Privacy Policy (MindReveal iOS App)

Version: 2026-03-20

Effective Date: March 20, 2026

Last Updated: March 20, 2026

1. Scope

This Privacy Policy explains how MindReveal collects, uses, stores, shares, and protects personal data when you use the MindReveal iOS app and related research services.

This policy applies to data processed through the App, including onboarding details, questionnaire responses, cognitive task outputs, and sensor-derived telemetry used for ADHD-focused research.

2. Data Controller and Contact

CerebrumAI Ltd is the service operator and data controller for MindReveal.

Contact for privacy and data rights requests: support@mindreveal.ai

3. Categories of Data We Collect

3.1 Profile and onboarding data

• First name
• Email address
• Date of birth
• Sex
• Country code
• ADHD diagnosis status (yes/no)
• Terms acceptance flag, version identifiers, and acceptance timestamp

3.2 Questionnaire data

• Questionnaire type (adult or youth)
• Encoded questionnaire responses
• Completion action (submitted or skipped)
• Questionnaire completion timestamp
• App version metadata

3.3 Cognitive task and telemetry data

The App records task-level telemetry and summary files including:

• Task event timing and interaction events
• Touch interaction features (for example, movement, timing, and tap context)
• Motion sensor channels (accelerometer, gyroscope, device motion)
• Face-derived metrics (for example, face detection, gaze vectors, blink metrics, head pose)
• Emotion blend-shape coefficients derived from face tracking
• Audio activity metrics (for example, amplitude, decibel level, speech start/end transitions)
• Device/app context (for example, timezone, app version, build number, locale, OS major version)
• Integrity and reconciliation diagnostics used for research quality controls

The App's telemetry implementation stores structured numeric/boolean channels and event metadata. It does not intentionally store raw camera video or raw microphone audio waveform media files.

3.4 Identity and session metadata

• Pseudonymous backend account identifier
• Participant IDs and app/session/task IDs generated by the App
• Backend upload and integrity metadata

4. Why We Process Data

We process personal data to:

• Operate the App and provide study participation workflows,
• Run cognitive research and build statistical/ML models,
• Maintain data quality, integrity, and anti-abuse controls,
• Improve product performance and user safety,
• Comply with legal obligations and enforce our Terms.

5. Legal Bases (GDPR/UK GDPR)

Depending on context, we rely on:

• Consent (for participation and sensitive telemetry collection flows),
• Legitimate interests (research integrity, security, product quality),
• Contract/performance of service (providing App functionality you request),
• Legal obligation (recordkeeping, compliance, lawful requests).

Where consent is required by law, you may withdraw it at any time by discontinuing use and contacting support@mindreveal.ai for data-handling requests.

6. Sensitive and Youth Considerations

The App is intended for users aged 13 and above. If we become aware that ineligible data was collected in violation of policy, we will take steps to remove or restrict such data as appropriate.

Some telemetry and profile data may be treated as sensitive under certain laws. We apply additional controls for security, access limitation, and research governance.

7. Retention

We retain personal data for as long as reasonably necessary for research purposes, model validation, operational integrity, and legal obligations. Retention can vary by data type and jurisdiction.

We may delete or de-identify data earlier when:

• It is no longer needed for the stated purposes,
• Storage or legal obligations no longer require retention,
• A valid deletion request is completed (subject to legal exceptions).

Local on-device telemetry artifacts are temporary and may be purged after upload or on subsequent app launch cleanup flows.

8. Data Sharing and Recipients

We may share data with:

• Infrastructure, authentication, database, and storage service providers,
• Research and analytics processors acting under contract,
• Legal/regulatory authorities when required by law,
• Successors in a merger, acquisition, or asset transfer (subject to applicable law).

We do not sell personal data for monetary consideration.

9. International Transfers

Your data may be processed in countries outside your own jurisdiction. Where legally required, we use appropriate safeguards (for example, contractual protections and security controls) for cross-border transfers.

10. Security Measures

CerebrumAI Ltd uses administrative, technical, and organizational safeguards, including:

• Authenticated backend sessions,
• Access controls and least-privilege practices,
• Transport and storage safeguards provided by infrastructure vendors,
• Telemetry integrity checks and audit metadata.

No system is perfectly secure, and we cannot guarantee absolute security.

11. Your Privacy Rights

Depending on your location, you may have rights to:

• Access personal data,
• Correct inaccurate data,
• Delete data,
• Restrict or object to certain processing,
• Data portability,
• Withdraw consent where consent is the legal basis,
• Lodge a complaint with a supervisory authority.

US state privacy rights (including California) may include rights to know, delete, correct, and opt out of certain sharing contexts where applicable.

To exercise rights, contact support@mindreveal.ai. We may need to verify your identity before completing requests.

12. Automated Processing

MindReveal may use statistical and machine-learning methods on collected telemetry and task data for research and product improvement. These outputs are intended for research and are not clinical diagnoses.

13. Policy Updates

We may update this Privacy Policy to reflect legal, technical, or research changes. Updated versions will be published in-app with updated version metadata and dates.

14. Contact

Privacy and data rights contact: support@mindreveal.ai