Consent to the processing of EEG and health data

EEG recordings are data about your health. For these special categories of personal data, Article 9 GDPR requires explicit consent. This document sets out the full wording of the consents you give at registration, together with the participant information that goes with them. It supplements the Privacy Policy.

1. Who is the controller?

For studies commissioned by a company or institution, that commissioning party is the controller and we act as processor. Who the controller is in a given case is shown to you before you take part, on the consent screen.

2. What data is processed?

• raw EEG data from the headband: four channels with 256 values per second, plus signal quality for each electrode;
• time and synchronisation markers linking the recording to the film shown;
• session data: film and film version, start and duration, browser and device type, reasons for abandonment;
• profile data from your account, as far as needed to assign you to a comparison group: year of birth, sex, handedness;
• derived measures, charts and reports from the analysis.

We do not capture image or sound from your surroundings. The connection to the headband exists solely between the band and your own device.

3. What is the data used for?

You give two separate consents. The first is a prerequisite for a measurement; the second is entirely voluntary — you can use the full Service without it.

Consent (a) — carrying out your measurements

I expressly consent to Adam Koch processing the EEG data I record, together with the associated session and profile data, in order to carry out the measurements I have started, analyse them and present the results to me in my account — including comparison with my own earlier measurements and with existing reference groups. I understand that this constitutes health data within the meaning of Article 9 GDPR.

Legal basis: Art. 9 (2) (a) in conjunction with Art. 6 (1) (a) GDPR.

Consent (b) — comparison database and research

I additionally consent to my EEG data and the associated profile data being included in pseudonymised form in the NeuroScreen comparison (normative) database and used for analyses and research on the platform. This consent expressly covers cross-module use: my recordings may also be used in other studies on the platform as a covariate and for training and validating analysis methods. I understand that results are published or shared with third parties exclusively in aggregated or anonymised form and that I am not identifiable in them.

Legal basis: Art. 9 (2) (a) GDPR, supplemented by Art. 89 GDPR with the safeguards provided for there (pseudonymisation, data minimisation, purpose limitation).

Individual studies with their own protocol — for example paired sessions in different locations — require an additional consent for that study, which is presented to you separately before you take part.

4. How do we protect the data?

• Pseudonymisation: measurement data is stored under a participant identifier, kept separate from account data.
• Encryption: transmission exclusively over TLS; backups of raw data stored encrypted.
• Access: on a least-privilege basis, limited to people who need the data for operation or analysis.
• Location: processing and storage exclusively in German data centres of Hetzner Online GmbH (processor under Art. 28 GDPR); no transfer to third countries.
• Verifiability: recordings can be given cryptographic timestamps so that it can later be demonstrated that they were created at a particular time and not altered afterwards. These timestamps contain no personal content, only checksums.

5. How long is the data stored?

Until you withdraw your consent or delete your account. After withdrawal we delete the raw data without undue delay and at the latest within 30 days; the encrypted backups expire within the relevant backup cycle, after 90 days at the latest. Records of the consent given are kept until the limitation periods expire (usually three years), because we must be able to demonstrate to supervisory authorities what you consented to.

6. How do you withdraw a consent?

Both consents are voluntary and can be withdrawn at any time, individually, with effect for the future — in your account settings or by an informal e-mail to info@advena-partners.com. The lawfulness of processing carried out before withdrawal remains unaffected. Withdrawal has no disadvantages beyond the following:

• withdrawal of (a): measurements can no longer be carried out; raw data already recorded is deleted;
• withdrawal of (b): your data is removed from the comparison database. Analyses that have already been anonymised or aggregated and results already published cannot be recalled, because they no longer relate to you.

7. What you should know about the results

• NeuroScreen is a wellness and research tool and not a medical device. Reports are not a diagnosis and do not replace medical examination or advice.
• There is no automated decision-making producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR.
• A four-channel EEG cannot establish individual feelings of individual people at individual moments. You therefore see other participants' results only as comparison curves with stated uncertainty.
• If a measurement shows unusual values, that is not a finding. If you are worried, discuss it with a doctor.

8. Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. Details and contact addresses are in section 9 of the Privacy Policy. On request we provide your measurement data in a common, machine-readable format.

9. Taking part without your own account

If you take part in a participant panel via an invitation link, this information applies accordingly; your identifier is then your e-mail address, which you can also use to request erasure. Panel participants' data does not feed into the normative database. Who the controller is for the study in question is shown to you before you begin.