Privacy Policy

ViewMind Inc., ViewMind Sarl, and ViewMind S.A. (“ViewMind”, “we”, “us”, or “our”) are committed to safeguarding the privacy of our users and of the patients evaluated with our products. This Privacy Policy outlines how we collect, use, disclose, and protect personal data when you interact with our website or use ViewMind’s products, software, and services.

By accessing our website or using our products and services, you acknowledge the practices described in this Privacy Policy. Where personal data is processed on behalf of an Institution, the roles, legal basis and consent described in the Product Section apply. Unless otherwise defined, terms used in this Privacy Policy have the same meaning as in our Terms and Conditions.

Scope

This Privacy Policy applies to:

• Website: Covers personal data collected through our public-facing websites, portals, or communication channels.
• Product: Includes personal data collected during the use of ViewMind’s software, hardware, and associated services, including the ViewMind App and the ViewMind Medical Portal, in a research, clinical, or healthcare setting.

Definitions

• Service: Any ViewMind software, product, or service provided to users.
• Personal Data: Any information that identifies an individual directly or indirectly.
• Health Data: Personal Data related to the physical or mental health of a Patient, including conditions, medications, treatments and other interventions, and the Patient’s self-reported state at the time of an evaluation.
• Usage Data: Data collected automatically, generated during the use of our website or product.
• Pseudonymized Data: Personal Data processed so that it can no longer be attributed to a specific individual without additional information that is kept separately and protected.
• De-Identified Data: Information that has been modified to remove personal identifiers, ensuring it cannot reasonably be used to identify an individual.
• Anonymized Data: Data that has been processed to irreversibly prevent re-identification of the individual it pertains to.
• Institution: The healthcare, clinical, or research organization that contracts ViewMind’s products and services.
• Authorized User: A professional authorized by an Institution to use ViewMind’s products, such as an Evaluator or a Clinician.
• Evaluator: A Health Care Provider (HCP) who has successfully completed ViewMind’s required training, obtained a ViewMind Evaluator Certificate, and is authorized to operate the ViewMind App to conduct ViewMind Evaluations within a ViewMind Medical Institution.
• Clinician: A qualified healthcare professional who reviews and interprets information generated by the ViewMind System within the clinical context of the patient.
• Patient: The person undergoing a ViewMind Evaluation.
• Controller: The party that determines the purposes and means of processing Personal Data.
• Processor: The party that processes Personal Data on behalf of a Controller.
• Subprocessor: A third party engaged by ViewMind to process Personal Data on behalf of an Institution, such as a cloud hosting provider.
• Cookies: Small data files placed on devices to enhance user experience, and track preferences.
• Encryption: A method of securing data by converting it into coded formats, making it inaccessible to unauthorized individuals.
• Tracking Technologies: Tools used to collect information about user behavior on a website or application, including cookies, pixels, and web beacons.
• Third Parties: External entities, not part of ViewMind, that may interact with your personal data through the use of our services, such as analytics providers or social media platforms.
• You: The individual using ViewMind’s website or products, or the organization or entity represented by such an individual. Where this Policy describes the rights of Patients, “You” also refers to the Patient.

Website Section

Data Collected via the Website

• Personal Data:
  • Name, email and company name provided via contact forms or subscriptions.
• Usage Data:
  • IP addresses, browser type, pages visited, geolocation information, and other analytics data.
• Cookies and Tracking Technologies:
  • Includes cookies, web beacons, pixels, and other tracking technologies to enhance user experience and analyze website performance.

Use of Website Data

We use data collected from the website for:

• Communication (e.g., responding to inquiries or sending updates).
• Website analytics to improve user experience.

Links to Third-Party Websites and Social Media

For your convenience, the Website and this Privacy Policy may contain links to other third-party websites and social media sites such as Facebook, Instagram, X and LinkedIn. ViewMind does not control or take responsibility for the privacy practices, advertising, products, services, or content of such other websites. Please review the privacy policies and terms of service of these third parties for details about how your information is processed and what steps you can take to limit or avoid data sharing.

To limit the sharing of information, you can log out of your social media accounts before visiting our Website or adjust the privacy settings on those platforms to restrict data sharing.

Additionally, our Website may include social media plugins. If you visit our Website while logged into a social networking account, certain personally identifiable information about your browsing activity may be automatically shared with the social media platform operating that account. For further details on what information may be transferred and how you can manage this, please refer to the terms of service and privacy policies of the respective third-party platforms.

Product Section

Roles of ViewMind and the Institution

For Personal Data processed through ViewMind’s products, the Institution acts as the Controller (the covered entity, under HIPAA) and ViewMind acts as a Processor (a business associate, under HIPAA) on the Institution’s behalf. This processing is governed by the agreement between ViewMind and the Institution.

ViewMind acts as a Controller for Authorized User account data and for the Pseudonymized, De-Identified and aggregated data it uses for research and product development, as described below.

Data Collected via ViewMind Products

• Patient Personal Data:
  • Name, biological sex, date of birth, years of education, and location where the Service is used.
  • Subject IDs (Unique, encrypted alphanumeric identifiers assigned by the user organization. These identifiers do not correspond to any personal identification document, such as passport, social security number, or any other official identifier).
• Health and Contextual Data:
  • Pre-evaluation questionnaire responses, answered in the ViewMind App before each evaluation, about the Patient’s state and conditions that may affect the evaluation, such as sleep compared to usual, fatigue, recent intake of stimulants or alcohol, diagnosed ocular conditions, and use of corrective lenses. The questions may vary by Institution.
  • Patient Records, entered by Clinicians in the ViewMind Medical Portal, describing interventions the Patient receives, such as medications, hormone and peptide therapies, supplements, brain stimulation, cognitive training, exercise, sleep or lifestyle programs. Each entry may include the category and type of intervention, main goal, frequency, dose, status, start and end dates, and free-text details and notes.
• Authorized User Data:
  • Name, email address, role, Institution, and login credentials.
  • An activity record that attributes each creation and edit of a Patient Record to the Authorized User who made it, with the date of the change.
• Usage Data:
  • Eye-tracking data, such as X & Y eye position, timestamps, and pupil diameter.
  • Cognitive performance results and reports generated from evaluations.
  • System-generated information like device type, software version, and unique identifiers.

Free-Text Fields

Patient Records include optional free-text fields. Authorized Users should enter only the information needed to describe the intervention. They must not enter Patient identifiers, such as names, identification numbers or contact details, or information about third parties.

Legal Basis and Consent

Health Data is a special category of Personal Data under applicable data protection laws. Before registering a Patient in the ViewMind App, the Evaluator confirms, on behalf of the Institution, that the Patient has been informed of this Privacy Policy and the Terms and Conditions and has consented to the processing of their Personal Data, including Health Data, for the purposes described in this Policy.

The Institution is responsible for obtaining and documenting that consent, or for relying on another legal basis permitted by applicable law, such as the provision of healthcare. A Patient may withdraw consent and request the deletion of their data at any time, by contacting ViewMind or the Institution as described in Your Rights. Withdrawal does not affect processing carried out before it.

Use of Product Data

We collect product data for:

• Assessing cognitive performance.
• Contextualizing evaluation results, for example to account for factors that can affect a Patient’s performance on a given day.
• Supporting the longitudinal follow-up of Patients across evaluations, including the interventions received between them.
• Providing secure storage and analysis for research and clinical use.
• Research and product development, including improving algorithms, building normative reference data, and developing new features, as described below.
• Enhancing product functionality.
• Creating aggregated, anonymized datasets for research, marketing and commercial purposes, including their licensing or sale to third parties, as described in Aggregated Information.
• Managing Authorized User accounts, access and the activity record.

Research and Product Development

ViewMind uses Patient data, including Health Data, for research and to develop and improve its products. For these purposes, data is Pseudonymized or De-Identified before analysis, and direct identifiers such as name are removed. Research results are reported only in aggregated form that does not identify any individual. Aggregated, anonymized datasets derived from this data may also be used for commercial purposes, as described in Aggregated Information. Patients may object to this use by contacting ViewMind or the Institution.

Aggregated Information

We may aggregate, de-identify, and/or anonymize any information collected such that it is no longer linked to any identifiable individual and cannot reasonably be re-identified. We may use this aggregated and anonymized information (non-Personal Information) for any purpose, including without limitation research, marketing and commercial purposes, such as licensing or selling aggregated datasets to third parties. We may share such data with our affiliates and third parties, including research partners, commercial partners, advertisers, promotional partners, and others. Information shared with third parties is always aggregated; record-level data from ViewMind’s products, even when de-identified, is not shared with advertisers or promotional partners. Datasets derived from Patient data are de-identified in accordance with the HIPAA de-identification standards (Safe Harbor or Expert Determination), and recipients are contractually prohibited from attempting to re-identify any individual.

Disclaimer: ViewMind’s product does not provide a clinical diagnosis and is intended for cognitive performance measurement. Decisions based on data should be made in consultation with qualified professionals. Pre-evaluation questionnaire responses and Patient Records are contextual information. They are not used to diagnose, are not verified by ViewMind, and do not replace the Institution’s medical record.

General Provisions

Data Security & Privacy

• Compliance: All data is processed in compliance with applicable data protection laws, including the GDPR, HIPAA, Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018), Argentina’s Personal Data Protection Law (Law No. 25,326), and the laws of other countries where our products are used or our data is hosted.
• Encryption: Personal and usage data are protected using advanced encryption protocols during both transmission ("in transit") and storage ("at rest"), ensuring data confidentiality and security.
• Pseudonymization: Subject IDs are assigned by the Institution and are not linked to any official identification document through ViewMind’s systems. Patient data is protected through pseudonymization and access controls to reduce the risk of identification.
• Access Control and Activity Record: Patient data, including Patient Records, is accessible only to Authorized Users of the Institution that registered the Patient. Each creation and edit of a Patient Record is attributed to the Authorized User who made it and recorded with its date. ViewMind personnel access Patient data only when needed to provide, support or maintain the Services, under confidentiality obligations.

Hosting and Subprocessors

Product data is hosted on Amazon Web Services (AWS), which acts as ViewMind’s infrastructure Subprocessor. Data is stored in the AWS region assigned to each Institution: United States, European Union, Brazil or Singapore.

Retention of Data

• Website Data: Retained as long as necessary for communication or marketing purposes, unless otherwise requested.
• Product Data: Retained for the duration of the agreement with the Institution and as required by applicable regulations. This includes pre-evaluation questionnaire responses, Patient Records and their activity record. When the agreement ends, data is returned or deleted as set out in that agreement. Pseudonymized, De-Identified and aggregated data used for research and product development may be retained after that period.

Data Breach Notification

In the event of a data breach that may affect You, we will notify You without undue delay of any loss, misuse, or alteration of personal information. We will also notify the relevant regulatory authorities within 72 hours of discovering the breach, or within the period required by applicable law. Where the breach affects Patient data, we will notify the Institution so that it can inform the affected Patients.

Transfer of Data

We do not sell, trade, or otherwise transfer your personally identifiable information to outside parties. However, your information may be transferred to, stored, or otherwise processed in a destination outside of your jurisdiction where data protection laws may differ from those in your region.

For users in the European Union (EU), we comply with the General Data Protection Regulation (GDPR) and take steps to ensure that any data transferred outside the European Economic Area (EEA) is subject to appropriate safeguards. These safeguards include contractual agreements or adherence to frameworks such as the EU-U.S. Data Privacy Framework.

By entering into a Service Agreement with ViewMind, you acknowledge and consent to the transfer, storage, and processing of your data outside the EEA when necessary to provide our services. All data transfers are conducted in compliance with applicable data protection laws, and we ensure adequate security measures are in place to protect your information.

International Transfer of Personal Information

ViewMind may share customer information within our family of companies to support our global operations and provide you with information about our products and services. To facilitate these operations, personal information may be transferred from your home country to other ViewMind locations worldwide.

We strive to ensure that all data transfers comply with applicable data protection laws. For transfers to countries that may not offer an equivalent level of data protection as determined by the European Commission, we are committed to implementing appropriate safeguards to protect your information, such as contractual agreements or other lawful mechanisms. Where Patient data is transferred out of the AWS region where it is hosted, the same safeguards apply.

Cookies and Tracking Technologies

We use cookies and tracking technologies to:

• Assess website performance and improve functionality.
• Provide personalized content and advertisements (with user consent).
• Track user preferences to enhance user experience.

You can manage cookies and tracking preferences through your browser settings. Please note that disabling certain cookies may impact website functionality. For detailed instructions on managing cookies, refer to your browser’s help section.

Do Not Track (DNT) and Global Privacy Control (GPC)

• We currently do not respond to DNT signals due to the lack of a universal standard.
• We honor GPC signals for U.S.-based users as an opt-out of the sale or sharing of personal data.

Children's Privacy

Our services are not directed to individuals under the age of 18. If we discover that we have collected information from a minor without the consent of their legal guardian, we will immediately delete such information and notify the guardian of the incident.

Your Rights

As a user, you have the right to:

• Access and correction: Request access to or correction of your personal data.
• Erasure: Request deletion of your personal data, subject to legal obligations.
• Restriction: Request restrictions on the processing of your personal data.
• Objection: Object to the use of your data for research, product development, and the creation of aggregated datasets.
• Withdraw Consent: Opt-out of marketing communications or withdraw consent for data collection.

To exercise your rights, you can contact us via email at info@viewmind.com. Patients may also address their request to the Institution. Once we receive a request, we will confirm receipt and verify the requester’s identity before processing it. We will respond and act on the request within 30 days. When a Patient requests the deletion of their data, ViewMind will delete it and inform the Institution, except where retention is required by law. Data that has already been anonymized and aggregated no longer identifies the Patient and is not affected. Clinicians can correct Patient Records directly in the ViewMind Medical Portal.

Language and Translations

This Privacy Policy is written in English. Translations of its full content into other languages are provided as annexes to this document. In case of any discrepancy between the English version and a translation, the English version prevails.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in legal requirements or operational practices. Updates will be posted on our website with the effective date.

Contact Information

For questions or concerns, reach us at: