Privacy policy
Privacy Policy
Last updated: 28 March 2026
Neurex UAB ("Neurex," "we," "us," or "our") operates the neurex.tech website and store. This Privacy Policy explains how we collect, use, and protect your personal information.
By using our services, you acknowledge that you have read and understood this policy.
Who We Are
Neurex UAB is a Lithuanian neurotechnology company registered in Vilnius, Lithuania. For all data and privacy matters, contact us at contact@neurex.tech.
Personal Information We Collect
We may collect the following:
- Contact details: name, email address, shipping and billing address, phone number
- Financial information: payment details processed securely via our payment provider
- Account information: username, password, preferences
- Transaction information: products purchased, order history
- Device and usage information: IP address, browser type, how you interact with our website
- Communications: messages you send us via email or contact forms
Neural and Biometric Data (EEG)
When you use the Neurex headband with EEG consent, it records electroencephalogram (EEG) data — the electrical signals your brain produces during sleep. Under GDPR Article 9, EEG data is classified as special category biometric and health data and receives the highest level of legal protection.
EEG consent is required only for the deep sleep stimulation feature. If you do not consent, the device operates in Basic Mode using movement-based sleep tracking only. You can enable full functionality at any time through your account settings. Your consent is always freely given — there is a real, functional alternative.
Where your EEG data is processed: Your EEG signals are transmitted securely to Neurex servers located in the European Union. Raw EEG signals are processed on our servers and then permanently deleted — they are never stored. Only derived outputs (sleep stage classifications, stimulation timing logs, and sleep quality metrics) are retained.
Why we collect it — and only for these purposes:
- To detect your deep sleep phases in real time
- To deliver precisely timed sound pulses designed to strengthen your deep sleep
- To generate your personal sleep report
- To personalise the stimulation timing to your individual brainwave rhythm over time
How long we keep it: Raw EEG signals are permanently deleted immediately after processing. Derived sleep data is retained for 2 years from your last device use, after which it is permanently deleted. You can request deletion at any time.
Consent records: When you give EEG consent, we record the date, time, and exact version of the consent text you were shown. This record is kept for the duration of your account plus 5 years.
Your EEG data is never sold to third parties and never used for advertising or any purpose beyond those listed above.
Legal basis: We process your EEG data only with your explicit, separately given consent under GDPR Article 9(2)(a). You may withdraw this consent at any time through your account settings or by contacting contact@neurex.tech. Withdrawing consent means the deep sleep stimulation feature will no longer function and the device will revert to Basic Mode — this is inherent to how the feature works, not a penalty.
Device Improvement
Neurex uses anonymised, aggregated data from all users to improve the accuracy and performance of the stimulation algorithm over time — for example, refining detection thresholds and stimulation timing across different sleep profiles.
This processing uses only derived outputs (sleep stage classifications, stimulation timing logs, sleep quality metrics) — never raw EEG signals. It does not use individually identifiable data.
Legal basis: Legitimate interests under GDPR Article 6(1)(f). We have assessed that this processing is necessary to deliver an improving product, is proportionate, and does not override users' rights. You may object to this processing at any time by contacting contact@neurex.tech.
Optional: Research and Neurotechnology Development
With your separate optional consent, Neurex may retain your anonymised sleep data for up to 7 years from the date of collection to conduct neurotechnology research — including development of future features such as brain-computer interface applications.
This data is used solely to:
- Validate device performance against population-level sleep data
- Conduct internal research into brainwave patterns and neurostimulation
- Develop future neurotechnology features
What anonymised means in practice: Before any data is used for research, it is stripped of all directly identifying information. We acknowledge openly that re-identification from EEG-derived data is theoretically possible — which is why this consent is always optional, never a condition of using the device, and why raw EEG signals are never retained for research.
You can withdraw this research consent at any time through your account settings or by contacting contact@neurex.tech. Data already incorporated into aggregated anonymous analysis cannot be individually reversed, but your identifiable records will be deleted upon request.
Contributors who give research consent receive early access to new Neurex features as a thank you.
Legal basis: Explicit consent under GDPR Article 9(2)(a).
Profiling and Automated Processing
Neurex analyses your sleep patterns to personalise stimulation timing to your individual slow wave rhythm. This constitutes profiling under GDPR Article 4(4). You have the right to object to profiling at any time — if you opt out, the device operates using fixed default parameters.
Neurex also uses automated processing to determine the precise timing of each audio pulse. Because this relates to health data, we apply GDPR Article 22 safeguards:
- Transparency: This policy discloses exactly what automated processing is performed
- Human review: You can request a human explanation of how the algorithm was applied to your session by contacting contact@neurex.tech
- Opt-out: You can opt out of personalisation without losing access to the device
How We Use Your Personal Information
We use your personal information to:
- Process and fulfil your orders
- Communicate with you about your order, account, or support requests
- Operate and improve our products and services
- Send marketing communications where you have separately consented (you may opt out at any time)
- Comply with legal obligations
- Prevent fraud and ensure security
How We Share Your Personal Information
We do not sell your personal information. We may share it with:
- Service providers: Payment processors, shipping companies, hosting providers and analytics tools — only as necessary to operate our services. All are bound by data processing agreements.
- MakeCommerce: Online store payments are processed using the makecommerce.lt platform, operated by Maksekeskus AS (Liivalaia 45, Tallinn 10145, Estonia, reg. nr.:12268475), therefore your personal information required for payment execution and confirmation will be transferred to Maksekeskus AS.
- Shopify: Our store is powered by Shopify. See Shopify's Privacy Policy for details of their processing.
- Legal authorities: Where required by law or to protect our legal rights.
EEG data is never shared with any third party in any form.
Legal Bases for Processing (GDPR)
| Data type | Legal basis |
|---|---|
| EEG and biometric data | Explicit consent — Article 9(2)(a) |
| Research and BCI development data | Explicit consent — Article 9(2)(a) |
| Device improvement (anonymised) | Legitimate interests — Article 6(1)(f) |
| Order fulfilment | Contract — Article 6(1)(b) |
| Marketing communications | Consent — Article 6(1)(a) |
| Fraud prevention | Legitimate interests — Article 6(1)(f) |
| Legal compliance | Legal obligation — Article 6(1)(c) |
How We Share Your Personal Information
We do not sell your personal information. We may share it with:
- Service providers: Payment processors, shipping companies, hosting providers and analytics tools — only as necessary to operate our services. All are bound by data processing agreements.
- Shopify: Our store is powered by Shopify. See Shopify's Privacy Policy for details of their processing.
- Legal authorities: Where required by law or to protect our legal rights.
EEG data is never shared with any third party in any form.
Security
Your EEG signals are encrypted in transit using TLS and raw signals are permanently deleted immediately after processing. Access to any personal data held by Neurex is restricted to named team members on a need-to-know basis. Data processing agreements are in place with all third-party processors. Retained derived data is encrypted at rest. We will notify you and the relevant supervisory authority without undue delay in the event of a personal data breach.
International Data Transfers
All EEG processing and data storage occurs on servers located within the European Union. Where other personal data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses to ensure it is protected to EU standards.
Data Retention
| Data type | Retention period |
|---|---|
| Raw EEG signals | Deleted immediately after processing — never stored |
| Derived sleep data | 2 years from last device use |
| Research data (optional consent) | Up to 7 years from collection date |
| Order and transaction data | 10 years (Lithuanian accounting law) |
| Marketing consent records | Until consent withdrawn + 3 years |
| EEG consent records | Duration of account + 5 years |
| General account data | Until account deletion |
Your Rights Under GDPR
As an EU resident, you have the right to:
- Access — request a copy of the data we hold about you
- Correction — request correction of inaccurate data
- Deletion — request deletion of your data, including all EEG and sleep data
- Portability — request your sleep report data in a machine-readable format
- Objection — object to processing based on legitimate interests or to profiling
- Restriction — request that we restrict processing of your data
- Withdrawal of consent — withdraw any consent at any time without affecting prior lawful processing
- Human review — request human review of any automated processing applied to your data
To exercise any right, contact contact@neurex.tech. We will respond within 30 days.
Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate:
Valstybinė duomenų apsaugos inspekcija www.ada.lt
Children
Our services are not intended for anyone under the age of 18. We do not knowingly collect personal information from minors.
Cookies
Our website uses cookies to improve your experience. You can manage your cookie preferences through your browser settings or our cookie consent tool.
Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes by email or by posting a notice on our website before the changes take effect.
Contact
Neurex, UAB
Įmonės kodas: 307630385
Žozefo Pusjė g. 56-2, LT-14188 Vilnius, Lithuania
+370 630 47 092