Privacy Policy

Scope and who we are

This Privacy Policy applies to the NeuroMD Recovery Coach, the voice sessions with "Donna," this website, and any NeuroMD page that links to it (the "Service"). It is part of our Terms of Use.

The Service is operated by NeuroMD Medical Technologies LLC ("NeuroMD," "we," "us"). We are the business responsible for the information described here.

A note about HIPAA

We are not a HIPAA covered entity or business associate, and the information you give us is not protected health information under HIPAA. We are not a healthcare provider, health plan, or clearinghouse, and the Recovery Coach does not provide medical care. That does not mean your health information is unprotected — state consumer health privacy laws do apply to us, and Section 5 explains how we handle it.

Information you give us

• What you tell the Coach. Your first name; where your pain is; how you rate it, typically from 1 to 10; how long you have had it; what it stops you doing; what you want to get back to; how well you have been sleeping; and whether you describe yourself as a man or a woman. You choose what to say — the Coach works with whatever you give it.
• Contact details. Email address, and phone number if you give one.
• Purchase information. What you bought, when, the plan and price, and your subscription status. Your full card number goes directly to Stripe and never reaches our servers — we hold a payment token, the card brand, and the last four digits.
• Support correspondence. What you write to us, and our replies.
• Anything else you volunteer, including testimonials or survey answers.

Please do not tell the Coach your card number, passwords, Social Security number, or another person's private information. We do not need it.

Information collected automatically

• Device and connection. IP address, browser type and version, operating system, device type, screen size, language, and referring page.
• Usage. Pages viewed, links and buttons clicked, scroll depth, time on page, session start and end, and the path you took through the site.
• Session replay. Our analytics provider reconstructs a playback of your visit — mouse movement, clicks, scrolling, and rage-clicks — so we can see where the site confuses people. See Section 11, including how to opt out.
• Browser storage. We store small values on your own device so your plan is there when you come back: your session details (donna_demo), the marketing profile identifier described in Section 4 (donna_kid, donna_kx), where you arrived from (donna_src), and whether you have already had your complimentary session (donna_done, also kept as a cookie), which is how we take returning visitors straight to their plan. Clearing your browser storage clears them.

Information from other sources

From our email and text platform. If you arrive from a NeuroMD email or text, the link may carry an identifier for your existing marketing profile. We read it, store it on your device, and use it to connect your visit, your session, and your purchase to the same person — so you are not treated as a stranger and are not sent things you have already bought. That profile may already include your email address, phone number, marketing consent status, and NeuroMD purchase history.

From our payment processor. Confirmation that a payment succeeded or failed, subscription status, refunds, and fraud signals.

Voice sessions in detail

Because a voice service raises questions a normal privacy policy does not, here is exactly what happens when you talk to Donna.

1. Your browser asks your permission to use your microphone. Nothing is captured before you grant it, and you can revoke it in your browser at any time.
2. While the session is live, your audio streams to our voice provider and to a speech-to-text provider, which converts it to text in real time.
3. The text goes to a language-model provider, which generates Donna's reply. The reply is turned into speech by a voice-synthesis provider and played back to you.
4. Details you give — name, pain area, rating, duration, goals — are saved so your plan and summary can be built.

Audio is not recorded

Audio recording is switched off. Your voice is processed in the moment and is not stored as an audio file by us. What we retain is the text transcript of the session and the structured details above.

Other people in the room

Your microphone picks up whoever is near it. Several states require everyone in a conversation to consent before it is captured. Please make sure anyone else present knows the session is being transcribed, and do not use the Service where capturing the conversation would be unlawful.

Training

We do not sell your session content, and we do not permit our vendors to use it to train their general-purpose models where their enterprise terms allow us to say so. We may review transcripts internally to fix problems, improve Donna's guidance, and keep the Service safe.

How we use information

• To run the Service — hold a voice session, understand you, respond, and build and show your plan and summary.
• To personalize what the Coach says and what your summary shows, based on what you told us.
• To process payments, manage your subscription, process renewals and refunds, and prevent payment fraud.
• To support you — answer questions, resolve problems, and handle cancellations and refunds.
• To communicate — send transactional messages about your account and subscription, and, with your consent, marketing.
• To improve the Service — understand which parts confuse people, fix errors, and test changes. Wherever it will do the job, we use aggregated or de-identified data for this.
• To keep things secure — detect and prevent fraud, abuse, and unauthorized access.
• To meet legal obligations and to establish, exercise, or defend legal claims.

We do not use automated processing to make decisions that produce legal or similarly significant effects about you. The plan the Coach suggests is guidance, not a decision about your rights, benefits, or care.

Who we share it with

We share information with service providers who process it on our behalf, under contract, for the purposes below — and not for their own. As of the effective date above:

We may also disclose information:

• To comply with law — in response to a subpoena, court order, or other lawful request. We review each request and push back where it is overbroad or defective.
• To protect people — where we believe in good faith it is necessary to prevent fraud, investigate a violation of our Terms, or protect anyone's rights, safety, or property.
• In a business transfer — as part of a merger, acquisition, financing, or sale of assets. If consumer health data would transfer, we will notify you first and give you the chance to delete it beforehand.
• With your direction — when you ask us to.

We do not sell your information

We do not sell personal information for money, and we have not done so in the preceding 12 months. We do not sell the personal information of anyone under 16.

One nuance worth stating plainly: California and several other states define "sharing" and "targeted advertising" broadly enough that ordinary analytics and advertising cookies can fall inside them, even with no money involved. Because we use the analytics and session-replay tools in Section 8, we treat that activity as "sharing" and give you a way out — see Section 11 for the opt-outs, and Section 14 to send us a request. Consumer health data is never included in any of it.

How long we keep it

We do not delete your information on a fixed schedule. We keep it for as long as we determine is appropriate in our sole discretion — including indefinitely — so that your history stays available to you and to the Coach, and so that we can comply with law, resolve disputes, and enforce our agreements. Where we do end a retention period, we delete the information or irreversibly de-identify it.

We use the information described in this policy to operate the Service, to improve it, to develop new products, features, and clinical guidance, and for research and analysis — including research using de-identified and aggregated data derived from how our members use the Service.

Your right to ask us to delete your information does not expire and applies regardless of the periods above. Section 13 explains how to exercise it.

Cookies, analytics, and session replay

We use cookies and similar technologies — including browser storage and pixels — to keep the Service working, remember your session, and understand how the site is used.

Session replay, stated plainly

Microsoft Clarity records your interactions with our pages and lets us replay them as a reconstruction of your visit, including mouse movement, clicks, and scrolling. Where you arrived from one of our emails, that playback can be linked to your marketing profile, which means it is not anonymous. Clarity is configured to mask text you type into form fields, but you should assume anything visible on the page during your visit is captured.

How to opt out

• Everything at once: email Help@GetNeuroMD.com with the subject "Opt Out of Tracking" and we will suppress analytics and session replay for you.
• Google Analytics: install Google's browser opt-out add-on at tools.google.com/dlpage/gaoptout.
• Microsoft Clarity: opt out at Microsoft's privacy dashboard.
• Your browser: block or delete cookies and site data in your browser settings. Blocking essential storage may break parts of the Service.
• Global Privacy Control: we honor the GPC signal as a valid opt-out of sale and sharing where the law requires it.

Because there is no common standard for it, we do not respond to browser "Do Not Track" headers. We do respond to GPC.

How we protect it

We use encryption in transit, access controls that limit who on our side can see what, vetted vendors under written data-protection terms, and a payment setup where card numbers never touch our systems.

No system is perfectly secure. We cannot guarantee absolute security, and you share information with us knowing that. If a breach affects your information, we will notify you and the relevant regulators as the law requires. Tell us immediately at Help@GetNeuroMD.com if you think your account has been compromised.

Your privacy rights

We extend the core rights below to everyone who uses the Service, wherever you live, rather than only to residents of states that mandate them.

• Know and access — what we hold about you, where it came from, why we have it, and who we disclosed it to.
• Portability — a copy in a portable, machine-readable format.
• Correct — fix information that is wrong.
• Delete — have it erased, subject to narrow legal exceptions such as tax records.
• Opt out — of sale, of sharing for targeted advertising, and of profiling with significant effects.
• Limit sensitive data — restrict use of sensitive personal information to what providing the Service requires.
• Withdraw consent — including consent to consumer health data collection, at any time.
• Non-discrimination — we will not deny service, charge you more, or give you a worse experience for exercising any of these rights.

How to exercise your rights

Email Help@GetNeuroMD.com, or write to us at the address in Section 21. Tell us what you want and use the email address associated with your session or purchase where you can.

• Verification. We will ask for enough information to confirm it is really you, and we use it only for that. We will not ask for more than we need.
• Timing. We acknowledge within 10 business days and respond within 45 days, extendable once by another 45 days if the request is complex — we will tell you if that happens. Health-data deletion is handled within 30 days.
• Cost. Free, up to twice in a 12-month period. We may charge a reasonable fee for requests that are manifestly unfounded or excessive, and will tell you before doing so.
• Authorized agents. An agent may submit a request with your written permission; we may still verify with you directly.
• Appeals. If we decline, we will tell you why, and you may appeal by replying with the subject line "Privacy Appeal." We will respond to an appeal within 45 days. If we deny the appeal, we will tell you how to complain to your state attorney general.

California disclosures

Under the California Consumer Privacy Act as amended, here are the categories of personal information we have collected in the preceding 12 months, and the business purposes for each. We disclose each of these categories to the service providers listed in Section 8.

Sensitive personal information. We use it only to provide the Service you asked for, as permitted by CCPA § 7027(m). We do not use or disclose it to infer characteristics about you, and we do not use it for advertising. You may still ask us to limit it.

Shine the Light. California Civil Code § 1798.83 lets California residents request information about disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

Minors. California residents under 18 who are registered users may request removal of content they posted; email us. Removal may not be complete or comprehensive.

To exercise any California right, including opting out of sharing or limiting sensitive information, use Section 14 or send the GPC signal.

Other state disclosures

Washington and Nevada. If you are a Washington resident, the My Health My Data Act gives you the rights in Section 5 over your consumer health data, including consent withdrawal, a list of who received it, and deletion. Nevada residents have comparable rights under SB 370, including the right to tell us not to sell covered health information — which we do not do in any case. Washington residents may also file a complaint with the Washington State Attorney General.

Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Residents of these states have rights to access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale, and certain profiling. We treat health information as sensitive data requiring your consent, which you give by choosing to tell the Coach and may withdraw at any time. Use Section 14, including the appeal process, which these states require.

Illinois and Texas biometric laws. We do not collect biometric identifiers. We do not create a voiceprint, and we do not use voice for identification or authentication — audio is converted to text and discarded.

If you are outside the United States

The Service is intended for users in the United States, and information is processed on servers in the United States and other countries where our vendors operate. Privacy laws there may differ from those where you live. By using the Service you understand your information will be transferred to and processed in the United States.

If you are in the European Economic Area, the United Kingdom, or Switzerland: our legal bases are your consent (for health data and marketing), performance of a contract (to provide and bill the Service), legitimate interests (security, and improving the Service, where not overridden by your rights), and legal obligation. You have rights of access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent at any time or complain to your local supervisory authority. Where we transfer data internationally we rely on Standard Contractual Clauses or another valid mechanism. Contact us at Help@GetNeuroMD.com.

Children

The Service is for adults 18 and over. We do not knowingly collect information from anyone under 18, and we do not knowingly collect information from children under 13 as defined by COPPA. If we learn we have, we delete it promptly. If you believe a minor has given us information, email Help@GetNeuroMD.com and we will remove it.

Third-party sites

Our pages link to and embed content from services we do not control, including the payment page and an embedded clinician endorsement. Their privacy practices are their own, and this policy does not cover them. Read their policies before giving them information.

Changes to this policy

We may update this policy. When we make a material change we will update the "Last updated" date and give reasonable notice before it takes effect — by email or an in-product notice. Where the law requires your consent for a new use of consumer health data, we will ask for it separately rather than relying on an updated policy. Continuing to use the Service after a change takes effect means you accept the updated policy.

How to reach us

For any privacy question, request, or complaint:

Email

Help@GetNeuroMD.com

Mail

NeuroMD Medical Technologies LLC, 20803 Biscayne Blvd, Suite 101, Aventura, FL 33180

Health data requests

Use the subject line "Health Data Request"

Appeals

Use the subject line "Privacy Appeal"

We will provide this policy in an alternative format on request if you need one to access it.