Privacy Notice for End Users, Practitioner Context

1. Who this notice is for#

1.1 This notice is for you if you train with Narbis hardware under the supervision of a clinician, coach or other professional. In this notice that professional is called your Practitioner, and you are called the End User.

1.2 It explains, in plain language, what information about you reaches Narbis, Corp., a Delaware corporation ("Narbis", "we", "us" or "our"), what we do with it, what we will never do with it, how long we keep it, and how you ask for it, change it or have it deleted.

1.3 The short version, before the detail. Your Practitioner decides what is collected about you and why. Narbis runs the technology that collects and stores it, on your Practitioner's instructions. We do not sell your data, we do not advertise to you, and we do not use your data for our own purposes beyond running the service and keeping it safe. If you want to see your data, change it or have it deleted, start with your Practitioner, because they hold the relationship with you and, in a clinical setting, the legal obligation to give you access.

2. When this notice applies, and when a different one does#

2.1 This notice applies when your Neurophysiological Data reaches Narbis because a Practitioner uses the Narbis Platform, marketed as Edge Pro for coaches and NeuroPro for clinicians, with you as their client or patient. That includes sessions you run at the Practitioner's premises and sessions you run at home on a protocol your Practitioner assigned and monitors.

2.2 A different notice applies if you bought a Narbis product yourself and use it on your own, with no Practitioner involved. In that case Narbis deals with you directly and the documents that govern are the Narbis Privacy Policy and the Narbis Consumer Health Data Privacy Policy. Neither this notice nor the Narbis Practitioner Terms applies to that use.

2.3 If both are true, meaning you own a Narbis device that you use on your own and you also train under a Practitioner who uses the Platform, then each stream is governed by its own notice. The data your Practitioner collects through the Platform is governed by this notice. The data from your own account is governed by the Privacy Policy and the Consumer Health Data Privacy Policy. The two are held separately, as described in the section titled "The two data estates are kept apart".

2.4 This notice is not the notice your Practitioner gives you about their own practice. Your Practitioner should give you their own privacy notice, their own consent forms, and, where they are a HIPAA covered entity, a Notice of Privacy Practices. Read those as well. Where your Practitioner's notice and this one differ about something your Practitioner controls, theirs governs their side and this one governs ours.

2.5 This notice is also not the privacy information that applies to the Practitioner's own account with Narbis, meaning their name, their login, their billing and their business contact details. That is covered separately in the Narbis Practitioner Terms and the Narbis Privacy Policy.

3. Who does what: the roles, stated plainly#

3.1 Your Practitioner decides. Narbis carries out. Your Practitioner chooses to use Narbis, chooses which protocols to assign you, chooses what questionnaires and tests you complete, chooses how long to keep your records, and chooses who else in their practice can see them. Narbis provides the hardware, the apps and the Platform, and processes your data on your Practitioner's behalf and under their instructions. We do not decide what is collected about you or why. That is your Practitioner's decision and your Practitioner's professional responsibility.

3.2 Your Practitioner has the relationship with you. They obtained your consent to treatment or coaching, they hold your record, they interpret your results, and they answer to you and to their regulator for how they use them. Narbis has no clinical relationship with you and does not provide any clinical service to you.

3.3 Where your Practitioner is a HIPAA covered entity, which is typical for a licensed clinician who bills insurance, the information Narbis handles for them is protected health information. In that case Narbis is a business associate, and the Business Associate Agreement appended to the Narbis Practitioner Terms applies automatically, with no separate signature needed. Under that agreement Narbis may use and disclose your protected health information only as the agreement permits, must safeguard it, must report a breach, and is directly liable under the HIPAA Security Rule and the HIPAA Breach Notification Rule. If you want to know whether your Practitioner is a covered entity, ask them.

3.4 Where your Practitioner is not a covered entity, which is common for a coach or a wellness practice, HIPAA does not apply to your data. That does not lower the standard we apply. Narbis handles your data under this notice, under the Narbis Practitioner Terms, and under the state consumer health data laws described in the Narbis Consumer Health Data Privacy Policy, and the protections in the section titled "What Narbis will not do with your data" apply in full either way.

3.5 Under the General Data Protection Regulation and the UK General Data Protection Regulation, your Practitioner is the controller and Narbis is the processor. Narbis does not offer the Platform in the European Economic Area, the United Kingdom or Switzerland, so those regulations will usually not be the law that governs your Practitioner's use of it, but the roles are stated here because they describe the arrangement accurately wherever European rules do reach it, for example where your Practitioner is established somewhere we serve and you are not. That means your Practitioner determines the purposes and means of processing, and Narbis acts only on their documented instructions. The data processing terms in the Narbis Practitioner Terms set out what we must do as a processor, including confidentiality, security, the use of subprocessors, assistance with your rights, breach notification, and deletion or return at the end of the engagement. If you are in the European Economic Area or the United Kingdom, your rights are exercised against your Practitioner as controller, and Narbis is obliged to help them answer you.

3.6 In short: your Practitioner is the one who decides and the one you ask. Narbis is the one who runs the system, keeps it secure, and does what your Practitioner tells us to do with your data.

4. The definitions we use#

4.1 These four definitions are used identically across the entire Narbis legal package.

"Neural Data" means information generated by measuring the activity of your central or peripheral nervous system, and that is not inferred from nonneural information. For Narbis this means the electroencephalographic (EEG) signal recorded by the Smart Glasses or by a compatible EEG headband, together with the frequency band values computed directly from that signal.

"Cardiac Data" means the photoplethysmographic (PPG) or electrocardiographic signal recorded by the Narbis ear clip or by a compatible heart rate sensor, the interbeat intervals derived from it, and heart rate variability values computed from those intervals.

"Derived Metrics" means the scores, indices, states and summaries that we compute from Neural Data or Cardiac Data, including coherence scores, engagement or focus indices, reward rate, session summaries and longitudinal trends.

"Neurophysiological Data" means Neural Data, Cardiac Data and Derived Metrics together.

4.2 In addition, in this notice:

"Smart Glasses" means the Narbis EEG neurofeedback smart glasses.

"Edge" means the Narbis Edge HRV biofeedback glasses, certified and sold in the United States and Canada only.

"Sensor Device" means any Narbis or third party device that measures Neurophysiological Data for use with the Services, including the Smart Glasses, Edge, the Narbis ear clip, and compatible third party EEG headbands and heart rate sensors.

"Apps" means the Narbis applications for iOS, watchOS, Android and the web.

"Platform" means the Narbis practitioner facing dashboard, its cloud services and its data stores, marketed as Edge Pro for coaches and NeuroPro for clinicians.

"Practitioner" means a clinician, coach or other professional who uses the Platform with their own clients or patients.

"End User" means an individual whose Neurophysiological Data is collected through a Practitioner's use of the Platform.

4.3 Neurophysiological Data is always sensitive. We never treat it, describe it or process it as ordinary personal information. Cardiac Data gets exactly the same protections as Neural Data, without exception, because heart rate variability indexes autonomic nervous system activity and we are not interested in arguing about which statute reaches it.

5. What is collected about you through the Platform#

5.1 The following is collected and reaches Narbis. Your Practitioner may not use every one of these features, so some rows may not apply to you. Ask your Practitioner what they have switched on.

5.2 What your Practitioner decides. Which of your identifiers go into the Platform is your Practitioner's choice. Some Practitioners enter a full name. Some use a client code and keep the key in their own records. If you would prefer to be identified by a code, ask your Practitioner. Narbis stores whatever your Practitioner enters and does not require any particular identifier.

5.3 What Narbis does not collect in this context. We do not collect precise geolocation. We do not collect genetic data. We do not collect facial images, fingerprints, voiceprints or iris scans. We do not collect payment card details from you, because you do not pay Narbis. We do not receive your data from advertising networks, social platforms or data brokers, and we do not buy data about you.

5.4 Live viewing. Where your Practitioner uses live session viewing, your signal and Derived Metrics stream to their dashboard while the session is running so that they can watch it in real time. That stream passes through Narbis systems and is stored as part of the session record. The stream is visible only to your Practitioner and to personnel they have authorized.

6. What the data is used for#

6.1 Narbis uses your data for the following purposes and no others:

a. to deliver the training session, which means reading the signal from the Sensor Device, computing band values or interbeat intervals from it, comparing them against the assigned protocol, and driving the feedback, which for the Smart Glasses means changing the tint of the lenses;

b. to compute your Derived Metrics and to display your results and your progress to your Practitioner, and to you where your Practitioner gives you access;

c. to store your session history so that adherence and change over time can be tracked;

d. to deliver a protocol your Practitioner assigns, including a remote update to that protocol;

e. to score questionnaires and continuous performance tests and to produce the regional survey and band analysis;

f. to produce the analytics, reports and data exports your Practitioner requests;

g. to provide support to your Practitioner and to you where your Practitioner asks us to help;

h. to keep the Platform secure, to detect and investigate unauthorized access, and to prevent fraud and abuse;

i. to maintain, test and debug the Platform and the Apps;

j. to meet legal obligations, including product safety obligations and responding to lawful legal process; and

k. where a Sensor Device appears to be faulty or a session pattern suggests a safety issue, to investigate it.

6.2 Your Practitioner uses your data for their own professional purposes, which they will have explained to you in their own consent process. Narbis does not control that and does not set it.

7. Who can see your data#

7.1 Your Practitioner, and the people they authorize. Your Practitioner sees your record in the Platform. They may authorize other people in their practice, such as a supervising clinician, a colleague covering for them, a technician or an administrator. Adding and removing those people is your Practitioner's responsibility, and the Narbis Practitioner Terms require them to grant access only to people who need it and to remove access promptly when it is no longer needed. If you want to know who at your Practitioner's practice can see your record, ask them.

7.2 Narbis personnel, only where it is necessary. Nobody at Narbis has standing access to your data by virtue of working here. A small number of support, engineering, security and clinical quality personnel can access it, and only where it is necessary for support, security or service delivery, for example to diagnose a fault your Practitioner has reported. That access:

a. is granted on a role basis and only to people whose job requires it;

b. is granted for a defined purpose and, wherever possible, for a defined period, and is removed when the role changes or the person leaves;

c. is logged, and the logs are reviewed;

d. is subject to written confidentiality obligations and training on handling sensitive health data before access is granted; and

e. is reviewed on a regular schedule, with unnecessary access removed.

Wherever a task can be done on de-identified or aggregated data, we use de-identified or aggregated data instead.

7.3 Subprocessors, under written agreement. Narbis uses service providers to run the Platform, principally cloud infrastructure and hosting, database and storage, security monitoring, and error and performance monitoring. Each one is engaged under a written agreement that limits it to the purpose we specify, requires confidentiality and appropriate security, prohibits any use of the data for its own purposes, prohibits any sale, requires it to bind its own subcontractors to the same terms, and requires return or deletion at the end of the engagement. Where your Practitioner is a HIPAA covered entity, each subprocessor that handles protected health information is engaged under a business associate agreement.

7.4 Where a subprocessor changes. Narbis maintains a current list of subprocessors and gives Practitioners advance notice of a new one, with an opportunity to object, as set out in the data processing terms in the Narbis Practitioner Terms. If you want to see that list, ask your Practitioner, or write to info@narbis.com.

7.5 Nobody else. Beyond the above, your data is disclosed only where the law requires it, and then only what a valid legal demand actually requires. We assess every demand, we require lawful process, we object to an overbroad demand, and where we are permitted to do so we notify your Practitioner before responding so that they can act on your behalf.

7.6 The list, by name. The current subprocessors, with the purpose of each, what it receives, where it processes and whether a business associate agreement is in place, are published at narbis.com/legal/subprocessors. Narbis gives Practitioners notice before adding a new subprocessor that will handle protected health information, and a Practitioner may object on reasonable grounds relating to data protection, as paragraph B6.3 of the Business Associate Agreement in the Narbis Practitioner Terms sets out.

7.7 Error and crash reporting. Error reports are generated in the App and sent to a Narbis mailbox. Narbis does not use a third party crash or performance monitoring service, and no error report contains Neural Data, Cardiac Data or Derived Metrics. If such a service is ever added, it is named on the subprocessor page before it is switched on.

8. What Narbis will not do with your data#

8.1 These commitments are the same ones we make to consumers who buy directly from us. Being reached through a Practitioner does not get you a lower standard.

a. Narbis does not sell End User data. Not your Neural Data, not your Cardiac Data, not your Derived Metrics, not your questionnaire responses, not your session records. This is flat and unqualified. There is no version of this where a payment changes the answer.

b. Narbis does not use End User data for advertising. We do not advertise to you, we do not build an advertising profile of you, and we do not share your data with advertising networks, advertising technology providers, social media platforms or data brokers.

c. Narbis does not use your data to market anything to you. You are your Practitioner's client, not a Narbis marketing contact. We do not use the Platform to reach you with promotions.

d. Research and product improvement use is limited and conditional. Narbis uses End User data to evaluate protocols and algorithms, to improve the product, or to conduct or support research only where the data has first been de-identified to the standard at 45 C.F.R. 164.514, by Safe Harbor or by Expert Determination, and only where the law and your Practitioner's instructions permit it. Where your Practitioner is a HIPAA covered entity, de-identification is carried out as the Business Associate Agreement permits, and identifiable protected health information is never used for research or product improvement without the authorization or waiver that HIPAA requires.

e. Narbis commits not to attempt to re-identify any data that has been de-identified, and binds every recipient of de-identified data to the same commitment by contract.

f. Narbis does not use your data to train a general purpose machine learning model on identifiable data.

g. Narbis does not make an automated decision about you that produces a legal or similarly significant effect. The Platform produces measurements and scores. A clinical or coaching decision is made by your Practitioner, who is a person.

8.2 If any of these positions ever changed, it would require a change to this notice, notice to your Practitioner, and whatever consent or authorization the law requires. Continuing to train would not be consent, and it never will be.

9. How long your data is kept#

9.1 Retention is stated in numbers, not in adjectives.

9.2 The business associate rule matters most here. Where your Practitioner is a HIPAA covered entity, Narbis holds your protected health information on their instruction. We keep it for as long as they instruct. When their agreement with Narbis ends, and unless they instruct otherwise, we return or destroy that protected health information within 30 days of termination, and we require our subprocessors to do the same. Where return or destruction is not feasible for a specific record, we extend the protections of the Business Associate Agreement to that record and limit further use and disclosure to the reasons that make return or destruction infeasible, and we tell your Practitioner which records those are.

9.3 Your Practitioner may hold your record for longer than Narbis does, because clinical record retention rules in their state or country may require it. Ask your Practitioner what their retention period is. Narbis deleting a record from the Platform does not delete your Practitioner's own record of your care.

9.4 Export before the end. Before a Practitioner's access ends, they can export your records in full using the export function in the Platform. Export is a supported function, not a favor. If you want a copy of your data before your Practitioner stops using Narbis, ask them to export it for you.

9.5 When a retention period ends, deletion runs as a scheduled job rather than on request, so that the schedule is enforced whether or not anyone is watching.

10. Your rights, and how to exercise them#

10.1 Start with your Practitioner. For anything to do with your record, contact your Practitioner first. There are two practical reasons for this, and neither is an attempt to avoid you.

a. Your Practitioner holds the relationship with you and knows which record is yours. Narbis often cannot tell, because your Practitioner may have entered you under a code rather than a name.

b. Where your Practitioner is a HIPAA covered entity, the legal obligation to give you access to your record, and to amend it, sits with them and not with Narbis. HIPAA gives you the right of access against the covered entity. A business associate answers that request through the covered entity. The same is true under the General Data Protection Regulation, where your Practitioner is the controller and your rights are exercised against the controller.

10.2 What Narbis does. When your Practitioner brings us a request from you, Narbis supports them in fulfilling it. That means we help them locate, export, correct, restrict or delete your data in the Platform, within the timeframe they need to meet their own legal deadline. Our obligation to do that is written into the Narbis Practitioner Terms and, where applicable, the Business Associate Agreement.

10.3 When Narbis acts directly. Narbis will respond to you directly where the law requires us to, or where your Practitioner is unreachable, has ceased practice, or refuses to pass on a request that the law entitles you to make. In those cases write to info@narbis.com, tell us who your Practitioner is, and we will verify you and act. Where we act directly we apply the same standard we apply on the consumer side: we acknowledge within 10 days, we respond within 45 days, and where a request is complex we may take one further 45 day extension and will tell you within the first 45 days that we are doing so. If we decline a request, we explain why and tell you how to appeal, and an appeal is reviewed by someone who was not involved in the original decision and answered within 45 days.

10.4 The rights themselves. Depending on where you live and on whether your Practitioner is a covered entity, those rights include: to be told what is held about you; to get a copy of it in a usable format; to have an inaccurate record corrected or amended; to have your data deleted; to restrict or object to certain processing; to withdraw a consent you gave; and, under HIPAA, to receive an accounting of certain disclosures. Your Practitioner's own privacy notice sets out the full list that applies to their practice.

10.5 Verification. Before Narbis gives anyone access to Neurophysiological Data we verify who they are. Because this data is sensitive and a wrongful disclosure cannot be undone, we may ask for an additional confirmation step, and we may confirm with your Practitioner that the request is genuine. We ask only for what verification requires, we do not use it for anything else, and we delete it when verification is complete.

10.6 No retaliation. Neither Narbis nor, under the Narbis Practitioner Terms, your Practitioner may treat you worse because you exercised a right.

10.7 Where to write. info@narbis.com, with "End User request" in the subject line, or use the form at narbis.com/contact.

11. If the End User is a child or a young person#

11.1 Only an adult aged 18 or over may create a Narbis account and agree to Narbis terms. A Practitioner using the Platform with a minor client does so under their own professional and legal obligations to that client and to the parent or guardian.

11.2 A trainee must be aged 6 or over. Compatible third party sensors are subject to their own manufacturer's minimum age requirement, which may be higher than the Narbis minimum, and where it is higher, that higher age applies to use of that device. The Narbis Privacy Policy sets this out in the section titled "Children and trainees".

11.3 Where the trainee is under 13, verifiable parental consent is obtained from the parent or guardian before any Neurophysiological Data is collected. Consent for the training itself is kept separate from consent to any third party disclosure. The two are never bundled.

11.4 Where the trainee is in the European Economic Area or the United Kingdom and is under the age of digital consent in their country, which ranges from 13 to 16, consent is obtained from the holder of parental responsibility and reasonable steps are taken to verify it.

11.5 In a practitioner setting your Practitioner is responsible for obtaining and documenting parental consent, because they hold the relationship with the family. Narbis provides the consent capture and record keeping tools in the Platform and requires their use.

11.6 A parent or guardian may exercise every right in this notice on behalf of a child. A young person aged 13 to 17 may also raise a request with their Practitioner, or with Narbis at info@narbis.com, and we will work with them and with their Practitioner and parent or guardian as the law and the circumstances require.

11.7 Data of a trainee under 13 is retained on the shorter schedule in the section titled "How long your data is kept": raw signal for 12 months, and all data deleted within 90 days of account closure.

12. Security, and what happens if something goes wrong#

12.1 Narbis protects your data with administrative, technical and physical safeguards appropriate to how sensitive it is, and treats Neurophysiological Data as its highest sensitivity tier. Those safeguards include encryption in transit and at rest, role based access control with least privilege, multi factor authentication for administrative access, logging and monitoring of access to identifiable data, network segmentation, secure development practices, vulnerability management and patching, background checks and confidentiality obligations for personnel with access, written security requirements imposed on every subprocessor, and a documented and tested incident response plan.

12.2 Where your Practitioner is a HIPAA covered entity, Narbis is directly liable under the HIPAA Security Rule for the administrative, physical and technical safeguards it applies to your protected health information, and directly liable under the HIPAA Breach Notification Rule for reporting a breach.

12.3 Breach notification runs through your Practitioner. If there is a breach of unsecured protected health information, or any other security incident affecting your data, Narbis notifies your Practitioner without unreasonable delay and within the time the Business Associate Agreement and applicable law require, with the information they need to assess it: what happened, when, which individuals and which categories of data are affected, what we have done, and what we recommend. Your Practitioner, as the covered entity or controller, is then responsible for notifying you and the relevant regulator. This is the correct order, because your Practitioner holds the relationship with you and, in most cases, the only reliable way to reach you.

12.4 Where the law requires Narbis to notify you directly, we will.

12.5 No system is perfectly secure and we do not claim otherwise. To report a suspected vulnerability or incident, write to info@narbis.com.

13. The two data estates are kept apart#

13.1 Narbis runs two separate data estates and keeps them logically and contractually separate.

a. The practitioner estate, which holds data collected through a Practitioner's use of the Platform, including protected health information held as a business associate.

b. The direct to consumer estate, which holds data of people who bought a Narbis product and use it without a Practitioner.

13.2 No protected health information from the practitioner estate flows into the direct to consumer estate, and no direct to consumer data flows into the business associate environment. Commingling would destroy our ability to make clean and honest representations under either regime, and it would put your data under the wrong set of rules.

13.3 In practice this means your Practitioner's records about you are not added to any Narbis consumer database, are not used to build a Narbis consumer profile of you, and are not mixed with data from a personal Narbis account you may hold separately.

14. Where your data is processed#

14.1 Narbis is established in the United States and processes and stores Platform data there, in cloud infrastructure under its control. Where data is transferred out of the country in which it was collected, Narbis uses a transfer mechanism recognized by the applicable law.

14.2 Because your Practitioner is the controller, the decision about where your data may be processed is theirs, and the data processing terms in the Narbis Practitioner Terms record what they have agreed. Ask your Practitioner if you want to know where your data is held.

14.3 Narbis does not offer the Platform to Practitioners established in the European Economic Area, the United Kingdom or Switzerland, and has not done so since 1 October 2026. There is therefore no routine transfer of Platform data out of those territories, and no European Economic Area or United Kingdom hosting option is offered. The section titled "Eligibility and your professional standing" in the Narbis Practitioner Terms describes the position, and your Practitioner can tell you which hosting region their account uses.

15. Being told when the system reads an attentional or emotional state#

15.1 This section explains something the European Union Artificial Intelligence Act requires you to be told, and it is worth reading even if you are not in Europe, because it describes what the product actually does.

15.2 The Narbis Platform measures brain activity and cardiac activity and computes scores from them. Some of those scores are interpretations of a state rather than raw measurements. A focus or engagement index is an inference about how attentive you were. A stress index or a coherence score is an inference about a physiological state associated with arousal or calm. Where a system infers an emotional or attentional state from biometric measurements, the Artificial Intelligence Act treats it as a system whose use has to be disclosed to the people it is used on.

15.3 Article 50(3) of the Artificial Intelligence Act requires the deployer of such a system to inform the people exposed to it that the system is being used, and to explain how it operates. In the practitioner channel, your Practitioner is the deployer, because they are the one who decides to use the Platform with you. The obligation to inform you therefore sits with your Practitioner, not with Narbis.

15.4 What Narbis does about it. Narbis provides Practitioners with notification materials written for End Users: a plain language explanation of what the Platform measures, which outputs are direct measurements and which are inferred states, what the inferences are and are not capable of showing, and a record keeping tool so that the Practitioner can show they informed you. The Narbis Practitioner Terms require Practitioners in scope of the Artificial Intelligence Act to give you that notification before using the Platform with you.

15.5 What you should understand about the inferences. A focus index is not a measurement of your thoughts. A stress index is not a diagnosis. These scores are computed from a physiological signal using an algorithm, they reflect patterns in that signal, and they can be affected by how well the sensor is seated, by movement, by caffeine, by sleep and by a great many things that have nothing to do with what the score is named after. They are a tool your Practitioner uses alongside their own judgment and what you tell them. They are not a window into your mind, and nobody at Narbis or at your Practitioner's practice should present them to you as one.

15.6 Narbis does not use emotion recognition in a workplace or an educational setting, which the Artificial Intelligence Act prohibits, and the Narbis Practitioner Terms prohibit a Practitioner from deploying the Platform for that purpose.

16. Changes to this notice#

16.1 If we change this notice we will update the Last Updated date, post the revised notice at its canonical location, and notify Practitioners so that they can pass the change on to their clients and patients.

16.2 A material change does not apply retroactively. If Narbis wanted to use End User data for a new purpose, that would require a change to this notice, notice to Practitioners, an instruction from the Practitioner as controller or covered entity, and whatever consent or authorization the law requires. Continuing to train is not consent to a new purpose, and it never will be.

16.3 Prior versions of this notice are kept available so that you can see what applied when.

17. How to reach us#

How to reach us
Email: info@narbis.com
Web: narbis.com/contact

One mailbox handles everything. To help us route your message quickly, please begin your subject line with one of these words where it applies: Privacy, Legal, Practitioner, Security or Appeal. We read everything either way.

17.1 For anything about your own record, contact your Practitioner first, as described in the section titled "Your rights, and how to exercise them".

17.2 For a question about this notice, or where you need Narbis to act directly, write to info@narbis.com with "End User request" in the subject line, or use the form at narbis.com/contact. We acknowledge within 10 days and respond within 45 days.

17.3 To report a suspected security incident, write to info@narbis.com.