Effective and last updated October 5, 2026
1. Who we are and what this policy covers
The Neurovirtual legal entity identified in your Organization's executed order or written research agreement provides its Cloud service. That entity must be identified before service access is provided. Contact info@neurovirtual.com for its identity and contact details, or to identify the entity responsible for an account, website, or support interaction. References in this policy to "Neurovirtual," "we," "us," or "our" refer to the responsible entity. This policy describes personal information used to operate Neurovirtual Cloud, its public website, and connected services. Sections 15 and 16 add information for the European Economic Area, the United Kingdom, Switzerland, and Canada.
2. Our role and your organization's role
We manage account, security, service administration, and support information for our own operational purposes. Your clinic, laboratory, or other organization determines why patient and study information is entered into Neurovirtual Cloud and who may use it. We process that information to provide the service under the organization's instructions and applicable agreements. Ask your organization about its patient privacy notice and the legal basis for its use of patient information. This policy does not replace that notice, a data processing agreement, a Business Associate Agreement (BAA), or research consent.
3. Information we handle
Account and access information includes names, email addresses, organization and site memberships, roles, password hashes, authentication credentials, security settings, and records of terms acceptance. Service content may include patient identifiers and demographics, physiological recordings, study details, annotations, scores, reports, schedules, referrals, and equipment records supplied by authorized users or connected devices. Technical information includes access and activity logs, IP addresses, browser or device information, timestamps, and diagnostic information. Support information includes requests, feedback, and any attachments you choose to provide. Business contact information includes your name, email address, organization, role, and messages when you contact us, request a demonstration, or schedule a meeting. Information comes from you, your organization, authorized colleagues, connected devices, and operation of the service.
4. How we use information
We use information to create and authenticate accounts; enforce organization and site permissions; store, display, transfer, and process studies; provide requested workflows and reports; maintain security and audit records; troubleshoot problems; respond to support requests, inquiries, and demonstration requests; and meet applicable contractual and legal duties.
Under Section 7.5 of the Terms of Use, we may also use properly de-identified or, where required, anonymized uploaded content and derived data for research, statistical analysis, and the development, training, testing, validation, benchmarking, and improvement of algorithms, models, products, and services. This can include information from recordings, study details, annotations, scores, reports, and associated metadata. We may commercialize resulting products and improvements and publish findings that do not identify individuals or disclose your organization's confidential information. Affiliates and contractors may perform this work on our behalf under equivalent confidentiality, security, and no-re-identification obligations.
These uses begin only after acceptance of the revised Terms and satisfaction of applicable legal and contractual requirements. Preparing de-identified data must itself be lawful and authorized, including under any required BAA or data processing agreement. We must not attempt to re-identify individuals. Replacing names with codes or aggregating records does not by itself meet the required standard. Acceptance of the Terms is not blanket consent to process personal information, authorize secondary use of identifiable health information, or enroll someone in research; any required notices, consents, and approvals remain necessary.
Under Section 7.10 of the Terms, we also prepare aggregated statistics about an Organization's diagnostic activity ("Network Insights"), such as monthly study volume, study type, severity category, and scoring criteria, and may share them with distribution, channel, and commercial partners. Network Insights identify the Organization but never include patient names, contact details, dates of birth, identifiers, recordings, signals, reports, or the results of an individual study. We withhold any statistic calculated from fewer studies than our minimum group size and require partners not to attempt to identify any individual. Preparing Network Insights is subject to the same legal and contractual requirements as the uses above.
5. Legal bases where applicable
Where data protection law requires a legal basis, account and service administration may rely on performance of a contract, legal obligations, or legitimate interests in operating and securing the service, subject to the protections required by law. Where consent is required for a distinct optional purpose, it must be requested separately and may be withdrawn for future processing. Your organization is responsible for establishing the necessary legal basis and any additional condition for processing health information. A contract or acceptance of these terms alone does not authorize all processing of health information. Sections 15 and 16 describe the legal bases and consent rules for Europe and Canada.
6. Who can receive information
Authorized members of your organization receive information according to their permissions. Railway provides hosting infrastructure for the current hosted service. Other service providers may process information needed for storage, delivery of service emails, security, maintenance, or support under appropriate instructions and agreements. If you schedule a demonstration through the public website's Portuguese-language scheduling link, Pipedrive processes the booking details you enter for us. Partners receive only Network Insights as described in Section 4. Your Organization can request the applicable provider list, processing locations, and transfer safeguards through the contact in Section 14 before supplying personal information. We may disclose information when legally required, to address security threats or protect legal rights, or in a business transfer subject to applicable safeguards. Organization administrators control invitations and access; avoid including unnecessary patient information in support requests.
7. Health information and research
Do not upload HIPAA-regulated protected health information unless Neurovirtual has expressly confirmed that the deployment is enabled for that use and the required customer and downstream BAAs and safeguards are in place. Otherwise, use data appropriately de-identified under applicable law. Research use alone does not remove privacy duties. Replacing names with codes may leave information identifiable; recordings, dates, metadata, and attachments also require review before upload. Your organization is responsible for required patient notices, research approvals, and consents. No statement in this policy represents that an investigational feature is cleared or approved for clinical use.
8. Storage locations and international transfers
Unless your Organization's agreement specifies another hosting region, Neurovirtual Cloud and its connected services store and process information in the United States, including for installations that serve customers in other countries. Neurovirtual group companies, including those in Brazil, Colombia, and Mexico, and our service providers may access information from the countries where they operate when needed to provide, support, or secure the service. Before using a deployment, your organization should confirm its hosting locations and any cross-border access. Where international-transfer restrictions apply, the relevant transfer mechanism and safeguards must be documented in the applicable service or data processing agreement. Sections 15 and 16 describe the safeguards for Europe and Canada.
9. Retention and deletion
Retention depends on the type of information, the organization's instructions, the service agreement, and applicable legal obligations. Relevant criteria include the period of active service, clinical recordkeeping duties, security and audit needs, dispute resolution, and backup expiry. Account closure does not necessarily erase records your organization must retain. Your organization can request available export and deletion arrangements. Data and results used under Section 7.5 of the Terms may be retained after account closure only while they remain lawfully de-identified or anonymized and retention is permitted by applicable law and controlling agreements. This does not override mandatory deletion rights or permit indefinite retention of identifiable source records for those purposes.
10. Security and your responsibilities
Neurovirtual Cloud limits access with organization and site permissions, authenticated sessions, and two-factor authentication, uses encrypted connections, and keeps audit records of access and changes. Security also depends on deployment configuration, organizational permissions, and user practices. Protect your credentials, use available account security features, share information only with authorized people, and report suspected unauthorized access promptly. No system can guarantee absolute security. Neurovirtual Cloud has not completed its own SOC 2 Type II examination. A hosting provider’s assurance report or HIPAA arrangement does not certify Neurovirtual or automatically establish compliance for the service. We remain responsible for the security and privacy duties that apply to our activities. If a security incident affects personal information we handle, we notify the affected Organization without undue delay and notify individuals and authorities where the law requires.
11. Cookies and device storage
Neurovirtual Cloud uses cookies only to authenticate requests, protect sign-in, and renew signed-in sessions; page scripts cannot read them. Access and sign-in cookies expire within 30 minutes. A renewal cookie ends when you close the browser or, if you choose to stay signed in, lasts up to seven days by default. Browser storage also supports session coordination, language and appearance preferences, dismissed notices, and local application state until you sign out, clear it, or the application replaces it. When enabled, local recording caches can store study data on your device; use trusted devices and your organization's security procedures.
The public website sets no cookies. During a visit, your browser keeps temporary navigation state. If you choose a language, the website stores that choice in your browser until you choose another language or clear the site's data in your browser settings. It does not look up your location and loads its fonts from Neurovirtual rather than a third-party font service. Choosing a demonstration link opens an email message or, in Portuguese, Pipedrive's scheduling page, which applies its own cookies and privacy terms.
We use cookies and device storage only where they are strictly necessary to provide a service you request or to remember a choice you make. Neurovirtual Cloud and the public website do not include advertising, analytics, or cross-site tracking technologies. Before introducing optional cookies or similar technologies, we will update this policy and ask for consent where the law requires it.
12. Your rights and choices
Depending on applicable law, you may have rights to access, correct, delete, restrict, object to processing of, or obtain a portable copy of your information, withdraw consent where processing relies on consent, and complain to a supervisory authority. These rights have limits and may require identity verification. For patient or study records controlled by your organization, contact that organization first; we will assist it as required by our agreements and law. For account, service administration, or support information, contact Neurovirtual through the contact channels in Section 14. Sections 15 and 16 describe additional rights and the authorities you can contact in Europe and Canada.
13. Age and automated outputs
Neurovirtual Cloud accounts are intended for adult professional and institutional users. Organizations may process records about younger patients only with the necessary authority and safeguards. Automated study outputs support the functions described in the Terms of Use; organizations remain responsible for lawful use, required oversight, and any additional notices about automated processing.
14. Changes and contact
We will update the date above and provide notice of material changes through the application or other appropriate channels. New processing requiring consent will require a separate choice; continued use or terms acceptance does not replace that consent. Send privacy requests, questions, or complaints to info@neurovirtual.com and identify your Organization and country so we can direct the request to the responsible Neurovirtual entity. Describe the right you wish to exercise; we may request proportionate information to verify your identity and locate the records. Report suspected security incidents to support@neurovirtual.com. Do not include patient records or other sensitive information in an initial email. These channels do not limit your right to complain to the competent data-protection authority.
15. Additional information for the European Economic Area, United Kingdom, and Switzerland
This section applies when the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, or the Swiss Federal Act on Data Protection (FADP) applies to our processing. It adds to the rest of this policy.
15.1 Controller and processor.
Neurovirtual is the controller of the account, security, service administration, support, business contact, and website information it uses for its own purposes. For patient and study information in Neurovirtual Cloud, your Organization is the controller and Neurovirtual is its processor. We process that information only on your Organization's documented instructions under a data processing agreement that meets Article 28 of the GDPR or the equivalent UK or Swiss requirements, and we refer individuals' requests about it to your Organization. Where we prepare De-Identified Data under Section 7.5 of the Terms or Network Insights under Section 7.10 for our own purposes, we are the controller of that preparation and its results.
15.2 Legal bases.
Under the GDPR and UK GDPR, we rely on the following legal bases.
Accounts, authentication, permissions, and requested features: performance of our contract with you and our legitimate interest in providing the service your Organization has engaged us to provide.
Security, audit records, troubleshooting, and preventing misuse: our legitimate interest in protecting users, patients, and the service, and compliance with legal obligations under EU, Member State, or UK law, including security duties.
Support, inquiries, and demonstration requests: steps you request before entering into a contract, performance of a contract, and our legitimate interest in responding to you and managing business relationships.
Terms acceptance records, legal compliance, and legal claims: compliance with legal obligations under EU, Member State, or UK law and our legitimate interest in establishing, exercising, or defending legal claims.
Public website delivery and a language choice you make: our legitimate interest in providing a secure, functional website.
Optional processing, such as electronic marketing where the law requires consent: your consent, which you may withdraw at any time without affecting earlier processing.
We prepare De-Identified Data or Network Insights from information covered by this section only where your Organization has authorized it in writing for a defined purpose and the result is anonymous under these laws. For that preparation, we rely on our legitimate interest in research, statistics, and improving our products and, for health information, on processing for scientific research or statistical purposes under Article 9(2)(j) of the GDPR and the applicable Member State law or Schedule 1, paragraph 4 of the UK Data Protection Act 2018. Where these conditions are not met, we do not use information covered by this section for those purposes. Pseudonymized data, including data in which names are replaced by codes, remains personal data. Acceptance of the Terms is not consent to this processing. Network Insights about an Organization run by a single practitioner may be personal data about that practitioner, who may object under Section 15.3. The FADP does not require a legal basis for each use; we process information in line with its principles and justify processing where it requires, including for research and statistics under Article 31(2)(e) of the FADP.
15.3 Legitimate interests and your right to object.
Where we rely on legitimate interests, we have balanced them against your interests, rights, and freedoms. You may ask us for information about that balancing. You may object at any time on grounds relating to your particular situation, and we will stop unless we demonstrate compelling legitimate grounds or need the information to establish, exercise, or defend legal claims. You may object to direct marketing at any time.
15.4 Information you must provide.
You must provide your name, email address, and Organization membership to create and use an account; without them, we cannot give you access. Other information is optional unless your Organization requires it for its work.
15.5 International transfers.
Neurovirtual and its hosting providers are located outside the EEA, the UK, and Switzerland, mainly in the United States. Neurovirtual group companies in Brazil, Colombia, and Mexico may also access information as described in Section 8. Transfers to the United States rely on an adequacy decision only when the recipient is certified under the EU-U.S. Data Privacy Framework, its UK Extension, or the Swiss-U.S. Data Privacy Framework. Transfers to Brazil may rely on the European Commission's adequacy decision for Brazil. For other transfers, we use the European Commission's standard contractual clauses, with the UK International Data Transfer Addendum or the adaptations Switzerland requires, and supplementary measures where needed. For patient and study information, these safeguards form part of your Organization's data processing agreement. You may request a copy of the relevant safeguards through the contact details in Section 14.
15.6 Retention.
We keep information for the periods described in Section 9. We keep business contact information while the business relationship continues and then delete or anonymize it unless the law requires longer retention.
15.7 Your rights.
Subject to the conditions and exceptions in the law, you may request access to your personal information, correction, erasure, restriction of processing, and a portable copy of information you provided where processing is automated and based on consent or contract. You may object as described in Section 15.3 and withdraw consent at any time. Under the FADP, you may also receive information about automated individual decisions and express your point of view. We respond within one month and may extend that period by up to two further months for complex or numerous requests; we will tell you if we do. For patient and study records, contact your Organization; we will assist it.
15.8 Automated decisions.
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Automated study analysis produces outputs for qualified professionals at your Organization to review. Your Organization decides whether and how to use them and is responsible for any notice to patients.
15.9 Device storage.
Under EU, UK, and Swiss rules on storing or accessing information on your device, storage that is strictly necessary to provide a service you request does not require consent. The cookies and storage described in Section 11 are limited to that purpose. We will ask for consent before using any other storage or access on your device.
15.10 Complaints.
You may complain to us first through the contact details in Section 14; we acknowledge complaints within 30 days and respond without undue delay. You may also lodge a complaint with a supervisory authority, in particular in the EEA country where you live or work or where an alleged infringement occurred, with the UK Information Commission (ICO), or with the Swiss Federal Data Protection and Information Commissioner (FDPIC). The European Data Protection Board lists EEA authorities at edpb.europa.eu.
16. Additional information for Canada
This section applies when the Personal Information Protection and Electronic Documents Act (PIPEDA) or a provincial privacy or health information law applies, including Quebec's Act respecting the protection of personal information in the private sector, the Personal Information Protection Acts of Alberta and British Columbia, and Ontario's Personal Health Information Protection Act (PHIPA). It adds to the rest of this policy.
16.1 Privacy Officer.
Our Privacy Officer is accountable for our compliance with Canadian privacy laws and is the person in charge of the protection of personal information under Quebec law. Contact the Privacy Officer at info@neurovirtual.com with "Privacy Officer" in the subject line, or by mail at Privacy Officer, Neurovirtual, 3303 W Commercial Blvd, Suite 100, Fort Lauderdale, FL 33309, USA. The Privacy Officer also answers questions about how our service providers outside Canada collect, use, disclose, or store personal information, and provides written information about our policies and practices for those service providers.
16.2 Our role for patient and study information.
Your Organization remains accountable for patient and study information, including as a health information custodian or trustee where provincial health information law applies. Neurovirtual acts as its service provider and, depending on the applicable health information law, its electronic service provider, agent, or information manager. We use that information only to provide the service under your Organization's instructions and applicable agreements, subject to Section 16.4, and refer individuals' requests about it to your Organization. Neurovirtual Cloud lets authorized users at your Organization schedule, store, review, score, and report sleep and EEG studies and share them with users your Organization authorizes. Section 10 describes the safeguards that protect this information.
16.3 Consent.
We collect, use, and disclose account, support, and business contact information with your consent, which may be implied by your use of the service or express where the information is sensitive, or as the law otherwise permits. Your Organization is responsible for obtaining any consent or other legal authority required for patient and study information. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; we will explain the consequences, such as being unable to provide an account.
16.4 De-identified information and Network Insights.
We prepare De-Identified Data under Section 7.5 of the Terms or Network Insights under Section 7.10 from information covered by this section only where your Organization has the authority to permit it, any required consent or other legal authority exists, and the preparation meets the controls the law requires. Information remains personal information while there is a serious possibility that it could identify an individual, alone or combined with other information. We do not attempt to re-identify individuals and require the same of anyone who receives this information. For information subject to Quebec law, anonymization follows the criteria and methods prescribed by regulation, including a re-identification risk analysis and a register, and we use anonymized information only for serious and legitimate purposes.
16.5 Storage outside Canada.
Unless your Organization's agreement specifies a Canadian hosting region, information for Canadian customers is stored and processed in the United States and may be accessed from the other countries described in Section 8. While outside Canada, it is subject to the laws of those countries and may be accessible to their courts, law enforcement, and national security authorities. We protect information we transfer outside Canada through contracts and safeguards that provide comparable protection and, before communicating personal information outside Quebec, assess the privacy implications as Quebec law requires.
16.6 Governance.
Our Privacy Officer approves and oversees our privacy policies and practices. We keep personal information for the periods described in Section 9, then destroy it securely or, where the law permits, anonymize it. Within Neurovirtual, only personnel whose roles require it can access personal information: support staff to handle your requests, engineering and security operations staff to maintain and secure the service, and privacy and legal staff to handle requests, complaints, and legal duties.
16.7 Technology and automated decisions.
We do not use technology with functions that locate or profile you, and the public website does not use cookies or location lookups. We do not make decisions about you based exclusively on automated processing. If your Organization uses automated analysis to make a decision about a patient based exclusively on automated processing, it is responsible for informing the patient as Quebec law requires.
16.8 Access, correction, and other rights.
You may request access to the personal information we hold about you and an account of how it has been used and disclosed, and ask us to correct inaccurate or incomplete information. Under Quebec law, you may also request a portable copy in a structured, commonly used technological format, ask us to stop disseminating information or to de-index it in the circumstances the law allows, and request information about decisions based exclusively on automated processing. Access is free, except for a reasonable fee for transcription, reproduction, or transmission that we will tell you about in advance. We respond within 30 days; where federal law permits a longer period, we will tell you before the deadline. If we refuse a request under Quebec law, you may ask the Commission d'accès à l'information to review the refusal within 30 days. For patient and study records, contact your Organization; we will assist it.
16.9 Security incidents.
If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, or a confidentiality incident presents a risk of serious injury under Quebec law, we notify affected individuals and the competent privacy regulator and keep the records the law requires. For patient and study information, we notify your Organization so it can meet its obligations.
16.10 Complaints.
Send complaints to our Privacy Officer. We acknowledge each complaint, investigate it, and respond in writing within 30 days with the outcome and any corrective measures. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca), the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), or, for personal health information, the Information and Privacy Commissioner of Ontario (ipc.on.ca) or the authority responsible in your province.