Privacy Policy
Last updated: 28 March 2026
Neurex UAB (“Neurex,” “we,” “us,” or “our”) operates the neurex.tech website and store. This Privacy Policy explains how we collect, use, and protect your personal information.
By using our services, you acknowledge that you have read and understood this policy.
Who We Are
Neurex UAB is a Lithuanian neurotechnology company registered in Vilnius, Lithuania. For all data and privacy matters, contact us at contact@neurex.tech.
Personal Information We Collect
We may collect the following:
- Contact details: name, email address, and any information you include when contacting us
- Account information: username, password, preferences
- Device and usage information: IP address, browser type, how you interact with our website
- Communications: messages you send us via email or contact forms
Neural and Biometric Data (EEG)
When you use the Neurex headband with EEG consent, it records electroencephalogram (EEG) data — the electrical signals your brain produces during sleep. Under GDPR Article 9, EEG data is classified as special category biometric and health data and receives the highest level of legal protection.
EEG consent is required only for the deep sleep stimulation feature. If you do not consent, the device operates in Basic Mode using movement-based sleep tracking only. You can enable full functionality at any time through your account settings. Your consent is always freely given — there is a real, functional alternative.
Where your EEG data is processed
Your EEG signals are transmitted securely to Neurex servers located in the European Union. Raw EEG signals are processed on our servers and then permanently deleted — they are never stored. Only derived outputs (sleep stage classifications, stimulation timing logs, and sleep quality metrics) are retained.
Why we collect it — and only for these purposes
- To detect your deep sleep phases in real time
- To deliver precisely timed sound pulses designed to strengthen your deep sleep
- To generate your personal sleep report
- To personalise the stimulation timing to your individual brainwave rhythm over time
How long we keep it
Raw EEG signals are permanently deleted immediately after processing. Derived sleep data is retained for 2 years from your last device use, after which it is permanently deleted. You can request deletion at any time.
Consent records
When you give EEG consent, we record the date, time, and exact version of the consent text you were shown. This record is kept for the duration of your account plus 5 years.
Your EEG data is never sold to third parties and never used for advertising or any purpose beyond those listed above.
Legal basis
We process your EEG data only with your explicit, separately given consent under GDPR Article 9(2)(a). You may withdraw this consent at any time through your account settings or by contacting contact@neurex.tech. Withdrawing consent means the deep sleep stimulation feature will no longer function and the device will revert to Basic Mode — this is inherent to the technology, not a penalty.
Device Improvement
Neurex uses your derived sleep data (such as sleep stage classifications, stimulation timing logs, and sleep quality metrics) to improve the accuracy and performance of our stimulation algorithms over time — for example, refining detection thresholds across different sleep profiles.
Because this involves health data, we only process this information with your explicit, opt-in consent. This processing relies exclusively on pseudonymised derived outputs — never raw EEG signals. Your data is assigned a secure identifier, separating it from your direct contact details before it is used for algorithmic training.
Legal basis: Explicit consent under GDPR Article 9(2)(a). You may withdraw this consent at any time through your account settings or by contacting contact@neurex.tech. Withdrawing consent does not affect your standard use of the device.
Optional: Research and Neurotechnology Development
With your separate, optional consent, Neurex may retain your pseudonymised sleep data for up to 7 years from the date of collection to conduct neurotechnology research. This includes the development of future features such as brain-computer interface applications.
This data is used solely to:
- Validate device performance against population-level sleep data
- Conduct internal research into brainwave patterns and neurostimulation
- Develop future neurotechnology features
What pseudonymised means in practice
Before any data is transferred to our research database, it is stripped of all directly identifying information (such as your name or email) and replaced with a secure, randomised ID. Because we securely hold the key to this ID, the data remains legally protected under GDPR, allowing you to maintain full control over it. Raw EEG signals are never retained for research under any circumstances.
You can withdraw your research consent at any time through your account settings or by contacting contact@neurex.tech. Upon withdrawal, your pseudonymised records will be permanently deleted from our active research databases. Data that has already been fully and irreversibly anonymised and incorporated into high-level aggregate statistics cannot be isolated or deleted.
Contributors who provide research consent receive early access to new Neurex features as a thank you.
Legal basis: Explicit consent under GDPR Article 9(2)(a).
Profiling and Automated Processing
Neurex analyses your sleep patterns to personalise stimulation timing to your individual slow wave rhythm. This constitutes profiling under GDPR Article 4(4). You have the right to object to profiling at any time — if you opt out, the device operates using fixed default parameters.
Neurex also uses automated processing to determine the precise timing of each audio pulse. Because this relates to health data, we apply GDPR Article 22 safeguards:
- Transparency: This policy discloses exactly what automated processing is performed
- Human review: You can request a human explanation of how the algorithm was applied to your session by contacting contact@neurex.tech
- Opt-out: You can opt out of personalisation without losing access to the device
How We Use Your Personal Information
We use your personal information to:
- Communicate with you about product updates or support requests
- Operate and improve our products and services
- Send marketing communications where you have separately consented (you may opt out at any time)
- Comply with legal obligations
- Prevent fraud and ensure security
Legal Bases for Processing (GDPR)
| Data type | Legal basis |
|---|---|
| EEG and biometric data | Explicit consent — Article 9(2)(a) |
| Device improvement (pseudonymised) | Explicit consent — Article 9(2)(a) |
| Research and BCI development data | Explicit consent — Article 9(2)(a) |
| Responding to enquiries | Legitimate interests — Article 6(1)(f) |
| Marketing communications | Consent — Article 6(1)(a) |
| Fraud prevention | Legitimate interests — Article 6(1)(f) |
| Legal compliance | Legal obligation — Article 6(1)(c) |
How We Share Your Personal Information
We do not sell your personal information. We currently use no third-party analytics tools. We may share your personal information with:
- Service providers: Website hosting, email, and technical service providers — only as necessary to operate our services. All are bound by data processing agreements.
- Legal authorities: Where required by law or to protect our legal rights.
EEG data is never shared with any third party in any form.
Security
Your EEG signals are encrypted in transit using TLS and raw signals are permanently deleted immediately after processing. Access to any personal data held by Neurex is restricted to named team members on a need-to-know basis. Data processing agreements are in place with all third-party processors. Retained derived data is encrypted at rest. We will notify you and the relevant supervisory authority without undue delay in the event of a personal data breach.
International Data Transfers
All EEG processing and data storage occurs on servers located within the European Union. Where other personal data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses to ensure it is protected to EU standards.
Data Retention
| Data type | Retention period |
|---|---|
| Raw EEG signals | Deleted immediately after processing — never stored |
| Derived sleep data | 2 years from last device use |
| Research data (optional consent) | Up to 7 years from collection date |
| Marketing consent records | Until consent withdrawn + 3 years |
| EEG consent records | Duration of account + 5 years |
| General account data | Until account deletion |
Your Rights Under GDPR
As an EU resident, you have the right to:
- Access — request a copy of the data we hold about you
- Correction — request correction of inaccurate data
- Deletion — request deletion of your data, including all EEG and sleep data
- Portability — request your sleep report data in a machine-readable format
- Objection — object to processing based on legitimate interests or to profiling
- Restriction — request that we restrict processing of your data
- Withdrawal of consent — withdraw any consent at any time without affecting prior lawful processing
- Human review — request human review of any automated processing applied to your data
To exercise any right, contact contact@neurex.tech. We will respond within 30 days.
Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate:
Valstybine duomenu apsaugos inspekcija
www.ada.lt
Children
Our services are not intended for anyone under the age of 18. We do not knowingly collect personal information from minors.
Cookies
Our website uses cookies to improve your experience. You can manage your cookie preferences through your browser settings or our cookie consent tool.
Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes by email or by posting a notice on our website before the changes take effect.
Contact
Neurex UAB
Zozefo Pusje g. 56
Vilnius, LT-14188
Lithuania
contact@neurex.tech