Last updated
15.10.2026
Privacy Policy: General
1. Introduction
This policy explains how Connectome uses your personal data when you visit our website, book a scan, become a member or use the Connectome app and platform. If you are taking part in the LUCID research study, the LUCID Study Participants policy also applies to you.
We follow the UK General Data Protection Regulation and Data Protection Act 2018, the EU General Data Protection Regulation and the Swiss Federal Act on Data Protection.
2. Who we are
Connectome Health GmbH ("Connectome", "we", "us") is the controller of your personal data. Our registered office is Tobeleggweg 22, 8049 Zurich, Switzerland. You can contact us about anything in this policy at hello@connectome.health.
Where we provide our services to an organisation, such as a clinic, research organisation or employer, and process personal data on its behalf, that organisation is the controller and we act as its processor.
Our UK and EU representatives
We have appointed EDPO UK Ltd as our representative in the UK under the UK GDPR. You can contact them using their online form at https://edpo.com/uk-gdpr-data-request/ or by post at Unit 33, Waterside, Schooner Court, 44-48 Wharf Road, London N1 7UX, United Kingdom.
We have appointed the European Data Protection Office (EDPO) as our representative in the EU under the GDPR. You can contact them using their online form at https://edpo.com/gdpr-data-request/ or by post at Avenue Huart Hamoir 71, 1030 Brussels, Belgium.
3. What we collect
Booking and contact details. Your name, email address and phone number when you book a scan, contact us or use our chat.
Payment details. What you bought, how much you paid and whether you pay in full or in instalments. Your card details are handled by our payment provider, Stripe. We never see or store your full card number.
Scan data. The brain activity measurements recorded during your scan (fNIRS signals from the prefrontal cortex) and your performance on the short tasks you do during the scan, such as accuracy and reaction time.
Your Brain Profile. The scores and insights we calculate from your scans, such as attention, working memory and cognitive flexibility, and notes from your results sessions.
Wearable data. If you choose to connect a wearable (for example Oura, WHOOP, Apple Health, Garmin or Fitbit), the data you allow us to read, such as sleep, heart rate, heart rate variability and activity.
Questionnaires. Any answers you give us about yourself, your lifestyle, sleep or wellbeing, such as your age range and gender.
Website and advertising data. Pages you visit, the device and browser you use, how you arrived at our site and whether you started or completed a booking. We only use cookies for analytics and advertising if you accept them in our cookie banner.
Marketing preferences. Whether you have asked to receive news from us.
Your scan data, Brain Profile, wearable data and questionnaire answers can reveal information about your health. We treat them as special category data and protect them accordingly.
4. How we use your data and our legal basis
To book and run your scans, deliver your Brain Profile and give you access to the app. This is necessary to provide the service you have bought (contract, Art 6(1)(b)). For your scan data, Brain Profile, wearable data and questionnaires we also rely on your explicit consent (Art 9(2)(a)), which we ask for before your first scan and when you connect a wearable.
To take payment and keep financial records. Contract (Art 6(1)(b)) and our legal obligations under accounting and tax law (Art 6(1)(c)).
To contact you about your bookings, results and membership. Contract (Art 6(1)(b)).
To answer your questions by email, phone or chat. Our legitimate interest in responding to you (Art 6(1)(f)).
To send you news and offers. Your consent (Art 6(1)(a)). You can unsubscribe at any time using the link in any email.
To understand how people use our website and to measure our advertising. Your consent (Art 6(1)(a)), given through our cookie banner.
To improve and develop our methods. We may use your scan and wearable data in pseudonymised form (with your name and contact details removed) to improve how we measure brain function. We only do this if you agree (Art 9(2)(a)), or where the law permits it for scientific research with appropriate safeguards (Art 9(2)(j)).
To keep our service safe and comply with the law. Our legitimate interests (Art 6(1)(f)) and our legal obligations (Art 6(1)(c)).
Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You can ask us for a copy of that assessment.
You can withdraw your consent at any time by emailing hello@connectome.health or changing your settings in the app. This does not affect anything we did before you withdrew it. If you withdraw consent for us to process your scan data, we will no longer be able to provide your Brain Profile.
Our service is for adults aged 18 and over. Your Brain Profile is a wellness measurement. It is not a medical diagnosis, and we do not make automated decisions about you that have legal or similarly significant effects.
5. Cookies
We use cookies and similar technologies on our website. Strictly necessary cookies keep the site working. Analytics and advertising tools (Google Analytics, Google Ads and the Meta pixel), and HubSpot's tracking and chat cookies, only run if you click Accept in our cookie banner. If you decline, we set a single cookie to remember your choice. You can change your mind at any time by clearing your cookies for connectome.health, which will show the banner again.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers who help us run Connectome. They act on our written instructions and are bound by data processing agreements that meet Art 28 UK/EU GDPR.
Kernel. Processing of fNIRS scan data.
H2 Cognitive Design. The platform for the cognitive tasks you do during your scan.
Google Cloud. Secure hosting of our app and database.
Terra API. Connecting and reading data from your wearable. We are moving our wearable connections from Sahha to Terra. Until that is complete, Sahha may also process wearable data on our behalf.
Stripe. Payment processing.
HubSpot. Customer records, email, website chat and our cookie banner.
Mailchimp. Our mailing list.
Framer. Hosting our website.
Google (Analytics and Ads) and Meta. Website analytics and advertising measurement, only if you accept cookies.
Garmin:
Garmin data delivered only to an endpoint owned and operated by Connectome GmbH and approved for our licensed application, never to any third-party endpoint
API credentials held exclusively by Connectome and never shared with, transferred to, disclosed to, or used by any third party.
No subcontractors for the Garmin integration. It will be built and run in-house by Connectome, with no involvement from Terra or any other third party
All program information, documentation, credentials and communications treated as confidential
Rewardful. Tracking referrals made through our referral programme.
UNTIL. Our London scans take place at UNTIL Soho. UNTIL may receive your name and appointment time so they can welcome you. They do not receive your results.
Wearable data we obtain through these connections is never shared with, processed by or made available to external AI providers or any other third party beyond the processors listed above.
Where we provide services to an organisation (for example a clinic or employer), we share personal data with that organisation in line with its instructions and our agreement with it. We may also share data where the law requires it, or with a buyer or successor if our business is sold or reorganised, in which case this policy will continue to apply to your data.
7. International transfers
We are based in Switzerland and some of our providers are based in, or store data in, the United States and other countries. When your data leaves the UK, Switzerland or the EEA, we rely on an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework where the provider is certified) or on standard contractual clauses with additional safeguards such as encryption.
8. How we keep your data safe
Our database runs on Google Cloud SQL with automated daily backups, and files are stored in Google Cloud Storage. All data is encrypted at rest using Google Cloud Key Management Service. Access is limited to the people in our team who need it to provide your service. Data used for research or method improvement is pseudonymised and kept separate from your name and contact details.
9. How long we keep your data
Your account, scan data and Brain Profile. For as long as you have an account with us. If you close your account or ask us to delete your data, we delete it unless we need to keep it for a legal reason. If your account is inactive for a long period, we will email you 30 days before deleting it.
Payment and accounting records. For as long as accounting and tax law requires, currently up to 10 years.
Consent records. For as long as we need them to show that we have met our legal obligations.
Marketing preferences. Until you unsubscribe, after which we keep a record that you opted out so we don't contact you again.
Enquiries and chat history. For up to 2 years after our last contact with you.
Pseudonymised data used to improve our methods. For as long as it is useful for that purpose. Fully anonymised data is no longer personal data and may be kept indefinitely.
10. Your rights
You have the right to:
access a copy of your personal data
correct data that is wrong or incomplete
ask us to delete your data
restrict or object to how we use your data, including for direct marketing
receive your data in a portable format, or ask us to send it to someone else
withdraw your consent at any time
To use any of these rights, email hello@connectome.health. We will respond within one month.
11. Complaints and contact
If you have a concern, please contact us first at hello@connectome.health and we will do our best to help. You also have the right to complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In Switzerland this is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
12. Changes to this policy
We may update this policy from time to time. We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will tell you before it takes effect.
Last updated
15.10.2026
Privacy Policy: General
1. Introduction
This policy explains how Connectome uses your personal data when you visit our website, book a scan, become a member or use the Connectome app and platform. If you are taking part in the LUCID research study, the LUCID Study Participants policy also applies to you.
We follow the UK General Data Protection Regulation and Data Protection Act 2018, the EU General Data Protection Regulation and the Swiss Federal Act on Data Protection.
2. Who we are
Connectome Health GmbH ("Connectome", "we", "us") is the controller of your personal data. Our registered office is Tobeleggweg 22, 8049 Zurich, Switzerland. You can contact us about anything in this policy at hello@connectome.health.
Where we provide our services to an organisation, such as a clinic, research organisation or employer, and process personal data on its behalf, that organisation is the controller and we act as its processor.
Our UK and EU representatives
We have appointed EDPO UK Ltd as our representative in the UK under the UK GDPR. You can contact them using their online form at https://edpo.com/uk-gdpr-data-request/ or by post at Unit 33, Waterside, Schooner Court, 44-48 Wharf Road, London N1 7UX, United Kingdom.
We have appointed the European Data Protection Office (EDPO) as our representative in the EU under the GDPR. You can contact them using their online form at https://edpo.com/gdpr-data-request/ or by post at Avenue Huart Hamoir 71, 1030 Brussels, Belgium.
3. What we collect
Booking and contact details. Your name, email address and phone number when you book a scan, contact us or use our chat.
Payment details. What you bought, how much you paid and whether you pay in full or in instalments. Your card details are handled by our payment provider, Stripe. We never see or store your full card number.
Scan data. The brain activity measurements recorded during your scan (fNIRS signals from the prefrontal cortex) and your performance on the short tasks you do during the scan, such as accuracy and reaction time.
Your Brain Profile. The scores and insights we calculate from your scans, such as attention, working memory and cognitive flexibility, and notes from your results sessions.
Wearable data. If you choose to connect a wearable (for example Oura, WHOOP, Apple Health, Garmin or Fitbit), the data you allow us to read, such as sleep, heart rate, heart rate variability and activity.
Questionnaires. Any answers you give us about yourself, your lifestyle, sleep or wellbeing, such as your age range and gender.
Website and advertising data. Pages you visit, the device and browser you use, how you arrived at our site and whether you started or completed a booking. We only use cookies for analytics and advertising if you accept them in our cookie banner.
Marketing preferences. Whether you have asked to receive news from us.
Your scan data, Brain Profile, wearable data and questionnaire answers can reveal information about your health. We treat them as special category data and protect them accordingly.
4. How we use your data and our legal basis
To book and run your scans, deliver your Brain Profile and give you access to the app. This is necessary to provide the service you have bought (contract, Art 6(1)(b)). For your scan data, Brain Profile, wearable data and questionnaires we also rely on your explicit consent (Art 9(2)(a)), which we ask for before your first scan and when you connect a wearable.
To take payment and keep financial records. Contract (Art 6(1)(b)) and our legal obligations under accounting and tax law (Art 6(1)(c)).
To contact you about your bookings, results and membership. Contract (Art 6(1)(b)).
To answer your questions by email, phone or chat. Our legitimate interest in responding to you (Art 6(1)(f)).
To send you news and offers. Your consent (Art 6(1)(a)). You can unsubscribe at any time using the link in any email.
To understand how people use our website and to measure our advertising. Your consent (Art 6(1)(a)), given through our cookie banner.
To improve and develop our methods. We may use your scan and wearable data in pseudonymised form (with your name and contact details removed) to improve how we measure brain function. We only do this if you agree (Art 9(2)(a)), or where the law permits it for scientific research with appropriate safeguards (Art 9(2)(j)).
To keep our service safe and comply with the law. Our legitimate interests (Art 6(1)(f)) and our legal obligations (Art 6(1)(c)).
Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You can ask us for a copy of that assessment.
You can withdraw your consent at any time by emailing hello@connectome.health or changing your settings in the app. This does not affect anything we did before you withdrew it. If you withdraw consent for us to process your scan data, we will no longer be able to provide your Brain Profile.
Our service is for adults aged 18 and over. Your Brain Profile is a wellness measurement. It is not a medical diagnosis, and we do not make automated decisions about you that have legal or similarly significant effects.
5. Cookies
We use cookies and similar technologies on our website. Strictly necessary cookies keep the site working. Analytics and advertising tools (Google Analytics, Google Ads and the Meta pixel), and HubSpot's tracking and chat cookies, only run if you click Accept in our cookie banner. If you decline, we set a single cookie to remember your choice. You can change your mind at any time by clearing your cookies for connectome.health, which will show the banner again.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers who help us run Connectome. They act on our written instructions and are bound by data processing agreements that meet Art 28 UK/EU GDPR.
Kernel. Processing of fNIRS scan data.
H2 Cognitive Design. The platform for the cognitive tasks you do during your scan.
Google Cloud. Secure hosting of our app and database.
Terra API. Connecting and reading data from your wearable. We are moving our wearable connections from Sahha to Terra. Until that is complete, Sahha may also process wearable data on our behalf.
Stripe. Payment processing.
HubSpot. Customer records, email, website chat and our cookie banner.
Mailchimp. Our mailing list.
Framer. Hosting our website.
Google (Analytics and Ads) and Meta. Website analytics and advertising measurement, only if you accept cookies.
Garmin:
Garmin data delivered only to an endpoint owned and operated by Connectome GmbH and approved for our licensed application, never to any third-party endpoint
API credentials held exclusively by Connectome and never shared with, transferred to, disclosed to, or used by any third party.
No subcontractors for the Garmin integration. It will be built and run in-house by Connectome, with no involvement from Terra or any other third party
All program information, documentation, credentials and communications treated as confidential
Rewardful. Tracking referrals made through our referral programme.
UNTIL. Our London scans take place at UNTIL Soho. UNTIL may receive your name and appointment time so they can welcome you. They do not receive your results.
Wearable data we obtain through these connections is never shared with, processed by or made available to external AI providers or any other third party beyond the processors listed above.
Where we provide services to an organisation (for example a clinic or employer), we share personal data with that organisation in line with its instructions and our agreement with it. We may also share data where the law requires it, or with a buyer or successor if our business is sold or reorganised, in which case this policy will continue to apply to your data.
7. International transfers
We are based in Switzerland and some of our providers are based in, or store data in, the United States and other countries. When your data leaves the UK, Switzerland or the EEA, we rely on an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework where the provider is certified) or on standard contractual clauses with additional safeguards such as encryption.
8. How we keep your data safe
Our database runs on Google Cloud SQL with automated daily backups, and files are stored in Google Cloud Storage. All data is encrypted at rest using Google Cloud Key Management Service. Access is limited to the people in our team who need it to provide your service. Data used for research or method improvement is pseudonymised and kept separate from your name and contact details.
9. How long we keep your data
Your account, scan data and Brain Profile. For as long as you have an account with us. If you close your account or ask us to delete your data, we delete it unless we need to keep it for a legal reason. If your account is inactive for a long period, we will email you 30 days before deleting it.
Payment and accounting records. For as long as accounting and tax law requires, currently up to 10 years.
Consent records. For as long as we need them to show that we have met our legal obligations.
Marketing preferences. Until you unsubscribe, after which we keep a record that you opted out so we don't contact you again.
Enquiries and chat history. For up to 2 years after our last contact with you.
Pseudonymised data used to improve our methods. For as long as it is useful for that purpose. Fully anonymised data is no longer personal data and may be kept indefinitely.
10. Your rights
You have the right to:
access a copy of your personal data
correct data that is wrong or incomplete
ask us to delete your data
restrict or object to how we use your data, including for direct marketing
receive your data in a portable format, or ask us to send it to someone else
withdraw your consent at any time
To use any of these rights, email hello@connectome.health. We will respond within one month.
11. Complaints and contact
If you have a concern, please contact us first at hello@connectome.health and we will do our best to help. You also have the right to complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In Switzerland this is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
12. Changes to this policy
We may update this policy from time to time. We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will tell you before it takes effect.