Privacy policy

This privacy policy explains which personal data we process when operating NeuroScreen (neuroscreen.de), for what purpose, on what legal basis — and what rights you have.

Important first: EEG recordings are health data within the meaning of Article 9 GDPR. We process them solely on the basis of your explicit consent, which you may withdraw at any time. Without consent no measurement is possible — simply visiting the website requires no such consent.

1. Controller

We have not appointed a data protection officer because the statutory conditions of Article 37 GDPR and § 38 German BDSG are not currently met. Please use the contact details above for all data protection matters.

2. Visiting the website

2.1 Server log files

When you access our pages, technically necessary access data is processed: IP address, date and time, address requested, HTTP status code, volume of data transferred, referrer and browser identification (user agent).

• Purpose: delivering the pages, operational security, defence against attacks, error analysis.
• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and uninterrupted operation).
• Retention: as a rule 14 days, then automatic deletion; longer storage only in the event of a specific security incident, until it is resolved.

2.2 Cookies and access to your device

We use strictly necessary cookies only:

These cookies are strictly necessary for the service you have expressly requested; storage therefore requires no consent (Art. 5 (3) sentence 2 of Directive 2002/58/EC; in Germany § 25 (2) no. 2 TDDDG), and subsequent processing is based on Art. 6 (1) (f) or (b) GDPR. We use no tracking, no advertising networks, no analytics services and no social media plug-ins. That is why you will not see a cookie banner here. Should we introduce services requiring consent in future, we will obtain your consent beforehand and update this policy.

2.3 Hosting and storage location

The website, the application and the database run on servers we operate at

The data centres used are located exclusively in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner; data is processed there solely on our instructions.

Measurement data: EEG recordings and the files derived from them are stored on the same infrastructure — on server storage and in Hetzner's S3-compatible object storage (Hetzner Object Storage), in each case at a location in Germany.

The website, the application, the database and the measurement data do not leave the EU. The only exception concerns possible support access in e-mail delivery — see 2.4. We will provide the current list of processors (Art. 28 GDPR) on request.

2.4 E-mail delivery

Our e-mails — in particular the sign-in links you use to log in without a password — are sent through the service of

This involves processing your e-mail address, the subject and content of the message and technical delivery logs. A data processing agreement under Art. 28 GDPR is in place with Zoho; our account is hosted in Zoho's European data centre. Where support or maintenance exceptionally requires access from a third country, we rely on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

Legal basis: Art. 6 (1) (b) GDPR (signing in is part of the user contract). A sign-in link is an access key — do not pass it on. It is valid only briefly and only once.

2.5 The beattime.live time service

To synchronise measurements to the millisecond, your browser contacts our time service beattime.live during a session. For technical reasons your IP address is transmitted and processed in that service's log files (purpose and periods as under 2.1). That service is operated by the same controller; no data is passed to third parties.

3. Contact form and e-mail

If you write to us using the form on the home page or by e-mail, we process: name, e-mail address, subject, message text, the language version chosen and — to prevent spam — your IP address and browser identification.

• Purpose: handling and answering your enquiry; protecting the form against automated bulk submissions.
• Legal basis: Art. 6 (1) (b) GDPR where the enquiry is directed at a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in communicating with interested parties and in an abuse-free form).
• Retention: until your enquiry has been dealt with and for a maximum of six months thereafter for follow-up questions; IP address and browser identification are deleted when the matter is closed. Statutory retention obligations remain unaffected.

To limit spam we additionally store a counter of submissions per IP address in our cache for a maximum of one hour.

4. User account

Measurements require an account. We then process:

• access data: e-mail address (sign-in by link or password), times of registration and sign-in;
• profile data (voluntary, used to assign you to a comparison group): year of birth — deliberately not the full date of birth — sex, handedness, preferred language;
• consents: which version of which document you accepted and when (the accountability requirement of Art. 7 (1) GDPR).

• Legal basis: Art. 6 (1) (b) GDPR (performance of the user contract); for profile data additionally your consent under Art. 6 (1) (a) GDPR insofar as it goes beyond what the contract requires.
• Retention: until the account is deleted. After deletion, records of the consents given remain until the limitation periods expire (usually 3 years).

5. EEG measurements and session data

This is the core of the service and the most sensitive processing. During a session we process:

• raw EEG data from your headband (four channels, 256 values per second), including signal quality indicators for each electrode;
• timestamps and synchronisation markers linking the recording to the film shown;
• session metadata: film and film version, start and duration, browser and device type, reasons for abandonment;
• analysis results: derived measures, charts and reports.

Legal basis: your explicit consent under Art. 9 (2) (a) in conjunction with Art. 6 (1) (a) GDPR. The full wording is set out in Consent to the processing of EEG and health data.

Separation and pseudonymisation: measurement data is stored under a pseudonym (participant identifier) rather than your name and is kept technically separate from account data. Backups of raw data are stored encrypted.

No automated decision-making: there is no automated decision-making, including profiling, producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR. Reports are information for you, not diagnoses.

Retention: until you withdraw your consent or delete your account. After withdrawal we delete the raw data without undue delay and at the latest within 30 days, including backups within the relevant backup cycle (no longer than 90 days).

6. Normative database and research

If you have given separate consent, your measurement data will feed into a comparison (normative) database and into analyses on the platform — including across modules, for example as a covariate in other studies or for training analysis methods.

• Legal basis: Art. 9 (2) (a) GDPR (separate consent); supplemented by Art. 89 GDPR with the safeguards provided for there.
• Form: analysis is carried out on pseudonymised data; only aggregated or anonymised results from which you cannot be identified are published or shared with third parties.
• Withdrawal: you may withdraw this consent separately from the consent under section 5. Anonymised analyses and already published aggregate results cannot be recalled — your raw data will, however, be removed from the database.

7. Shared sessions, your own films and participant panels

• Shared sessions: joining a shared session constitutes consent to share the results of that session in line with the visibility setting displayed before you join. This consent applies per session and can be withdrawn.
• Your own films: films you upload are not analysed for content — no scenes, faces or on-screen emotions are evaluated. Markers are applied purely as an even time grid. Your own films are never public; they are automatically scanned for malware before being accepted.
• Panels without an account: if you take part via an invitation link without your own account, we process your e-mail address as an identifier, optionally coarse details (age band, sex) and your measurement data. For studies commissioned by companies, the commissioning party is the controller and we act as processor under Art. 28 GDPR; this is stated on the consent screen of the invitation link. Panel participants' data does not feed into the normative database.

8. Recipients

We share your data only where necessary to provide the service or where you have consented. Categories of recipients:

• Hetzner Online GmbH as operator of the servers and object storage (processor under Art. 28 GDPR, data centres in Germany);
• Zoho Corporation B.V. (Beneluxlaan 4B, 3527 HS Utrecht, Netherlands) as operator of our e-mail service for sending sign-in links and notifications (processor under Art. 28 GDPR);
• organisers of studies you have expressly joined, within the visibility displayed;
• authorities and courts, insofar as we are legally obliged to disclose.

We do not sell data. Any monetisation of health data takes place exclusively in aggregated or anonymised form.

9. Your rights

• access to the data we hold about you (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability — you receive your measurement data in a common, machine-readable format (Art. 20 GDPR);
• objection to processing based on legitimate interests (Art. 21 GDPR);
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR) — the lawfulness of processing carried out beforehand remains unaffected.

An informal message to info@advena-partners.com is sufficient to exercise these rights. Consent to EEG processing can additionally be withdrawn at any time directly in your account settings.

Right to lodge a complaint: you may lodge a complaint with a data protection supervisory authority, in particular the authority responsible for us:

You may also complain to the supervisory authority of your habitual residence or place of work within the EU.

10. Whether providing data is required

Providing your data is neither a statutory nor a contractual requirement. Without an e-mail address, however, we cannot maintain an account, and without consent to the processing of EEG data we cannot carry out a measurement. Consent to use for the normative database (section 6) is entirely voluntary: you can use the full service without it.

11. Data security

Transmission is exclusively encrypted via TLS (HTTPS). We apply least-privilege access controls, separate storage of identity and measurement data, and encrypted backups. The connection to the headband is local, between your own device and the band; we receive the data only over the encrypted connection to our server.

12. Changes to this policy

We adapt this policy when the service or the legal situation changes. The version in force, with its version number and date, is always available on this page. Where material changes affect processing based on your consent, we will inform you separately and, where necessary, obtain fresh consent.