and profile data in a machine-readable format.
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Revoke health data access or marketing consent at any time without affecting prior processing.

To exercise any of these rights, please contact us at privacy@neuroatlas.com or use the in-app 'Delete Account' or 'Manage Integrations' settings. We will respond within 30 days (or as required by applicable law).

7. Children's Privacy

NeuroAtlas is designed for professionals aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has created an account, please contact us immediately at privacy@neuroatlas.com and we will delete the account.

8. Data Security

We implement industry-standard technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls limiting internal access to your data.
• Secure authentication mechanisms including SSO and session management.
• Regular security assessments and vulnerability testing.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials.

9. International Data Transfers

NeuroAtlas may process and store your data in countries outside your jurisdiction, including the United States, the United Kingdom, or the European Economic Area. When transferring data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by relevant authorities where required.

10. Cookies & Tracking Technologies

The NeuroAtlas mobile app does not use browser cookies. We may use lightweight device-based identifiers and in-app analytics SDKs to understand usage patterns. These are described in the 'Information Collected Automatically' section above. You can opt out of analytics tracking via the Settings > Privacy menu within the App.

Our web-based administration console does use a small number of cookies; these are described in our Cookie Policy.

11. Third-Party Links & Integrations

The App may contain links to external resources or enable optional integrations (e.g., Apple Health, Google Fit). These third-party services operate under their own privacy policies. We encourage you to review them before enabling any integration. We are not responsible for the privacy practices of third-party services.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification and update the 'Last Updated' date above. Continued use of the App after changes take effect constitutes your acceptance of the updated Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact:

NeuroAtlas — Privacy Team
Email: privacy@neuroatlas.com
Address: [Insert Registered Company Address]
Data Protection Officer (if applicable): dpo@neuroatlas.com

If you are located in the EU/UK and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority (supervisory authority).