Privacy Policy

---

Brainmark Privacy Policy

Last updated: June 15, 2025

At Brainmark, your privacy and the security of your data are our highest priorities. This Privacy Policy outlines how we collect, use, protect, and share your personal information, in accordance with the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA) for individuals in the United States.

1-Who we are

Brainmark is a predictive health system that provides rapid physiological, mental, and sleep assessments for individuals and organizations. We operate with offices in Canada, the European Union, and the United States. For U.S.-based users, we comply with applicable federal and state health privacy laws, including HIPAA.

2-What data we collect

a. Personal Identifiable Information (PII)

• Full name
   
• Email address
   
• Date of birth or age range
   
• Gender (optional)
   
• Employer or organization (if applicable)
   

b. Protected Health Information (PHI) – U.S. users (HIPAA)

• Biometric health data (e.g., heart rate variability, electrodermal activity)
   
• Sleep and fatigue metrics
   
• Cognitive and mental performance indicators
   
• Data generated through or linked to healthcare providers
   

c. Technical Data

• Device or sensor identifiers
   
• IP address and location (only with consent)
   

3. Why We Collect This Data

We collect data for the following purposes:

• To generate personalized health and performance assessments
   
• To support organizational health and well-being programs
   
• To assist in medical or psychological follow-up (with user consent)
   
• To improve our products and services through anonymized research
   
• To comply with legal or regulatory obligations (e.g., HIPAA, GDPR)
   

4. Legal Basis for Processing

We process personal and health data on the following bases:

• Consent (explicitly required for biometric and health-related data)
   
• Contractual obligation (to provide a service you request)
   
• Legitimate interest (for non-identifiable analytics and system improvement)
   
• Legal requirement (as per GDPR and HIPAA regulations)
   

5. HIPAA Compliance for U.S. Users

If you are a U.S. resident and your Brainmark assessment is provided through a covered entity (such as a hospital, employer healthcare plan, or licensed practitioner), the information we collect may be classified as Protected Health Information (PHI) under HIPAA.

Brainmark acts as a Business Associate in these cases and complies with all applicable HIPAA rules, including:

• Signing Business Associate Agreements (BAAs) with covered entities
   
• Implementing administrative, technical, and physical safeguards to protect PHI
   
• Limiting the use and disclosure of PHI to what is necessary for providing our service
   

We do not use or disclose PHI for marketing purposes or sell PHI to third parties.

6. How We Protect Your Data

We apply strict security measures to protect all personal and health-related information, including:

• End-to-end encryption (data in transit and at rest)
   
• Secure, GDPR- and HIPAA-compliant servers (located in the EU, Canada, and U.S.)
   
• Access control and audit logging
   
• Role-based permissions and staff training on privacy compliance
   

7. Data Sharing and Disclosure

We never sell your personal or health data. We may share information only in the following contexts:

• With healthcare providers, only with your explicit written consent
   
• With your employer or referring organization, only in aggregated and anonymized form
   
• With our IT service providers under signed Data Processing and HIPAA Business Associate Agreements
   
• With regulators or authorities if required by law
   

8. Your Privacy Rights

Under GDPR (EU residents):

• Right to access, correct, delete, or limit your personal data
   
• Right to withdraw consent at any time
   
• Right to data portability
   
• Right to lodge a complaint with your national Data Protection Authority
   

Under HIPAA (U.S. residents):

• Right to access and receive a copy of your PHI
   
• Right to request corrections to your health information
   
• Right to an accounting of disclosures
   
• Right to file a complaint with the U.S. Department of Health & Human Services
   

To exercise any of these rights, contact us at: contact@brainmark.ai

9. Data Retention

• We retain personal data for up to 5 years, unless you request earlier deletion.
   
• Anonymized data used for scientific or operational research may be retained indefinitely.
   
• PHI will be retained as required by law (typically 6 years under HIPAA).
   

10. Children’s Privacy

Brainmark assessments are not offered to individuals under 16 years of age without verifiable parental consent. We do not knowingly collect or process data from minors without proper authorization.

11. Changes to This Policy

This Privacy Policy may be updated periodically to reflect legal or operational changes. You will be notified via email or app notice when significant updates occur.

12. Contact Information

For any questions or concerns about your privacy:

Data Protection Officer
Brainmark | Leaders of Tomorrow Institute Inc.
Email: contact@brainmark.ai
Canada HQ: Vancouver, BC