Privacy policy.

1. Scope

This policy applies to the NeuroLog mobile application, web portals, website, pilot waitlist, support services and related services that link to it (together, the NeuroLog services).

NeuroLog is based in Melbourne, Australia. We handle personal information in accordance with applicable privacy and health-records laws, including the Australian Privacy Principles and, where applicable, the Victorian Health Privacy Principles.

If you join a research study, the study information and consent form may contain additional privacy terms. Those study-specific terms apply alongside this policy. If they conflict about research use of your data, the approved study information and consent form governs that research activity.

2. Information we collect

The information we collect depends on how you use NeuroLog and may include:

• Identity and account information, such as your name, email address, account identifiers, chosen sign-in method and sign-in records. If you choose Apple or Google sign-in, we may receive a provider identifier, name and email address (including an Apple private-relay address) within the permissions you approve. We do not receive your Apple or Google password.
• Self-reported health information, such as neurological events, symptoms, intensity, duration, mood, medication and adherence information, notes and responses to questionnaires.
• Wearable and device-health information, such as sleep, activity, workouts, heart rate, resting heart rate, energy and related source and device information that you authorise.
• Study information, such as a study invitation, cohort membership, participant identifier, consent record and study-related responses.
• Technical information, such as app version, device and operating-system details, security and diagnostic logs, connection status and timestamps.
• Communications, including support requests and feedback.
• Website and pilot information, such as your name, email, organisation, area of interest and message when you join our waitlist. Please do not put health information in the waitlist form.

We usually collect information directly from you. We may also receive information from a health platform or wearable provider you connect, from an authorised study team, or automatically when needed to operate and secure the services.

3. How we use information

We collect, hold and use information where reasonably necessary to:

• create and secure your account;
• save and display your logs, history, settings and connected health data;
• provide personal summaries and explainable observations;
• operate an approved study in line with its consent and protocol;
• provide support and communicate about the service or a pilot;
• maintain, troubleshoot, protect and improve NeuroLog;
• prevent misuse, investigate security incidents and meet legal obligations; and
• create aggregated or de-identified information that does not reasonably identify you.

We do not sell personal information. We do not use health information for advertising, targeted marketing or data-broker activities.

4. Health and wearable data

You choose whether to connect services such as Apple Health, Health Connect, Samsung Health or a supported wearable account. NeuroLog requests access only to data types used by the features you choose. Device permission screens show the specific categories requested.

You can change device-health permissions in your phone settings and disconnect supported accounts from NeuroLog. Disconnecting stops future collection from that source; it does not automatically remove data already imported. You can request deletion as described below.

Health information is used to provide NeuroLog's health and research features. We do not use it to make automated treatment decisions. NeuroLog is for tracking and reflection and is not a diagnostic, emergency-alert or treatment service.

5. Studies and cohorts

A NeuroLog account can be used without joining a study. If you receive a study invitation link, QR code or code, the app will show the study identity, responsible institution or team, contact details, requested data and consent information before you decide whether to join.

Joining a study does not automatically permit access to every item in your NeuroLog account. We disclose study data only as described in the applicable consent. If a study requests information logged before you joined, that historical scope must be clearly presented for your agreement.

You can contact the study team or use the study controls in NeuroLog to ask about withdrawal. Withdrawal stops future study collection as described in the study documents, but information already used in research, required for study integrity or retained by law may not always be removable. De-identified or aggregated results cannot ordinarily be linked back to delete them.

6. When we share information

We may disclose information only as needed for the purposes above, including to:

• cloud hosting, email, support, security and other service providers acting for us;
• Apple or Google when you choose that provider to create or access your NeuroLog account;
• a study sponsor, institution, investigator or authorised research team where you have joined that study and the disclosure is covered by its consent;
• a clinician or other person when you direct us to share with them;
• wearable and health-platform providers when you initiate a connection or request; and
• regulators, courts, law-enforcement bodies or advisers when required or permitted by law, or when reasonably necessary to protect someone from a serious threat.

We require service providers to handle information only for agreed services and with appropriate privacy and security protections.

7. Storage, overseas processing and security

NeuroLog's primary application infrastructure is hosted in Amazon Web Services' Sydney region. We use safeguards such as encryption in transit and at rest, access controls, audit and security monitoring, backups and separation between testing and production environments.

Some providers may process information outside Australia. For example, our website waitlist and optional Google sign-in use Google services, and optional Apple sign-in uses Apple services. These and other technology providers may process account, technical or submitted information in the United States and other countries where they operate. A connected wearable provider may process data in the locations described in its own privacy notice.

No system is completely secure. If you believe your account or information may have been compromised, contact us promptly.

8. How long we keep information

We retain identifiable information only for as long as it is needed for the purposes described in this policy, an applicable study protocol or consent, and our legal, safety and record-keeping obligations. Retention periods differ by information type and context.

When information is no longer required, we take reasonable steps to delete it or permanently de-identify it. Limited copies may remain temporarily in protected backups until those backups are overwritten.

9. Your choices and rights

You may ask us to give you access to personal information we hold about you, correct it, export available account data, or delete your account and associated data. We may need to verify your identity before acting. Applicable law or an approved study may require us to retain limited records, and we will explain any such exception.

Use available controls in the app or email contact@neurologapp.com. See our account deletion instructions for the information to include. You can also manage device-health access in iOS or Android settings.

10. Privacy questions and complaints

Send privacy questions or complaints to contact@neurologapp.com with the subject “Privacy”. Describe your concern and how you would like it resolved. We will acknowledge it, investigate and aim to respond within 30 days.

If you are not satisfied, you may contact the Office of the Australian Information Commissioner. For Victorian health information, you may also contact the Victorian Health Complaints Commissioner.

11. Changes and contact

We may update this policy as NeuroLog changes. We will publish the revised version here and update the date above. We will provide additional notice where a material change requires it.

NeuroLog Technologies Pty Ltd
Melbourne, Victoria, Australia
contact@neurologapp.com