Privacy policy

1. Introduction

Connectome GmbH ("Connectome," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, disclose, and safeguard your personal data when you visit our website https://www.connectome.health/ ("Website") and interact with our services, including participation in the LUCID: Understanding the Connection Between Lifestyle and fNIRS-Defined Brain States research study ("the Study").

We comply with applicable data protection regulations, including the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

2. Data Controller

  • Imperial College London is the research Sponsor and joint Data Controller with Connectome GmbH.

  • If you have any questions about how your data is handled, you may contact us at:

    • Email: hello@connectome.health

    • For data protection inquiries, you may also contact Imperial College London’s Data Protection Officer (DPO) at dpo@imperial.ac.uk.

3. Information We Collect and Store

3.1 Personal Data

We collect the following personal data to facilitate study administration, participant tracking, and compliance with research ethics:

  • Demographic Information: Age, gender.

  • Health Survey Data: Self-reported health history, including prior neurological or health conditions, pregnancy status, and other relevant factors.

  • Contact Information: Email address (used solely for scheduling and communication).

  • Consent Forms: Signed informed consent documents confirming voluntary participation.

  • Hair Image: A close-up photo of the participant’s hair, with precautions taken to avoid capturing personal identifying features such as the face or ears.

  • Participation Status: Records of completed sessions and withdrawal requests (if applicable).

3.2 Physiological Data – Collected via Kernel Flow 2 fNIRS Device

The Kernel Flow 2 functional near-infrared spectroscopy (fNIRS) device is used to measure brain activity. The following data is collected:

  • Brain Imaging Data: fNIRS data capturing cerebral hemodynamic responses (blood oxygenation levels) during rest and cognitive tasks.

3.3 Physiological Data – Collected via Wearables and Cognitive Tasks

Additional physiological and behavioral data is collected through wearable devices and cognitive task performance:

  • Lifestyle Factors (Pre-Test Data): Includes sleep quality, exercise levels, mood assessments, and heart rate metrics (resting state, variability, etc.).

  • Cognitive Task Performance (During Testing):

    • Tests measuring working memory, executive function, cognitive flexibility, cognitive load management, spatial reasoning, language comprehension, and logical reasoning. Includes accuracy scores, reaction times.

    • Includes accuracy scores, reaction times.

We do not collect financial information or sensitive biometric data beyond what is strictly necessary for research purposes.

3.4 Data Collection, Storage, and Security

Connectome GmbH

Connectome GmbH is responsible for collecting, processing, and aggregating data related to the study. All data at Connectome is securely stored on Google Cloud Platform (GCP) infrastructure, ensuring compliance with EU data protection regulations.

  • Primary Database: Hosted on Cloud SQL (Google Cloud’s managed relational database service) with automated daily backups and point-in-time recovery capabilities.

  • Storage of Files & Media: Other files, documents, and media are securely stored in Google Cloud Storage.

  • Encryption: All data is encrypted at rest using Google Cloud Key Management Service (Cloud KMS).

  • Access Control: Strictly managed through standard identity and access management policies to ensure only authorised personnel can access sensitive data.

  • Participant Dashboard: Participants will be able to view their results through the Connectome Data Dashboard.

  • Personal Details: Kept on the Connectome platform unless explicitly requested for deletion by participants. This allows participants to view personalized data results.

Imperial College London

Imperial College London will store primary research data in its Research Data Store, ensuring compliance with academic and regulatory standards:

  • Storage Location: All raw and processed research data will be stored on Imperial College’s Research Data Store (RDS).

  • Access Control: Only authorized researchers will have access, managed via role-based access permissions.

  • Pseudonymization: Raw and processed data will be separated from participant identifying information and assigned a unique study ID to maintain participant anonymity.

  • Physical Document Security: Any physical documents, such as consent forms, will be securely stored in a locked cabinet inside the door-coded office of the principle investigator at Imperial College London.

3.5 Data Retention and Future Use

Imperial College London

  • Research data will be retained for 10 years after the study’s completion.

  • Pseudo-anonymized and aggregated data may be retained for secondary analysis in future research projects focused on neuroimaging and lifestyle correlates.

  • Data will be stored on the Imperial College London Research Data Store (RDS) for raw research data and backups, with the principle investigator as the data gatekeeper.

  • Participants will be asked during the consent process whether they agree for their data to be used in future research, including: 

    • Development of new tests, medications, or treatments by an academic institution or commercial company, including those outside the United Kingdom.

    • If participants do not consent to future use, their data will be excluded from any subsequent studies and securely deleted.

University of Zurich

  • Pseudo-anonymized fNIRS, cognitive task, and hair type data (description and photograph) will be shared with Professor Manuel Gunther, AI & ML Group Lead at the University of Zurich.

  • This collaboration supports a study to remove hair-related biases from Connectome’s signal processing, ensuring equity in fNIRS neuroimaging.

Connectome GmbH

  • Personal details will be kept on the Connectome platform unless explicitly requested to be deleted by participants.

  • Pseudo-anonymized and aggregated data may be retained for secondary analysis in future research projects focused on neuroimaging and lifestyle correlates.

  • Datasets may be made available to approved researchers under data-sharing agreements that ensure proper use.

  • Research data will be retained for 10 years after the study’s completion.

  • After 10 years, participants will be given the opportunity to remove their data. If no answer is provided, the data will be automatically removed.

  • Consent Management: Participants can easily withdraw or modify their consent at any time using the Connectome Webapp.

4. Data Sharing and Third-Party Processors

We will only share pseudo-anonymized research data with:

4.1 Research Collaborators

  • Imperial College London (Joint Data Controller)

  • University of Zurich (conducting fNIRS signal analysis for hair-types)

4.2 Third-Party Data Processors

We use third-party service providers for data processing, including:

  • Kernel – Processing fNIRS brain activity data.

  • H2 Cognitive Design (H2CD) – Processing cognitive performance data.

  • Sahha – Processing wearable device data.

These parties are contractually obligated to comply with GDPR and data security standards.

4.3 International Data Transfers

Where data is transferred outside the UK/EU, we ensure adequate protection through:

  • Standard Contractual Clauses (SCCs)

  • UK/EU adequacy decisions

5. Your Rights Under GDPR

You have the following rights concerning your data:

  • Right to Access: Request a copy of your personal data.

  • Right to Rectification: Correct inaccurate or incomplete data.

  • Right to Withdraw Consent:  Withdraw from the Study at any time.

  • If you choose to withdraw from the study, no further data will be collected from you. However, data already collected up to the point of withdrawal may be retained and used for research purposes in accordance with the UK GDPR research and statistics exemption (Article 89(1)). This means your data may continue to be processed if it is necessary for scientific research and is subject to appropriate safeguards. 

  • Right to Data Portability: Receive a copy of your data in a structured format.

  • Right to Restrict Processing: Limit how we use your data.

6. Commercialisation and Future Research

  • Data may contribute to commercial research (e.g., development of neurotechnology software analysis tools).

  • Any commercial use of your data will involve aggregated or pseudo-anonymized datasets.

  • Your personal identity will never be shared with commercial partners.

  • You may opt-out of future research data use.

7. Complaints and Contact Information

If you have concerns about how your data is processed, you may contact:

Research Team Contact:

Imperial College London Data Protection Officer (DPO):

Contact Us

If you need to contact us for any reason specified above, or if you have any questions or concerns about our Privacy Policy, please contact us at hello@connectome.health.