NeuroPawn Privacy Policy

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names
• phone numbers
• email addresses
• mailing addresses
• billing addresses
• contact preferences
• payment and billing information, including:
  • Billing addresses
  • Payment method type (e.g., Visa, Mastercard)
  • Last four digits of payment cards (for order confirmation and customer service)
  • Transaction history and order details
• order history and product preferences

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information doesn't reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. We typically use this information for security, to monitor site performance, and for aggregated analytics to improve our services.

Like many businesses, we also collect information through cookies and similar technologies. You can learn more about this in our Cookie Policy.

Information Processed by Our Software and Hardware

When you use our Materials (including the NeuroPawn Biopotential Kit and associated software), certain categories of data are generated. These are handled with a local-first approach to maximize your privacy.

User Data: You maintain full ownership of all data you collect or generate using the Materials, including biometric data, sensor readings, and any analytics derived from your direct input ("User Data"). NeuroPawn does not have ownership of your User Data. This data is primarily stored locally on your device, under your control.

Application Analytics Data ("App Data"): To enhance our Software, we may collect anonymized and aggregated analytics data about how the application is used. App Data can include performance metrics, device specifications, and feature usage patterns. This data is distinct from your User Data and never contains personally identifiable or biometric information. You have the option to disable the collection of App Data in the software's settings without impacting core functionality.

Information collected from other sources

In Short: We don't collect any information from third parties.

We don't collect any information from third parties.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To evaluate and improve our Services, products, marketing, and your experience. We may process your information when we believe it's necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
• To comply with our legal obligations. We may process your information to comply with our legal obligations, such as to respond to a legal request or subpoena.

To Provide and Enhance Product Functionality

Our services are architected to protect your privacy by managing how and where your data is processed:

Local Processing Priority: The NeuroPawn software is designed to prioritize the processing of your User Data locally on your device. This method gives you maximum control over your information and reduces the need for data transmission.

Cloud-Assisted Processing: For features requiring greater computational power, we may use cloud-based resources. This process is temporary and designed with privacy as a priority. Any cloud processing occurs in a "stateless manner," which means your User Data is not permanently stored on our servers and is not retained after the processing is complete. The software will provide a clear indication when a feature relies on cloud processing.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we believe it's necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

We rely on the following legal bases to process your personal information:

• Consent: We may process your information if you've given us explicit permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a Contract: We may process your personal information when we believe it's necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legal Obligations: We may process your information where we believe it's necessary for compliance with our legal obligations, such as cooperating with a law enforcement body or regulatory agency, exercising or defending our legal rights, or disclosing your information as evidence in litigation in which we're involved.
• Vital Interests: We may process your information where we believe it's necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
• Legitimate Interests: We may process your information when we believe it's necessary for our legitimate business interests, provided those interests aren't overridden by your data protection interests or fundamental rights and freedoms. Examples include:
  • Improving, maintaining, and analyzing our Services
  • Detecting and preventing fraud and security incidents
  • Understanding how our users use our Services
  • Sending relevant marketing communications

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations and with specific third parties.

We may need to share your personal information in the following situations:

• Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. Examples include: payment processing, data analysis, email delivery, hosting services, customer service, and marketing efforts.
• Payment Processing: We use Stripe Inc. as our payment processor to handle credit card transactions and other payment methods. When you make a purchase, your payment information is collected and processed by Stripe in accordance with their privacy policy, which you can review at https://stripe.com/privacy. We do not store your complete payment card details on our servers.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Affiliates. We may share your information with our affiliates, in which case we'll require those affiliates to honor this Privacy Notice.
• When you publicly post to other users. When you provide personal information or otherwise interact with public areas of the Services, such personal information may be viewed by all users and may be publicly made available outside the Services in perpetuity.
• With your consent. We may disclose your personal information for any other purpose with your consent.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy.

6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: We don't offer any AI-based products or services that directly process your personal data for AI model training or inference without explicit notice.

While we may use AI internally for operational efficiency (e.g., in customer support tools or data analysis), we don't offer AI-based products or features that rely on processing your personal information for AI model training, inference, or generating outputs that directly impact you, without providing clear notice and obtaining consent where required by law.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We'll only keep your personal information for as long as it's necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we'll either delete or anonymize it, or, if this isn't possible (for example, because your personal information has been stored in backup archives), then we'll securely store your personal information and isolate it from any further processing until deletion is possible.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We've implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we can't promise or guarantee that hackers, cybercriminals, or other unauthorized third parties won't be able to defeat our security and improperly collect, access, steal, or modify your information.

9. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We don't knowingly collect data from or market to children under 18 years of age.

We don't knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you're at least 18 or that you're the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we'll deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at support@neuropawn.tech.

10. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: In some regions, such as Canada and the European Economic Area, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

In some regions (like Canada, the EEA, and the UK), you have certain rights under applicable data protection laws. These may include the right to:

• Request access to your personal information
• Request rectification or correction of your personal information
• Request erasure of your personal information
• Object to the processing of your personal information
• Request restriction of the processing of your personal information
• Request data portability (transfer your data to another organization)
• Withdraw your consent at any time

Given that NeuroPawn Biotechnologies Inc. is located in Calgary, Alberta, Canada, Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA). These rights typically include the right to access your personal information and challenge its accuracy and completeness.

Withdrawing your consent

If we're relying on your consent to process your personal information, you have the right to withdraw your consent at any time. You can withdraw your consent by contacting us using the details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

Opting out of marketing and promotional communications

You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send or by contacting us using the details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

11. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we don't currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we'll inform you about that practice in a revised version of this Privacy Notice.

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Virginia, Colorado, Utah, or Connecticut, you are granted specific rights regarding access to your personal information.

The laws of certain US states, including California, Virginia, Colorado, Utah, and Connecticut, provide their residents with specific rights regarding their personal information.

California Residents

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year.

CCPA Privacy Notice (California Consumer Privacy Act)

Your rights with respect to your personal data:

• Right to know: You have the right to request that we disclose to you the categories and specific pieces of personal information we have collected about you
• Right to correct: You have the right to request that we correct inaccurate personal information that we maintain about you
• Right to delete: You have the right to request the deletion of your personal information, subject to certain exceptions
• Right to opt-out of sale/sharing: You have the right to opt-out of the "sale" or "sharing" of your personal information. NeuroPawn doesn't sell or share personal information as defined by the CCPA
• Right to non-discrimination: You have the right not to be discriminated against for exercising any of your CCPA rights

Virginia, Colorado, Utah, and Connecticut Residents

If you are a resident of Virginia, Colorado, Utah, or Connecticut, you may have additional rights regarding your personal data including rights to access, deletion, correction, and opt-out of sales/targeted advertising.

To exercise these rights, please contact us at support@neuropawn.tech. We'll respond to your request in accordance with applicable state laws.

13. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Depending on the region you're in, you may have additional rights to request access to, change, or delete your personal information.

Depending on your country, province, or region, you may have additional rights regarding the collection, use, and disclosure of your personal information. These rights can vary significantly depending on local laws such as Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the EU's General Data Protection Regulation (GDPR), and other national or regional data protection laws.

To inquire about specific rights applicable to your region, please contact us using the information provided in the "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" section.

14. INTERNATIONAL DATA TRANSFERS

We may transfer your personal information to countries other than your own, including Canada and the United States. When we do, we ensure appropriate safeguards (such as Standard Contractual Clauses or adequacy decisions) are in place to protect your data, especially for users in the EU/EEA, UK, or Switzerland.

15. PUBLIC USER CONTENT

If you choose to submit user-generated content (e.g., reviews, comments, or media) in our public Community Spaces, that content may be visible to other users and publicly indexed. Please avoid including sensitive personal information in public contributions. By posting such User Content, you grant NeuroPawn a license to use, reproduce, and display it for any purpose, as fully detailed in our Terms of Service. You are solely responsible for the content you post and for ensuring you have the rights to grant us this license.

Responsibility for Third-Party Data

If you use the Materials to collect data from third parties, such as research participants or patients ("Third-Party Data"), you are solely responsible for complying with all applicable laws. You represent and warrant that you have obtained all necessary rights, permissions, and explicit consents required to collect, process, and transmit such Third-Party Data through the Materials. Your full legal obligations and your agreement to indemnify NeuroPawn in relation to your handling of Third-Party Data are governed by our Terms of Service.

16. THIRD-PARTY SERVICES

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices or the content of those third parties. Please review their policies before providing them with personal information.

17. PROFILING AND INFERENCES

We do not engage in automated profiling that produces legal or similarly significant effects. However, we may analyze usage trends and behavior to improve our offerings and personalize user experiences.

18. VERIFICATION AND AUTHORIZED AGENTS

To protect your privacy and comply with legal requirements, we may require identity verification before fulfilling data access or deletion requests. If you're acting on behalf of someone else (e.g., as an authorized agent), we may require legal documentation such as a notarized statement or power of attorney.

19. DEIDENTIFIED INFORMATION

We may use or share aggregated or deidentified information for analytics, research, or product improvement. We will not attempt to re-identify this data.

20. REGULATORY DISCLOSURES

If required by applicable law or regulatory authority, we may disclose product-related data (e.g., device IDs, usage logs, or geographic information) to appropriate entities. Users will be notified to the extent permitted by law.

21. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we'll update this Notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date and the updated version will be effective as soon as it's accessible. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we're protecting your information.

22. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

23. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. To request to review, update, or delete your personal information, please submit a data subject access request by emailing support@neuropawn.tech. We'll respond to your request within the timeframe required by applicable law.