Privacy Policy
Neuropsych ("we," "us," "our") operates the website neuropsych.io. This policy explains what data we collect, why, how we store it, and your rights.
1. What We Collect
| Data | When | Why |
|---|---|---|
| Email address | Account creation | Authentication, account recovery |
| Display name | Account creation (optional) | Personalization |
| Date of birth | Post-signup onboarding | Age-matched normative comparisons |
| Gender | Post-signup onboarding | Gender-stratified normative data |
| Test responses | During assessments | Scoring, profile generation, research |
| Newsletter email | Footer subscription | Product updates delivered by our email service provider |
| Consent record | First acceptance before a test | Recording the consent version and acceptance time |
| Usage events | While you use the site | Understanding what gets used, diagnosing problems |
| Device and measurement context | Page views, test starts, saved results | Reliable interpretation of timing-sensitive tests |
When you first accept the consent screen, we store the consent version and acceptance time. If you are signed in, the record may be linked to your account. We do not send your browser's exact user-agent string as part of this consent record.
The device and measurement context is a small technical snapshot that your browser declares: screen size, pixel density and refresh rate, touch or keyboard input, coarse memory and processor capacity, network quality category, battery level, and a yes-or-no flag for whether the page is running inside another app's built-in browser. Cognitive tests are timing-sensitive, so this context is stored alongside results to help interpret them correctly. To derive that last flag, the site may inspect the browser's user-agent string in memory and then discard it. The exact user-agent string and user-agent client hints are not stored in this context. The snapshot contains no identity, no location, and nothing else from your device.
We do not collect: real names (unless you enter one), physical addresses, phone numbers, payment card details (no payments yet), IP addresses, precise location, or anything on your device outside the tests themselves (no contacts, files, photos, or browsing history).
2. How We Use Your Data
- Assessment scoring: Your test responses are processed to generate cognitive domain scores and, if requested, a Cognitive Profile Report.
- Normative comparisons: Your age and gender are used solely to compare your scores against published normative datasets (e.g., NEURONORMA, WAIS-V norms).
- Measurement context: Device characteristics (for example, touch versus keyboard input, or the screen's refresh rate) are stored with your results so timing-sensitive scores can be interpreted correctly and technical problems can be diagnosed.
- Research (aggregate only): De-identified, aggregate data may be used to develop normative benchmarks. Individual data is never shared without explicit consent.
- Communication: We use Resend to deliver transactional messages and, if you subscribe, periodic updates about new tests and validation studies. Resend receives the minimum email data needed to deliver and monitor those messages, as described below.
3. Anonymous Users
You can take one test without creating an account. Anonymous test results are stored only in your browser's localStorage and are not sent to our servers; if you clear your browser data, these results are permanently lost. Like every visit, anonymous sessions generate basic usage events (pages viewed, tests started, device context) tied to a random session identifier. These contain no identity, and we have no way to connect them to you or contact you.
4. Where Data Is Stored
- Authentication and user data: Supabase (hosted on AWS, US region). Encrypted at rest (AES-256) and in transit (TLS 1.2+).
- Website hosting: Cloudflare Pages (global CDN). No server-side data processing beyond static file delivery.
- Email delivery: Resend processes the recipient address, sender, subject, and transactional or subscribed-update message content needed to deliver email. It also returns operational events such as sent, delivered, delayed, bounced, complained, suppressed, and opened.
- AI Report generation: When you request a Cognitive Profile Report, your test scores (not personal identifiers) are processed by a locally-hosted AI model. Report content is stored in Supabase linked to your user ID.
5. Data Sharing
We do not sell or rent your personal data. We disclose it only to service providers needed to operate the platform, or when required by law.
The service providers with access to user data are:
- Supabase: Database and authentication provider. Subject to their privacy policy.
- Resend: Email delivery provider. Resend receives the email information described above and processes it under its privacy policy. We do not send Resend your test responses, cognitive scores, report content, date of birth, or clinical data.
- Google OAuth: If you sign in with Google, Google provides us your email and profile picture. We do not receive your Google password or access any other Google data.
6. Data Retention
- Account data is retained as long as your account exists.
- Test results are retained as long as your account exists.
- Newsletter subscriptions are retained until you unsubscribe (email us at the address below).
- When you delete your account, all associated data (profile, test results, report requests) is permanently deleted within 30 days.
7. Your Rights
Regardless of where you live, you can:
- Access your data: View your profile and all test results at any time through the platform.
- Export your data: Request a full export of your data by emailing us.
- Delete your data: Delete your account from the Profile menu. This is immediate and irreversible.
- Correct your data: Update your profile information at any time.
- Withdraw consent: Stop using the platform at any time. Your existing data will be retained unless you delete your account.
If you are in the EU/EEA, you have additional rights under GDPR including the right to lodge a complaint with your local supervisory authority.
8. Children
Neuropsych is designed for adults (18+). We do not knowingly collect data from children under 16. If you believe a child has created an account, please contact us and we will delete it.
9. Cookies and Local Storage
We use:
- Authentication cookies: Set by Supabase to maintain your login session. These are strictly necessary and cannot be disabled.
- localStorage: Used to store anonymous test results, UI preferences, and session cache. No tracking or analytics cookies are used.
We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts.
10. Security
We implement industry-standard security measures including:
- TLS encryption for all data in transit
- AES-256 encryption at rest (Supabase/AWS)
- Row-level security policies restricting data access to the owning user
- No plaintext storage of passwords (handled by Supabase Auth with bcrypt)
Neuropsych is not HIPAA-compliant. It is a cognitive screening tool, not a covered healthcare entity. If you are a healthcare provider considering clinical use, please contact us to discuss requirements.
11. Changes to This Policy
We may update this policy as our platform evolves. Material changes will be communicated via a banner on the website. The "Last updated" date at the top reflects the most recent revision.
12. Contact
For privacy inquiries, data export requests, or concerns:
Email: [email protected]
Website: neuropsych.io