Privacy Policy - Beyond Brain Health

This policy describes how Beyond Brain Health collects, uses, stores, and protects your personal and health data. Because we handle sensitive neurologic health information, this policy requires qualified legal review before launch.

Data we collect

Account information: name, email address, password (hashed)
Assessment responses: your answers to NSRI and PSNRI questions
Score data: computed scores, domain breakdowns, flags
Surgical information: surgery date, type (if provided)
Payment information: processed by Stripe; card data is never stored on our servers
Usage data: pages visited, assessment completion timestamps

How we use your data

To deliver your assessment scores and reports
To generate clinical narratives via the Claude API (Anthropic)
To send transactional emails (assessment completion, subscription receipts)
To process subscription payments via Stripe
To improve the platform (aggregated, anonymized analytics only)

Data storage and security

Your data is stored on Hetzner servers located in the European Union. Access is restricted to authenticated users and authorized staff. We use encrypted connections (TLS) for all data in transit.

Third-party services

Stripe - Payment processing. Stripe's privacy policy applies to payment data.
Anthropic (Claude API) - Report narrative generation. Assessment data may be sent to the Claude API to generate your full report.
Hetzner - Infrastructure and storage provider.
Mailtrap / SMTP - Transactional email delivery.

HIPAA and GDPR

[PLACEHOLDER - HIPAA applicability analysis, BAA requirements, and GDPR data subject rights (access, rectification, erasure, portability) to be drafted by qualified legal and compliance counsel. This section is CRITICAL and must not be left as placeholder before launch.]

Your rights

[PLACEHOLDER - Data subject rights under applicable law to be enumerated here by legal counsel.]

Contact

For privacy inquiries: [email protected]