1. What this page is#
Narbis uses a small number of service providers to run the product. Some of them process personal information on our behalf. This page names each of them specifically.
We publish this because our Privacy Policy, our Consumer Health Data Privacy Policy and the Business Associate Agreement in our Practitioner Terms all promise it, and because Washington law requires us to be able to tell you not just the categories of recipient but the specific affiliates and third parties who have your consumer health data.
Every provider listed here acts on our instructions under a written contract, may not use your information for its own purposes, and is bound to confidentiality and security obligations. Where a provider may handle Protected Health Information from the practitioner channel, we have a Business Associate Agreement with them as well.
None of these providers is permitted to sell your data, use it for advertising, or use it to train their own models on identifiable Narbis data.
2. Who processes what#
Narbis runs two platforms and they use different infrastructure. This page names the providers for both.
| Provider | What they do for us | What they may process | Where | BAA | Status |
|---|---|---|---|---|---|
| Microsoft Corporation, Microsoft Azure | Cloud hosting, the SQL database and the application programming interface behind the Narbis neurofeedback Smart Glasses platform | Account data, session data, Neural Data | United States | Required | STATED |
| Access IT Automation Ltd | Builds and administers the Azure database and the application programming interface on our behalf | Administrative access to everything held in that database, including Neural Data | United Kingdom, administering infrastructure located in the United States | Required | STATED |
| Cloudflare, Inc. | Platform hosting for the Narbis Edge platform | Account data, session data, Cardiac Data, Derived Metrics | United States | Required | STATED |
| Google LLC, Google Sign In | Account authentication for both platforms | Your email address and an account identifier. No Neurophysiological Data | United States | Required if it touches practitioner data | STATED |
| Google Analytics | Website analytics, consent gated | Usage data only. Never Neurophysiological Data | United States | Not applicable | EVIDENCED |
| Google Fonts | Web font delivery on narbis.com | IP address and browser data of site visitors | United States | Not applicable | EVIDENCED |
| WP Engine | Website hosting for narbis.com | Website usage data, server logs | United States | Not applicable | EVIDENCED |
| Shopify | Online store and order management for narbis.shop | Name, contact, order and shipping details | United States and Canada | Not applicable | EVIDENCED |
| Stripe | Payment processing for the store | Payment details, which we never see in full | United States | Not applicable | EVIDENCED |
| Intuit Mailchimp | Email marketing and list management | Name, email, subscription preferences | United States | Not applicable | EVIDENCED |
| Zoho | Contact form handling on narbis.com | Name, email, the content of your message | United States | Not applicable | EVIDENCED |
| Automattic, Akismet | Comment and form spam filtering | IP address and submitted form content | United States | Not applicable | EVIDENCED |
| The shipping carrier for your order | Delivery of hardware. The carrier used is named in your shipping confirmation | Name, delivery address, contact | Varies by destination | Not applicable | EVIDENCED |
| Google LLC, Google Workspace | Carries our email, including account verification, deletion verification and similar automated messages, and the support mailbox | Your email address and the content of your correspondence with us | United States | Required if practitioner correspondence reaches it | STATED |
| Apple, Push Notification service, and Google, Firebase Cloud Messaging | Delivery of push notifications to your device | A device token and the notification text. Notification text never contains Neurophysiological Data | United States | Not applicable | Not currently in use. Listed because push notifications are planned. The row stays here so it is not added quietly later |
On where your data actually sits. Data from the neurofeedback Smart Glasses is held on your device and in the Azure database. Data from the Narbis Edge platform is held on your device and on Cloudflare. Neither platform sends your Neurophysiological Data to the other.
No artificial intelligence or inference service receives your data#
No Narbis service sends Neural Data, Cardiac Data or Derived Metrics to any third party artificial intelligence service, machine learning platform, inference API or model provider. Not for processing, not for analysis, not for training, not for evaluation. The analysis that produces your Derived Metrics runs on our own infrastructure.
If that ever changes, the provider is named on this page before any data reaches it, and because it would be a recipient not previously disclosed, we obtain fresh consent before it does.
We also use no third party crash or performance monitoring service. Error reports are generated in the App and sent to a Narbis mailbox. We use no feature flag or A/B testing service in the Apps.
3. What is not on this page, and why#
Apple and Google, as app stores. They distribute our apps and process subscription payments under their own terms. They are not our subprocessors and we do not send them your Neurophysiological Data.
Third party sensor manufacturers. Polar, COOSPO and InteraXon make devices we support. Where you use one, your relationship on that device is with them, under their own terms and privacy policy. We receive the signal through your device, not from them.
Your practitioner. If you train under a practitioner, they are not our subprocessor. The relationship runs the other way: they decide what is collected and we process it for them. See the Practitioner Terms and the Privacy Notice for End Users, Practitioner Context.
4. Changes#
We will update this page before adding a new provider that will handle Neurophysiological Data, and we will give notice of that change as our Privacy Policy describes. Practitioners may object to a new subprocessor on reasonable data protection grounds under the Business Associate Agreement.
5. How to reach us#
How to reach us
Email: info@narbis.com
Web: narbis.com/contact
One mailbox handles everything. To help us route your message quickly, please begin your subject line with one of these words where it applies: Privacy, Legal, Practitioner, Security or Appeal. We read everything either way.