Privacy policy

When you create an account: first name, last name, email address, language and time zone. Your password is never stored — only a fingerprint from which the password cannot be rebuilt.

When you buy: what you bought, when, how much you paid and the status of the order. Card details never pass through us and we never see them — payment is handled by the shop’s payment processor.

When you use the platform: which materials you opened and where you left off, which sessions you had and with whom.

When you measure with the devices: the intervals between heartbeats, the coherence score and, if you start the reading, the ECG wave. These are health data and follow the rules below.

Measurements taken with the strap are a special category of data within the meaning of Article 9 of the GDPR. We process them only with your explicit consent, given at the first measurement, and you can withdraw it at any time — from the app, by stopping the upload to the platform, or by writing to us.

• Measurements stay on your phone even if you stop the upload; there they are yours and nobody sees them.
• On the platform they are seen by the therapist you have sessions with, and by nobody else.
• The app does not keep patient names — only a code. The link between the code and the person is made on the platform, at your request.
• We don't sell them, we don't pass them on and we don't use them for advertising. Never, whatever the amount.

• To give you what you bought and remember where you left off — legal basis: performance of the contract.
• To hold your sessions and let the specialist prepare them — legal basis: performance of the contract.
• To issue invoices and answer to the authorities — legal basis: legal obligation.
• To measure and show your progress with the devices — legal basis: your explicit consent.
• To keep the platform running and catch attempts to break into accounts — legal basis: our legitimate interest in providing a secure service.

Nobody beyond what is needed for the service to work:

• the specialist you have sessions with, for what concerns your sessions together;
• the provider that hosts the platform and the database, in the European Union;
• the payment processor, which receives the amount and the order — not what you measured;
• the provider that delivers the video materials, which only learns that a material was requested;
• the authorities, when the law requires it and only as far as it requires.

• Your account and what you bought: as long as you have an account, plus the period required by accounting law for invoices (10 years).
• Measurements: as long as you have an account, or until you delete them. Withdrawing consent stops future ones; we delete past ones on request.
• Technical logs, with IP addresses: 90 days at most.

Write to us, and you will get an answer within 30 days at most:

• a copy of everything we have about you;
• correction of anything that is wrong;
• deletion — except invoices, which the law requires us to keep;
• stopping the processing, or withdrawing consent for health data;
• your data in a format you can take elsewhere;
• to object to processing based on legitimate interest.

Accounts are created by adults. For a child under 16, the account is opened and managed by the parent or guardian, who also gives consent for the health data.

The connection to the platform is encrypted. Passwords are stored as fingerprints that cannot be reversed. Sessions close by themselves, and their keys are not accessible to scripts on the page. Access to health data is limited to the specialist who looks after it.

If a breach that could affect you ever happens, we will notify you and the authority within the time limits set by law.

The platform is operated by Brain Map Online SRL, with its registered office at Str. Zaharia Carcalechi nr. 23, bloc 1, ap. 30, Brașov, România, registered with the Romanian Trade Register under no. J8/2041/2024, tax ID (CUI) RO50306260.

You can write to us at contact@institutulbrainmap.ro or call 0371 710 020.

Write to us first — most things get sorted out there. If we can't reach an agreement, you can turn to:

• the Romanian National Authority for Consumer Protection — anpc.ro, including alternative dispute resolution (ADR);
• the European online dispute resolution platform — ec.europa.eu/consumers/odr;
• for personal data, the Romanian National Supervisory Authority for Personal Data Processing — dataprotection.ro.