Privacy Policy
NeuroVitals exists to give you a private, intelligent view of your own brain and body. That mission only works if your data is genuinely yours. This policy explains exactly what we collect, why we collect it, who can see it, and the controls you hold.
Contents
1. Who we are
NeuroVitals is operated by NeuroVitals, Inc. ("NeuroVitals," "we," "our," "us"). The mobile application, related services, and this website are collectively the "Service."
For privacy questions, write to privacy@neurovitalsai.com.
2. Information we collect
2.1 Information you provide
- Account information — email address, password (stored only as a one-way hash by our authentication provider), and your chosen atSign identifier.
- Profile and intake — voluntarily provided data such as goals, demographics, lifestyle responses, and the contents of your Blueprint intake.
- Lab biomarkers — when you import lab results, the values, units, and reference ranges you upload.
- Communications — support emails, in-app feedback, and survey responses.
3.2 Information generated from connected devices and apps
- Apple HealthKit — only the specific data types you authorize. Read-only. We never write data to HealthKit unless you explicitly enable a writeback feature.
- Oura, and other supported wearables — sleep stages, heart rate variability, resting heart rate, activity, recovery, and similar biometric signals you connect.
3.3 Information collected automatically
- Device and diagnostic data — model, OS version, app version, locale, anonymous crash reports, and performance metrics.
- Usage data — features opened, actions taken inside the app, and timing. Tied to a pseudonymous user identifier, not to your name or email in our analytics store.
- Purchase data — subscription status, transaction identifiers, and renewal events received from Apple via RevenueCat. We do not receive your full payment card number.
3. How we use information
- Provide the Service — generate your Blueprint, run the behavior intelligence engine, render signals, and personalize recommendations.
- Authenticate you — sign you in and protect your account.
- Process subscriptions — verify and maintain your Pioneer Annual access via Apple and RevenueCat.
- Improve the product — fix bugs, understand which features help, and prioritize what to build next. Aggregated and anonymized wherever possible.
- Communicate — send transactional emails (receipts, security alerts, account changes). Marketing emails are only sent with your explicit opt-in and you can unsubscribe anytime.
- Comply with the law — respond to lawful requests, enforce our Terms, and prevent abuse.
We do not sell your personal information. We do not share it with advertisers. We do not use it to train third-party machine-learning models.
4. The atSign vault — your data, encrypted
NeuroVitals uses the atSign protocol to give you a personal, end-to-end encrypted data vault keyed to your atSign (for example, @yourname). Most of your sensitive data — including Blueprint state, wearable signals, lab values, and personalization vectors — is stored in this vault.
- Vault contents are encrypted on your device before transmission.
- The atSign network routes encrypted packets but cannot decrypt them.
- NeuroVitals' servers cannot read vault contents.
- If you lose the atSign keys held on your device and have not backed them up, the data they protect is unrecoverable — by design.
This architecture is the privacy backbone of the Service. We chose it specifically so that no single party — including us — has a clear-text copy of your most personal data.
5. Who we share data with
We share information with a narrow set of vendors who help us operate the Service. Each is bound by contract to handle data only on our instructions and to maintain industry-standard safeguards.
- Google Firebase (Authentication, Firestore, Cloud Functions, Crashlytics) — account auth, non-vault application data, crash diagnostics. Hosted in the United States.
- RevenueCat — subscription state and entitlement management. Receives a pseudonymous user identifier and Apple transaction events.
- Apple — payments, App Store entitlements, and HealthKit (HealthKit data never leaves your device for our servers unless you explicitly opt in to a feature that requires it).
- Oura and other wearable providers — when you authorize a connection, those providers send us the signals you approved. Their own privacy policies govern data they hold.
- atSign network operators — route encrypted packets. They cannot decrypt them.
- Email and customer-support tooling — for transactional and support messages.
We may also disclose information if we believe in good faith it is required by law, necessary to enforce our Terms, or required to protect the safety of any person.
If NeuroVitals is involved in a merger, acquisition, or asset sale, we will notify you before personal information is transferred and you will retain the rights described in this policy.
6. Health data and HealthKit
NeuroVitals is a wellness and self-quantification tool, not a medical device. We do not provide medical advice, diagnosis, or treatment. Always consult a qualified clinician for medical decisions.
- HealthKit data you authorize is read on-device. We process it locally first and store derived insights in your atSign vault.
- We do not use HealthKit data for advertising or share it with third parties for advertising or data-broker purposes — both are prohibited by Apple's HealthKit terms and by our policy.
- You can revoke HealthKit permissions at any time in iOS Settings → Privacy & Security → Health → NeuroVitals.
7. Data retention
- Account data — retained while your account is active. If you delete your account, we delete or anonymize within 30 days, except where law requires longer retention (for example, financial records).
- Vault contents — controlled by you. Deleting them on-device removes them from the atSign network's reach for delivery.
- Diagnostics and logs — retained for up to 90 days for debugging, then aggregated or deleted.
- Subscription records — retained for the period required by tax and accounting laws (typically 7 years).
8. Your rights and controls
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate data.
- Delete your account and associated data.
- Object to or restrict certain processing.
- Receive a portable copy of your data.
- Withdraw consent at any time where consent is the legal basis.
- Lodge a complaint with a supervisory authority.
California residents have additional rights under the CCPA/CPRA. EEA, UK, and Swiss residents have rights under GDPR and equivalents. To exercise any of these, email privacy@neurovitalsai.com. We respond within 30 days. We will never charge you for a routine rights request or retaliate for exercising your rights.
Account deletion: in the app, go to Settings → Account → Delete Account. Or email privacy@neurovitalsai.com from the address on your account.
9. Security
We implement administrative, technical, and physical safeguards including TLS in transit, encrypted storage at rest, principle-of-least-privilege access controls, secret management via Google Cloud Secret Manager, and routine review of dependencies. The atSign vault provides end-to-end encryption for the most sensitive data. No system is perfectly secure; if you believe your account has been compromised, contact security@neurovitalsai.com immediately.
10. Children
NeuroVitals is not intended for, marketed to, or designed for children under 17. We do not knowingly collect personal information from children under 17. If you believe a child has provided us information, contact us and we will delete it.
11. International users
NeuroVitals is operated from the United States. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S. and other jurisdictions where our vendors operate. Where required, we rely on Standard Contractual Clauses or equivalent legal mechanisms for cross-border transfers.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and notify you in-app or by email before the change takes effect. Continued use of the Service after the effective date constitutes acceptance.
13. Contact us
Questions, requests, or concerns:
- Email: privacy@neurovitalsai.com
- Support: support@neurovitalsai.com
- Security disclosures: security@neurovitalsai.com
- Mail: NeuroVitals, Inc., Lakewood, Ohio, United States