Privacy policy

Brill Neurotech, Inc. (“Brill,” “Company,” “we,” “us,” or “our”) is developing a wearable, non-invasive optical headset that records signals associated with brain activity. We know that information about your brain is among the most sensitive information there is. This Privacy Policy explains how we collect, use, disclose, and protect personal information through the website located at brillneurotech.com and its subdomains (the “Site”), our group email addresses linked on the Site, and the forms made available on the Site. In this Privacy Policy, “personal information” means information that identifies, relates to, or could reasonably be linked to an identified or identifiable individual, and includes “personal data” as defined under Applicable Law. This Privacy Policy does not cover the Device, the Platform, or Neural Data, none of which is collected through the Site; if we collect Neural Data in the future, we will provide a separate notice and obtain your consent before doing so. This Privacy Policy is incorporated into and forms part of our Terms of Use. Capitalized terms used but not defined in this Privacy Policy have the meanings given in our Terms of Use.

1. SUMMARY

• We collect the information you send us (emails to our group addresses, newsletter signups, job applications, and research interest list signups), newsletter engagement data, aggregate Site analytics, and standard hosting and security logs. We also publish profiles of team members and advisors who agree to be featured.
• The Site does not collect Neural Data, consumer health data, or biometric identifiers. We do not use advertising or cross-site tracking cookies, we do not run targeted ads, we are not a data broker, and we do not sell personal information or share personal information for cross-context behavioral advertising or targeted advertising.
• We do not use personal information collected through the Site to train artificial intelligence models.
• You can ask to access, correct, delete, or obtain a copy of your information, opt out of profiling, obtain a list of the third parties to which we disclose it, unsubscribe at any time, and withdraw consent by emailing privacy@brillneurotech.com.

2. INFORMATION WE COLLECT AND HOW WE USE IT

The table below describes the personal information we collect through the Site and related channels, where it comes from, and why we use it.

Controller and legal bases. Where the EU General Data Protection Regulation or the UK General Data Protection Regulation and UK Data Protection Act 2018 (together, “GDPR”) apply, Brill Neurotech, Inc. is the controller of the personal information described in this Privacy Policy, and you can contact us using the details in the “Contact Us” section. We rely on the following legal bases: (a) our legitimate interests in responding to inquiries and maintaining business records, operating and securing the Site and detecting spam and abuse (hosting and security logs), measuring Site usage through aggregate, cookieless analytics, managing Site content and editor accounts, contacting you about future research studies you asked to hear about, evaluating job applicants, and establishing, exercising, or defending legal claims; (b) taking steps at your request before entering into an employment contract with you, for job applications; (c) your consent for the newsletter and related email tracking, for the research interest list contact checkbox, and for published team profiles; and (d) compliance with our legal obligations, including employment, tax, and record-keeping laws. Where we process special categories of personal data in job applications (for example, health or diversity information you choose to provide), we do so on the basis of your explicit consent or, where applicable, to carry out our obligations under employment law. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing that occurred before withdrawal. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, you may request more information about that assessment, and you may object as described in Section 6.

Is providing information required? You are not required by law or contract to provide personal information through the Site. However, if you do not provide your contact details, we cannot respond to your inquiry, send you the newsletter, add you to the research interest list, or consider your job application, and if you do not provide information requested during the hiring process, we may be unable to progress your application. Where we collect information about you from someone other than you (for example, references you identify or our interviewers), the categories of information and sources are described in the table below.

Automated processing. Our newsletter platform automatically calculates aggregate read rates and removes bounced or inactive addresses, our Site analytics are automatically aggregated into statistics, and our hosting provider’s automated firewall and bot protection may block suspicious traffic or form submissions. None of this is used to make decisions that produce legal or similarly significant effects, and we do not engage in profiling in furtherance of such decisions. Every job application and research interest list signup is read by a person; we do not use automated tools or artificial intelligence to filter, score, rank, or summarize them. You may ask us for an explanation of any of this automated processing, and you may opt out of analytics through our Site consent banner. If you believe a security filter blocked you in error, contact us and a person will review it.

Please do not send sensitive information. Please do not include health information, Neural Data, biometric information, government identification numbers, or other sensitive information in emails, job applications, or the research interest list form unless we specifically request it. If you do, we will use it only to respond to you or evaluate your application and will delete it when no longer needed.

Consumer health data and biometric information. We do not collect, share, or sell consumer health data (as defined under the Washington My Health My Data Act, Nevada law, and the Connecticut Data Privacy Act) or biometric identifiers or biometric information (as defined under the Illinois Biometric Information Privacy Act) through the Site, and we do not use geofencing around health care facilities. If we begin collecting any such data, we will first publish a separate consumer health data privacy policy, obtain your separate consent to collect and to share it, obtain any written release required by law, and never sell it without your written authorization.

3. COOKIES AND TRACKING TECHNOLOGIES

The Site does not use advertising cookies, cross-site tracking cookies, or third-party advertising pixels, and our Site analytics do not use cookies or create cross-site identifiers. If we add cookies or similar technologies that require your consent, we will ask for it first. Our newsletter emails contain tracking technology (such as pixels and tracked links) that tells us whether an email was opened and which links were clicked; we use this only in aggregate and to maintain our list. You can limit email tracking by disabling image loading in your email client or by unsubscribing. We detect and honor Global Privacy Control and similar opt-out preference signals as a valid request to opt out of any sale, targeted advertising, or profiling.

4. HOW WE DISCLOSE INFORMATION

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We disclose personal information only as follows:

• Service providers that process information on our behalf under written contracts restricting their use of it, currently: Vercel (hosting, form delivery, and analytics); Astrodon Corporation d/b/a Loops (newsletter and form emails); Sanity (Site content management; no personal information other than team profiles and editor accounts); Google Workspace (email and document storage); GitHub (code hosting; no form submissions); Slack (internal communications); Anthropic (AI assistance with business communications, under business terms that prohibit training on our data); and Cierto Tech (our web developer). Our service providers may use their own subprocessors, which may process information in the United States, the United Kingdom, Spain, and other countries.
• Legal and safety: to comply with law or legal process, protect the rights, safety, or property of Brill or others, or investigate fraud or security issues.
• Corporate transactions: in connection with a merger, financing, acquisition, or sale of assets, subject to this Privacy Policy and Applicable Law.
• With your consent or at your direction.

We do not disclose personal information collected through the Site to Third Party Providers or other Persons for monetary or other valuable consideration, and we are not a data broker. If that changes, we will update this Privacy Policy, provide a clear opt-out mechanism, and obtain your consent before any sale of sensitive data.

5. RETENTION

We keep personal information only as long as needed for the purposes described above, and then delete or de-identify it:

6. YOUR RIGHTS AND CHOICES

Regardless of where you live, you may ask us to: confirm whether we process your personal information and give you access to it or a portable copy; correct inaccurate information; delete your information; withdraw any consent you have given; opt out of newsletter emails (using the unsubscribe link in any email); opt out of any sale of personal information, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in these activities); and obtain a list of the specific third parties to which we have disclosed your information. If you are a resident of Connecticut or Vermont, you have these rights under state law, and where profiling applies, you may request an explanation of, and review and correction of the data used in, any such profiling. If GDPR applies to you, you may also ask us to restrict or object to our processing (including processing based on our legitimate interests), and you have the right to lodge a complaint with your local data protection supervisory authority.

Additional rights under GDPR. If GDPR applies to you, you have the right to: access your personal information; rectify inaccurate or incomplete information; erase your information; restrict our processing; receive information you provided to us in a structured, commonly used, and machine-readable format and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means; object to processing as described below; withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not make such decisions). You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement occurred. In the United Kingdom, this is the Information Commissioner’s Office (ico.org.uk); in the European Economic Area, a list of supervisory authorities is available at edpb.europa.eu. We would, however, appreciate the chance to address your concerns first.

Right to object. Where we process your personal information based on our legitimate interests, you have the right to object at any time, on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed to establish, exercise, or defend legal claims. You may object at any time to processing of your personal information for direct marketing purposes, including our newsletter, and we will stop processing it for that purpose.

To make a request, email privacy@brillneurotech.com or write to us at the address in the “Contact Us” section below. You do not need an account. We will verify your request using information you have provided to us, respond within 30 days (extended once by up to 30 additional days where necessary, with notice) or, where GDPR applies, within one month (extended by up to two further months where necessary given the complexity or number of requests, with notice and reasons), and not discriminate against you for exercising your rights. You may use an authorized agent, subject to verification. If we deny your request, you may appeal by replying to our decision with “Appeal” in the subject line; we will respond in writing within 45 days, and if you are not satisfied you may contact your state Attorney General or, where GDPR applies, your supervisory authority. We will pass deletion requests on to our service providers.

7. SECURITY

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (TLS), multi-factor authentication, least-privilege access controls, and written data protection agreements with service providers. Personal information is handled only on Brill-managed systems and accounts. No system is perfectly secure. If a breach affects your personal information, we will notify you, state attorneys general, and other regulators as required by Applicable Law, including applicable state data breach notification laws and, where GDPR applies, notice to the competent supervisory authority within 72 hours where required.

8. CHILDREN

The Site is not directed to anyone under 18, our research interest list is open only to adults 18 and older, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us information, contact us and we will delete it.

9. INTERNATIONAL USERS

Brill is based in the United States and processes personal information in the United States, and our service providers may process it in other countries, including the United Kingdom and Spain. When we transfer personal information from the European Economic Area or the United Kingdom to countries that the European Commission or the UK government has not found to provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or, for recipients certified under it, the EU-U.S. Data Privacy Framework and its UK Extension, as applicable. You may request a copy of these safeguards by contacting us. The Site is not intended for use in jurisdictions subject to comprehensive U.S. sanctions.

10. CHANGES TO THIS POLICY

We will post any changes here with a new “Last Updated” date. For material changes, we will notify newsletter subscribers and others whose contact information we hold by email, or post a prominent notice on the Site, before the change takes effect. If we intend to process personal information for a purpose other than the one for which it was collected, we will provide you with information about that new purpose before we do so. We will not use previously collected personal information in a materially different way, or begin collecting new categories of sensitive information, without your affirmative express consent.

11. CONTACT US

Brill Neurotech, Inc.
Attn: Privacy
21 S Evergreen Ave, Suite 200-146, Arlington Heights, IL 60005
privacy@brillneurotech.com