Narbis Privacy Policy

1. The short version#

Narbis products measure your nervous system. That is the whole point of them, and it is also why this policy is written the way it is. Brain and cardiac signals are not ordinary personal information, and we do not treat them as ordinary personal information.

Seven commitments govern everything below. They are not aspirations. Each one is implemented in the product and enforced in our systems.

1. We do not sell Neurophysiological Data. Not to anyone, for any consideration, ever.
2. We do not use Neurophysiological Data for advertising, and we do not share it with advertising networks or data brokers.
3. We collect it only with your opt in consent, obtained before collection begins, granular by purpose, and as easy to withdraw as it was to give. Agreeing to our terms is not consent, and never will be.
4. Sharing it with a third party requires your separate consent, and we name the recipient specifically rather than describing a category.
5. Research and product improvement use is opt in, off by default, and operates only on de-identified data.
6. When we de-identify, we do it to the HIPAA standard at 45 C.F.R. 164.514, and we commit not to attempt re-identification and to bind anyone who receives it to the same.
7. We tell you how long we keep things, in numbers. The schedule is in the section titled "How long we keep things".

If you only read one more section, read the one titled "Neurophysiological Data". It is the part of this policy that is actually about you.

2. Who we are and what this covers#

This policy is issued by Narbis, Corp., a Delaware corporation ("Narbis", "we", "us" or "our").

It covers the personal information we handle when you:

• visit narbis.com or narbis.shop,
• buy or use Narbis hardware, including the Smart Glasses, Narbis Edge and the Narbis ear clip,
• use the Narbis applications for iOS, watchOS, Android or the web, or
• contact us for support.

It does not cover the practitioner channel. If your data reaches us because a clinician, coach or other professional uses the Narbis Platform with you, the document titled "Privacy Notice for End Users, Practitioner Context" applies to you instead, and your Practitioner holds the primary relationship and the primary obligations. See the section titled "If you train with a practitioner".

Cookies and similar technologies are described in the separate Cookie Notice. Consumer health data rights under Washington, Nevada, Connecticut and California law are described in the separate Consumer Health Data Privacy Policy, which the law requires us to publish as its own document.

How to reach us
Email: info@narbis.com
Web: narbis.com/contact

One mailbox handles everything. To help us route your message quickly, please begin your subject line with one of these words where it applies: Privacy, Legal, Practitioner, Security or Appeal. We read everything either way.

3. The words we use#

"Neural Data" means information generated by measuring the activity of your central or peripheral nervous system, and that is not inferred from nonneural information. For Narbis this means the electroencephalographic (EEG) signal recorded by the Smart Glasses or by a compatible EEG headband, together with the frequency band values computed directly from that signal.

"Cardiac Data" means the photoplethysmographic (PPG) or electrocardiographic signal recorded by the Narbis ear clip or by a compatible heart rate sensor, the interbeat intervals derived from it, and heart rate variability values computed from those intervals.

"Derived Metrics" means the scores, indices, states and summaries that we compute from Neural Data or Cardiac Data, including coherence scores, engagement or focus indices, reward rate, session summaries and longitudinal trends.

"Neurophysiological Data" means Neural Data, Cardiac Data and Derived Metrics together.

"Sensor Device" means any Narbis or third party device that measures Neurophysiological Data for use with the Services, including the Smart Glasses, Narbis Edge, the Narbis ear clip, and compatible third party EEG headbands and heart rate sensors.

"Apps" means the Narbis applications for iOS, watchOS, Android and the web.

"Platform" means the Narbis practitioner facing dashboard and its associated cloud services.

A note on Cardiac Data. There is genuine legal argument about whether heart rate variability is "neural data" within the meaning of the state statutes, because HRV is a measure of autonomic, that is peripheral, nervous system activity. We have not tried to win that argument. We treat Cardiac Data exactly as we treat Neural Data throughout this policy, and you get the higher standard on both.

4. What we collect#

4.1 Neurophysiological Data#

From the Smart Glasses or a compatible EEG headband: the raw electroencephalographic signal, the frequency band values computed from it, and signal quality and impedance information.

From Narbis Edge, the Narbis ear clip or a compatible heart rate sensor: the photoplethysmographic or electrocardiographic signal, the interbeat intervals derived from it, and heart rate variability values.

From both: the Derived Metrics we compute, including coherence scores, engagement or focus indices, reward rate, breathing rate and resonance frequency, session summaries and longitudinal trends.

We collect this only after you have given opt in consent, and only for the purposes you consented to. See the section titled "Neurophysiological Data".

4.2 Session and training information#

Session start and end times, duration, protocol or training mode used, target settings, lens response events, adherence and streak information, and any notes or ratings you add yourself.

4.3 Account and profile information#

Name, email address, password credential, and the profile details you choose to provide such as date of birth, training goals and preferences. Where a trainee is added to an account, the trainee's first name or nickname and age.

4.4 Purchase, warranty and support information#

Order records, items purchased, shipping details, warranty and return records, and the content of your support correspondence.

We do not receive or store full payment card numbers. Payments are processed by our payment processor. We receive a confirmation, the card brand and the last four digits.

4.5 Device and technical information#

Sensor Device model, serial number and firmware version, mobile or desktop operating system and version, app version, Bluetooth pairing and connection diagnostics, crash reports, and IP address.

4.6 Website and app usage information#

Pages viewed, referring page, interactions, and similar analytics information. This is governed by the Cookie Notice and by your consent choices.

4.7 What we do not collect#

We want to be as clear about the absences as about the presences.

• We do not collect precise geolocation. The Apps do not request location permission for the training experience, with one exception that Android imposes: on Android 10 and 11, Android lets an app scan for Bluetooth devices only if it holds location permission, so our Android apps ask for it on those versions, solely to find your headband, glasses and sensors. They never read, store or send your location. On Android 12 and later they do not ask for it.
• We do not use geofencing. We make an unconditional commitment never to place a geofence around any health care facility. This is set out in full in the Consumer Health Data Privacy Policy.
• We do not collect audio or video from your device.
• We do not read your contacts, photos, calendar or messages.
• We do not use EEG for identification or authentication. Narbis has never used a brain signal as a biometric identifier and does not intend to. If that ever changes it will require a new, separate consent and a material update to this policy.
• In the experience used by a trainee under 13, we do not run third party analytics, crash reporting or advertising software of any kind.

5. Why we use it#

We do not use your information for automated decisions that produce legal or similarly significant effects about you. The feedback the product gives you is not a decision about you; it is a measurement shown back to you.

6. Neurophysiological Data#

This is the section that matters.

6.1 We treat it as sensitive, everywhere#

Neurophysiological Data is sensitive personal information. It is treated as such under the laws of a growing number of jurisdictions, and we apply that treatment globally rather than only where a statute compels it.

Specifically, and without limiting the above:

• It is neural data and therefore sensitive data under the Colorado Privacy Act as amended, the Connecticut Data Privacy Act as amended, and, from 1 January 2027, the Delaware Personal Data Privacy Act as amended.
• It is sensitive personal information under the California Consumer Privacy Act as amended.
• It is neurotechnology data under the Montana Genetic Information Privacy Act as amended.
• It is consumer health data under the Washington My Health My Data Act, Nevada law, Connecticut law and California law. See the separate Consumer Health Data Privacy Policy.
• It would be special category data under the UK and EU General Data Protection Regulations, as health data and, where it could enable identification, as biometric data. We do not offer our products in those territories, but we have kept that standard as our design baseline anyway, because it is the strictest one and we would rather build to it.

We have deliberately built to the strictest of these rather than to a patchwork. Where one jurisdiction demands per purpose, per recipient consent, everyone gets per purpose, per recipient consent.

6.2 Consent#

We collect Neurophysiological Data only after you give consent, and that consent is:

• opt in, given by a clear affirmative act;
• obtained before collection begins, not after;
• granular by purpose, so that consenting to training does not consent you to research;
• separate for collection and for sharing, because those are two different things;
• specific as to recipient, so that where we ask to share with a third party we name that third party rather than describing a category;
• not a condition of using the product, except where the processing is genuinely necessary to deliver the feature you asked for; and
• as easy to withdraw as it was to give, from a single screen in the Apps.

Consent is never obtained by your acceptance of our terms of service, by continued use, by hovering, by muting, by closing a dialog, by a pre ticked box, or by any interface designed to make agreeing easier than declining.

Withdrawing consent stops future collection for that purpose. It does not make past lawful processing unlawful. If you want past data deleted as well, ask us and we will delete it.

6.3 We do not sell it#

We do not sell Neurophysiological Data. There is no qualification on that sentence, no "except with your permission", and no carve out for affiliates.

We want to be transparent about why. Selling it would be lawful in principle if we obtained a signed authorization from you, retained that authorization for six years under Washington law, and obtained a separate authorization under Nevada law that would expire after twelve months. We have not built any of that, because we do not intend to sell your brain and cardiac data and we would rather say so plainly than leave ourselves room.

A transfer of the business, such as a merger or an acquisition, is not a sale of data in this sense, but we treat it carefully: see the section titled "Business transfers".

6.4 We do not use it for advertising#

Neurophysiological Data is never used to target advertising to you, is never shared with an advertising network, an ad technology vendor or a data broker, and is never used to build or enrich an advertising profile. No advertising or attribution software in the Apps has access to it.

6.5 Sharing#

We share Neurophysiological Data only in these situations:

1. With your Practitioner, where you have chosen to train under a Practitioner's supervision, and only with that Practitioner and the personnel they authorize.
2. With a subprocessor that hosts or processes it for us, under a written contract that binds them to these protections and permits them no independent use. The current list of subprocessors is published at narbis.com/legal/subprocessors.
3. With a specific third party you have separately consented to, named at the time we ask.
4. Where we are legally compelled, and then only to the extent compelled. Where the request relates to Neurophysiological Data we require valid legal process, which for Montana residents means a search warrant or an investigative subpoena supported by probable cause, and we apply that same standard to everyone. We will notify you unless we are legally prohibited from doing so.
5. Where necessary to protect life, in a genuine emergency involving a risk of serious harm.

That list is exhaustive.

6.6 Research and product improvement#

We would like to use aggregate patterns in the data to make the product better and to contribute to the science of neurofeedback and heart rate variability training. We only do that if you opt in, and the opt in is a separate choice from everything else.

If you opt in:

• the data used is de-identified first, to the standard described below;
• it is used for algorithm improvement, feature development, and academic or clinical research;
• we do not share identifiable data with researchers, and we do not permit recipients to attempt re-identification; and
• you can withdraw at any time, which stops future use. Data already incorporated into a completed analysis cannot always be extracted from it, and we will tell you that plainly rather than promising otherwise.

If you do not opt in, none of this happens, and the product works exactly the same.

6.7 De-identification#

When we de-identify Neurophysiological Data we do it to the standard set out at 45 C.F.R. 164.514, by Safe Harbor or by Expert Determination. That is the HIPAA standard, and we apply it whether or not HIPAA applies to the data in question.

We further commit that:

• we will not attempt to re-identify de-identified data;
• we will contractually prohibit every recipient from attempting to re-identify it, and from sharing it onward without the same prohibition; and
• we will not combine de-identified data with other data in a way designed to make it identifiable again.

We say this because a weaker standard is common in this industry. Removing a name and an email address is pseudonymization, not de-identification, and a longitudinal brain signal is not made anonymous by deleting the contact details attached to it.

6.8 Biometric statutes#

We do not use Neural Data or Cardiac Data as a biometric identifier, do not derive a faceprint, voiceprint or retina or iris scan, and do not use any signal to identify or authenticate you. Should that ever change, we would obtain the separate written consent that laws including the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act require, publish a retention and destruction schedule, and update this policy before doing so.

6.9 Where it is stored#

Neurophysiological Data is held in cloud infrastructure under our control, encrypted in transit and at rest, with access restricted to the personnel for whom it is necessary. We do not store Neurophysiological Data in any country subject to comprehensive United States sanctions. Transfers outside the country where you live are described in the section titled "International transfers".

The practitioner estate and the direct to consumer estate are kept logically and contractually separate. Data collected under a Practitioner's supervision does not flow into our consumer data set, and consumer data does not flow into the practitioner environment.

7. When we share other information, and with whom#

Outside Neurophysiological Data, which is governed by the section above, we share personal information as follows.

Each service provider acts on our instructions under a written contract, may not use your information for its own purposes, and is bound to confidentiality and security obligations. The current list of subprocessors, naming each specifically, is published at narbis.com/legal/subprocessors, and we will give notice before adding a new one that handles Neurophysiological Data.

Business transfers. If Narbis is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction. If that happens we will give you notice, the acquirer will be bound by commitments no less protective than those in this policy for Neurophysiological Data, and if you do not want your Neurophysiological Data to transfer you will be able to delete it first.

We do not sell or share personal information for cross context behavioral advertising, as those terms are defined under California law, and we have no financial incentive programs involving personal information.

8. How long we keep things#

Indefinite retention is not acceptable to us and, for children's data, is prohibited outright by law. These are the periods we apply.

You can delete your data at any time without waiting for these periods to run. If you close your account we will delete on the schedule above, and you can ask us to delete sooner.

Where we are required to retain something to comply with a legal obligation or to establish, exercise or defend a legal claim, we retain only what is necessary for that purpose, isolate it, and delete it when the purpose ends.

9. Security#

We protect Neurophysiological Data with encryption in transit and at rest, access controls that restrict access to the personnel for whom it is necessary, multi factor authentication on administrative access, logging and monitoring, and a documented incident response process. We maintain a written information security program, review it at least annually, and carry out risk assessments when we make material changes to how data is processed.

No system is perfectly secure, and we will not claim otherwise. What we will do is tell you promptly if something goes wrong. Where a breach affects your Neurophysiological Data or other sensitive information we will notify you and the relevant regulators within the timeframes the law requires, and we will tell you what happened, what data was involved and what we are doing about it.

If you believe you have found a security vulnerability, please write to info@narbis.com. We will not pursue legal action against good faith security research conducted under responsible disclosure.

10. Children and trainees#

Narbis products can be used by children, and the law takes that seriously. So do we.

Only an adult aged 18 or over may create a Narbis account and agree to our terms. An account holder may add a trainee aged 6 or over to their account.

• Where the trainee is under 13, we obtain verifiable parental consent from the account holder before any Neurophysiological Data is collected from the trainee. A parent controlled account is not by itself verifiable parental consent, so we use a consent method reasonably calculated to confirm that the person consenting is the parent or legal guardian.
• Consent to operate the product for a child is separate from any consent to disclose a child's information to a third party. We do not bundle them, because bundled consent is not permitted.
• Where the trainee is in the European Economic Area or the United Kingdom and is under the age of digital consent in their country, which ranges from 13 to 16, we obtain and take reasonable steps to verify consent from the holder of parental responsibility.
• Where the trainee is in Quebec and is under 14, we obtain parental consent.
• Compatible third party sensors are subject to their own manufacturer's minimum age requirement, which may be higher than the Narbis minimum. Where a manufacturer sets a higher minimum age, that higher age applies to any use of that device with a Narbis product, and we do not permit a trainee below that age to pair it. The third party sensors we support are the Polar H10, Polar H9, Polar Verity Sense and COOSPO HW807 heart rate sensors, and the Muse 2 and Muse S EEG headbands.

Where to check a sensor's own age requirement. We deliberately do not restate another manufacturer's minimum age here, because those change and a number copied into our policy would eventually be wrong. Check the manufacturer's own terms, which govern:

• Muse EEG headbands: the legal terms published by InteraXon at choosemuse.com/pages/legal
• Polar heart rate sensors: the terms published by Polar Electro at polar.com
• COOSPO heart rate sensors: the terms published by COOSPO at coospo.com

If a manufacturer's minimum is higher than ours, theirs applies, and we will not let a trainee below that age pair that device.

The under 13 experience contains no third party analytics, crash reporting or advertising software of any kind. That is the simplest way to be certain a child's data is not going anywhere it should not, and it is the design we have chosen.

Children's data retention. Raw signal from a trainee under 13 is retained for 12 months. All data relating to that trainee is deleted within 90 days of account closure. We do not retain a child's personal information indefinitely for any purpose.

Children's data security. We maintain a written security program specific to children's information, with designated responsible personnel, an annual risk assessment, documented safeguards and an annual review.

A parent or guardian may at any time review the personal information we hold about their child, refuse to permit its further collection or use, and require its deletion. Write to info@narbis.com.

11. Your rights#

11.1 Rights everyone has, wherever you live#

We extend these to all users, not only to those whose local law compels it.

• Know and access. Ask what we hold about you and get a copy in a portable format.
• Correct. Have inaccurate information fixed.
• Delete. Have your information deleted. There is a dedicated page for this, titled "Delete my data", which works without signing in and without the app installed.
• Withdraw consent. For anything you consented to, at any time, as easily as you gave it.
• Opt out. Of marketing communications, of analytics, and of research use.
• Portability. Export your session history and Derived Metrics in a machine readable format. This is a product feature, not a favor.
• Non discrimination. We will not deny you service, charge you a different price or give you a lesser experience because you exercised a right. The only exception is where a feature genuinely cannot work without the data, in which case we will tell you which feature and why.
• Appeal. If we decline a request, you may appeal, and a person not involved in the original decision will review it.

How to exercise them. Write to info@narbis.com, or use the privacy controls in the Apps. For deletion specifically, see the page titled "Delete my data". We will acknowledge within 10 days and respond within 45 days. If we need more time we will tell you why and take up to a further 45 days. There is no charge unless a request is manifestly unfounded or excessive, and we will tell you before charging anything.

Authorized agents. You may use an authorized agent. We will ask for proof of authorization and may ask you to verify your identity directly.

Verification. We verify requests before acting on them, because handing Neurophysiological Data to the wrong person would be worse than not handing it over at all. Usually this means confirming control of the email address on the account.

11.2 Universal opt out signals#

We honor the Global Privacy Control and treat it as a valid opt out of sale and of sharing for targeted advertising. Since we do not sell or share for targeted advertising in any event, this changes nothing about our practices, but the signal is respected and recorded. We also honor Do Not Track headers.

11.3 If you live in the United States#

Depending on your state you may have rights under a comprehensive state privacy law, including the rights to confirm processing and access, correct, delete, obtain a portable copy, opt out of targeted advertising, sale and certain profiling, and limit the use of sensitive personal information. All of these are covered by the rights in the section titled "Rights everyone has, wherever you live", which we apply to everyone.

Some specifics worth stating:

California. Neurophysiological Data is sensitive personal information under the California Consumer Privacy Act. We use it only to deliver the service you asked for and for the purposes described in this policy, and never to infer characteristics about you for advertising. We do not sell or share personal information for cross context behavioral advertising, so no "Do Not Sell or Share My Personal Information" sale takes place, and the link we publish confirms that position. You may still ask us to limit the use of sensitive personal information and we will honor it. We do not use personal information for automated decision making that produces legal or similarly significant effects.

Washington, Nevada, Connecticut consumer health data. Your rights under the Washington My Health My Data Act, Nevada law and Connecticut law are set out in the separate Consumer Health Data Privacy Policy, which is linked from our homepage. Please read it. It includes your right to a list of every third party and affiliate with whom your consumer health data has been shared, together with contact information for each.

Colorado, Connecticut, Montana and, from 1 January 2027, Delaware. Neurophysiological Data is sensitive data in these states and we process it only with your opt in consent. For Montana residents, we obtain separate express consent for each of transfer to a named third party, use beyond the primary purpose, marketing, third party marketing and sale, we maintain a comprehensive written security program, and we require valid legal process supported by probable cause before disclosing neurotechnology data to law enforcement. We apply the Montana standard to everyone.

Texas. We do not sell sensitive personal information. Were that ever to change we would publish the notice Texas requires before doing so.

11.4 The European Economic Area, the United Kingdom and Switzerland#

We do not offer our products or services to people in the European Economic Area, the United Kingdom or Switzerland. Our store does not sell or ship to those territories, and our apps are not offered there. This has been our position since 1 October 2026.

If you bought from us before that date, nothing you already have is being taken away. We continue to honor your warranty and to support you. We are simply not taking new customers in those territories.

Your personal information runs down on the ordinary schedule in the section titled "How long we keep things", and you can ask us to delete it sooner at any time. Every right in the section titled "Rights everyone has, wherever you live" applies to you, including access, correction, deletion, portability and withdrawal of consent, because we extend those rights to everyone regardless of where they live rather than only where a statute compels it.

Why we made this choice, stated plainly. Serving those territories properly means appointing formal representatives in the Union and in the United Kingdom, and Switzerland has a separate requirement of its own. Those obligations are designed for companies with a much larger presence in Europe than we have. We would rather stop offering there than serve customers at a standard we could not maintain. If that changes, we will appoint representatives first and update this policy before we sell there again.

11.5 If you live in Canada#

We obtain express consent for the collection, use and disclosure of Neurophysiological Data, which is sensitive personal information under PIPEDA. You may withdraw consent, access your information and challenge its accuracy. We are transparent about processing and storage outside Canada, which is described in the section titled "International transfers". We maintain a breach register and report breaches presenting a real risk of significant harm as required.

If you live in Quebec, we have designated a person responsible for the protection of personal information, reachable at info@narbis.com. We carry out a privacy impact assessment before transferring personal information outside Quebec, obtain express consent for sensitive information, obtain parental consent for anyone under 14, and will inform you on request of the personal information we hold and how it is being used.

Narbis Edge is offered in Canada. The Smart Glasses are offered internationally, other than in the European Economic Area, the United Kingdom and Switzerland.

12. Where your information is processed#

Narbis is established in the United States and personal information is processed there, in cloud infrastructure under our control.

We do not store Neurophysiological Data in any country subject to comprehensive United States sanctions.

Because we do not offer our products or services in the European Economic Area, the United Kingdom or Switzerland, we do not make the routine cross border transfers out of those territories that would otherwise require a specific transfer mechanism. Where we hold information about a customer who bought from us before 1 October 2026 and who lives in one of those territories, that information is held on the same terms as everyone else's and runs down on the schedule in the section titled "How long we keep things".

If you live in Canada, see the section titled "If you live in Canada".

13. If you train with a practitioner#

If a clinician, coach or other professional uses the Narbis Platform with you, the position is different and this policy is not the document that governs it.

In that arrangement your Practitioner decides what is collected about you and why, and holds the direct relationship with you. Narbis processes the data on their behalf and under their instructions. Where your Practitioner is a HIPAA covered entity, Narbis acts as a Business Associate and the Business Associate Agreement appended to the Narbis Practitioner Terms applies automatically. Under European terms, your Practitioner is the controller and Narbis is the processor.

Please read the document titled "Privacy Notice for End Users, Practitioner Context", and direct requests about your data to your Practitioner in the first instance. We will support them in answering you, and we will act directly where the law requires us to.

The commitments in the section titled "Neurophysiological Data" apply in the practitioner context as well. We do not sell End User data, we do not use it for advertising, and we use it for research or product improvement only where de-identified and only where permitted.

14. Cookies#

Cookies and similar technologies are described in the separate Cookie Notice. In short: consent is obtained by an affirmative act in a banner and never by continued browsing, and no Neurophysiological Data is ever collected by a cookie or used for advertising.

15. Changes to this policy#

We will update this policy as the product and the law change. Where a change is material we will give notice before it takes effect, by email or in the Apps, and where the change affects how we handle Neurophysiological Data we will ask for fresh consent rather than relying on your silence.

Previous versions are archived at narbis.com/legal/archive so that you can see what changed and when.

16. How to reach us#

How to reach us
Email: info@narbis.com
Web: narbis.com/contact

One mailbox handles everything. To help us route your message quickly, please begin your subject line with one of these words where it applies: Privacy, Legal, Practitioner, Security or Appeal. We read everything either way.

If you are not satisfied with our response you may complain to your data protection authority, your state attorney general, or the Federal Trade Commission, and we would ask that you also tell us, because we would rather fix it.