Privacy Policy

Heart-Brain Connect Live · Last updated: September 2026

1. Who is responsible

Brainclinics Heart-Brain Group B.V., Bijleveldsingel 32, 6524 AD Nijmegen, The Netherlands (KvK 94388784) is the controller for the personal data described in this policy. Questions: info@brainclinics.com.

2. What we collect, and why

• Account data — your name, e-mail address and password (stored only as a hash). Used to create and secure your account and to contact you about it. Basis: performance of our contract with you.
• Billing data — your subscription status, invoices and coupon use. Card details are entered on Stripe's pages and held by Stripe, not by us. Basis: contract, and our legal obligation to keep invoices for 7 years.
• Device data — an identifier of each computer the app runs on, its operating system and the app version. Used to enforce the two-computer limit and to help you with support questions. Basis: contract and our legitimate interest in preventing account sharing.
• Usage statistics — when the app is used: the start and end of a session, its duration, the mode (live, replay, import), the preset chosen, and whether the Bluetooth connection succeeded. Linked to your account, never to the content of a session. Used to understand how the product is used and to improve it. Basis: our legitimate interest.
• Technical logs — IP address, time and requested page when you use the website or when the app contacts our server. Used to keep the Service secure and to detect abuse. Basis: legitimate interest. Kept for 90 days.
• Support correspondence — what you send us at info@brainclinics.com. Basis: legitimate interest in answering you.

What we never collect: your ECG, heart-rate or HBC data, and your recordings and reports. These stay on your computer and are never sent to us.

3. Who receives your data

We use these processors, who act on our instructions: Stripe Payments Europe Ltd. (payments and invoicing; Stripe may transfer data to the United States under the EU Standard Contractual Clauses), Microsoft Ireland Operations Ltd. (e-mail, Microsoft 365), and our hosting provider Rootnet B.V., the Netherlands. We do not sell personal data and do not use it for advertising.

4. How long we keep it

Account, device and usage data: while your account exists and for 30 days after you delete it. Invoices: 7 years (tax law). Technical logs: 90 days. Statistics that no longer identify anyone may be kept indefinitely.

5. Your rights

You can access, correct, download or delete your data, restrict or object to its processing, and delete your account yourself from your account page. Write to info@brainclinics.com for anything you cannot do there; we respond within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

6. Cookies

The website uses only strictly necessary cookies (your login session and security tokens). We do not use tracking, analytics or advertising cookies.

7. Security

Data is encrypted in transit (HTTPS), passwords are stored as salted hashes, access is limited to staff who need it, and the database is backed up daily.

8. Age

The Service is for adults. We do not knowingly collect data from anyone under 18.

9. Changes

We may update this policy; material changes are announced by e-mail before they take effect.