1. Data Controller and Legal Grounds for Processing

The data controller for personal data is NeuroAudit® Oy (Business ID: 3608232-7). The owner of the company and the person responsible for data protection is Tea Latvala. The official email address of the data controller is [email protected], and the websites can be found at www.aivoauditointi.com and app.aivoauditointi.com.

1.1 Purpose and Legal Basis of Processing

NeuroAudit® Oy processes personal data in accordance with the requirements set by the General Data Protection Regulation (2016/679) of the European Union. The processing of data is based on the following legal grounds:

• Contract (Article 6, Paragraph 1b): The processing of personal data is necessary to execute the Aivoauditointi™ service, to compile the cognitive analysis, and to carry out reporting.
• Explicit Consent (Article 9): The processing of special categories of personal data is strictly limited to Pillar 9 of the report. This specific section is protected by double encryption and complies with the strictest safeguards under Article 9 of the GDPR. Other physiological data, such as hormonal integration (P11), are processed as cognitive performance indicators part of the overall assessment.
• Legitimate Interest (Article 6, Paragraph 1f): Data is used for protecting intellectual property rights (IPR), validating algorithms, and the continuous product development of the service.

1.2 Nature of Data and Limitation of Liability

The data collected and processed is by nature expert data on cognitive performance. The operations of NeuroAudit® Oy do not constitute patient care under the Health Care Act, and the collected data does not form a statutory patient register. The system processes customer data intended for performance optimization and preventive analysis.

1.3 Data Storage and Technical Protection

All raw data generated by the Aivoauditointi™ process is protected by multi-stage access management. Data is stored in a Cloudflare D1 database using TLS 1.3 encryption. User passwords are protected by hashing them with the bcrypt algorithm.

Upon completion of the analysis, the raw data is anonymized into NeuroAudit® Oy’s reference database for algorithm development. After this process, an individual person can no longer be identified, and the anonymization is irreversible by nature.

2. Personal Data to be Processed and Data Categories

The register contains the following user-group-specific information:

• Basic Information: User’s name, email address, and hashed password.
• Health Data (Article 9): Answers to the questionnaire based on the BHQ 3.0 methodology, which cover basic medical information, nutrition, exercise, sleep quality, mental health, and areas of social well-being.
• Special Categories of Sensitive Data (Article 9, Paragraph 1): Pillar 9 of the report processes sexual well-being and history of psychoactive substance use (such as psilocybin, MDMA, or ayahuasca). This section is protected by double encryption in a separate database partition with highly restricted access. Other pillars adhere to standard high-level security protocols. This special data is stored solely with the explicit consent of the user, which the customer can withdraw at any time.

3. Regular Disclosure of Data

Personal data will not be disclosed to third parties without consent, except for the following necessary actors:

• NeuroAudit® Expert: An authorized expert has access to the data to compile the analysis and the report.
• Organization-Specific HR View: In the case of group clients, the employer or the subscriber is shown only anonymized aggregate data (groups of at least five people) from which an individual employee cannot be identified.
• Subcontracted Service Providers: OpenAI GPT-4o processes report data on behalf of NeuroAudit® Oy, and Cloudflare is responsible for the technical infrastructure. Data Processing Agreements (DPA) of each respective service provider apply to these actors.

4. Rights of the Data Subject

In accordance with the GDPR, the user has the right to inspect data concerning themselves (Article 15), request rectification of inaccurate data (Article 16), and to be forgotten, in which case the account and all associated data will be deleted within 30 days of the request (Article 17). The user also has the right to data portability (Article 20) and the right to withdraw their consent at any time (Article 7, Paragraph 3).

In case of potential problems, the user has the right to lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi). All data protection requests will be answered within 30 days at [email protected].