This policy applies to all visitors and users of NeuropathIQ platforms. It covers our obligations under PIPEDA (Canada), GDPR (European Union), CCPA/CPRA (California, USA), and applicable US state privacy laws.
NeuropathIQ Inc. is incorporated under the laws of British Columbia, Canada. We operate the evidence intelligence platform accessible at neuropathiq.com, neuropathiq.com, and neuropathiq.ca (the "Platform").
For purposes of GDPR, NeuropathIQ Inc. is the data controller of personal information collected through the Platform. For purposes of CCPA/CPRA, NeuropathIQ Inc. is the business.
Data Controller / Privacy Officer
NeuropathIQ Inc.
British Columbia, Canada
Email: privacy@neuropathiq.com
This policy applies to all personal information collected through the Platform, our website, email communications, and any related services. NeuropathIQ complies with the following privacy frameworks:
| Law | Jurisdiction | Applies to |
|---|---|---|
| PIPEDA (Personal Information Protection and Electronic Documents Act) | Canada | All users |
| GDPR (General Data Protection Regulation) | European Union / EEA | EU/EEA residents |
| UK GDPR | United Kingdom | UK residents |
| CCPA/CPRA (California Consumer Privacy Act as amended by the California Privacy Rights Act) | California, USA | California residents |
| US State Privacy Laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and others) | Various US states | Applicable state residents |
Where laws differ, we apply the most protective standard available. If your jurisdiction grants rights not listed here, you retain those rights and may exercise them by contacting us.
We collect the minimum personal information necessary to operate the Platform. We do not collect health data, medical records, government IDs, biometric data, financial account details, or any sensitive personal information beyond what is listed below.
| Category | Specific data | Source |
|---|---|---|
| Contact & registration | Email address, name (optional), institutional affiliation (optional), professional role (optional) | Provided by you |
| Search queries | Text entered into the Platform search. Transmitted to Anthropic's Claude API for AI analysis. Logged for debugging. | Provided by you |
| Usage data | Searches run, results expanded, AI insights reviewed, features accessed. Used only to improve the Platform. | Automatically collected |
| Technical data | IP address (hashed for privacy), browser type, pages visited, timestamps, device type. Used for security and performance only. | Automatically collected |
| Communications | Emails you send to us, support enquiries, advisory board correspondence. | Provided by you |
We do not collect: Social Security numbers, financial account numbers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, health or medical information, or the personal information of children under 18.
For users in the EU, EEA, and UK, we identify a lawful basis under GDPR Article 6 for each processing activity:
| Processing activity | Lawful basis |
|---|---|
| Providing early access and Platform services | Contract — Art. 6(1)(b): necessary to provide the service you requested |
| Sending platform updates and service communications | Contract / Legitimate interests — Art. 6(1)(b)/(f): necessary to maintain service relationship |
| AI analysis of search queries via Anthropic API | Contract — Art. 6(1)(b): necessary to deliver the AI-assisted research feature you actively requested |
| Security, fraud prevention, abuse detection | Legitimate interests — Art. 6(1)(f): protecting the platform and users from harm |
| Platform improvement and analytics | Legitimate interests — Art. 6(1)(f): improving service quality, balanced against your privacy rights |
| Compliance with legal obligations | Legal obligation — Art. 6(1)(c): compliance with applicable law |
We do not rely on consent as the primary lawful basis for any processing activity, meaning you do not need to withdraw consent to stop processing — you may exercise your rights to object or request deletion at any time as described in Section 11.
We do not use personal information for: advertising targeting, profiling for unrelated purposes, sale to third parties, training AI models on your data, or automated decision-making that produces legal or similarly significant effects on you.
NeuropathIQ uses Anthropic's Claude API to generate AI-assisted research insights. When you use search and AI features, your search query and relevant scientific context are transmitted to Anthropic's API servers in the United States for processing.
Key facts about this processing:
The GDPR lawful basis for transmitting your query to the Anthropic API is contract performance (Art. 6(1)(b)) — it is strictly necessary to deliver the AI research feature you have actively requested by using the Platform.
We share personal information only with service providers necessary to operate the Platform. Each provider is bound by a data processing agreement requiring them to process your data only on our instructions and to maintain appropriate security.
| Provider | Purpose | Location | Data shared |
|---|---|---|---|
| Supabase Inc. | Database hosting | Canada / USA (AWS) | Account data, usage data |
| Vercel Inc. | Website hosting and edge delivery | USA / Global CDN | Technical logs, IP addresses |
| Anthropic PBC | AI analysis (Claude API) | USA | Search queries and context only |
| Brevo (Sendinblue) | Early access email list management | EU / USA | Email address, access date |
We do not share personal information with: research institutions, pharmaceutical companies, advertisers, data brokers, analytics companies, or any third party for their own commercial purposes.
NeuropathIQ does not sell, rent, share for advertising purposes, or otherwise transfer your personal information to any third party for monetary or other valuable consideration.
This applies to all users globally. For California residents specifically: we do not "sell" or "share" personal information as defined under CCPA/CPRA. We do not engage in cross-context behavioral advertising. The "Do Not Sell or Share My Personal Information" right under CCPA applies but there is nothing to opt out of — we have no such practices.
We do not use your data to train AI models, license data sets, or create derived commercial products from your personal information.
We retain personal information only for as long as necessary for the purposes described in this policy, or as required by law.
| Data category | Retention period | Reason |
|---|---|---|
| Email address / account data | While active + 90 days after deletion request | Service delivery |
| Search query logs | 90 days, then permanently deleted | Debugging and quality |
| Usage logs | 12 months, then anonymized aggregate only | Platform improvement |
| Technical / server logs | 30 days | Security and performance |
| Communications (emails, support) | 3 years from last contact | Legitimate interests / legal records |
| Financial / billing records | 7 years | Canadian tax and accounting law |
When retention periods expire, data is either permanently deleted or irreversibly anonymized. Anonymized aggregate data is not personal information and is not subject to retention limits.
NeuropathIQ is operated from Canada. When you use the Platform, your data may be transferred to and processed in Canada and the United States. The United States does not have an EU adequacy decision under GDPR.
Safeguards for EU/EEA/UK users: Transfers to US-based service providers (Supabase, Vercel, Anthropic) are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards for international transfers under GDPR Article 46.
Canada is recognized by the European Commission as providing an adequate level of protection for personal data under GDPR, meaning transfers to Canada do not require additional safeguards.
By using the Platform, you acknowledge that your data will be processed in Canada and the United States under the safeguards described above.
Regardless of where you are located, you have the following rights over your personal information. We respond to all requests within 30 days (extendable to 45 days where legally permitted with notice).
To exercise any right, email privacy@neuropathiq.com with a description of your request. We may ask for information to verify your identity before processing the request. We will not charge a fee for reasonable requests.
This section applies to residents of California and supplements the rest of this policy. References to "personal information" have the meaning given under the CCPA.
In the past 12 months, NeuropathIQ has collected the following categories of personal information from California residents:
We do not collect: Social Security numbers, financial information, health information, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic data, biometric data, or any other sensitive personal information as defined under CPRA.
Directly from you (registration, search queries, communications) and automatically from your use of the Platform (technical and usage data).
Providing, maintaining, and improving the Platform; security and fraud prevention; communications about the service; legal compliance.
Identifiers and internet activity are shared with Supabase (database), Vercel (hosting), Anthropic (AI processing), and Brevo (email) as described in Section 7. Each provider receives only the data necessary for their specific function.
NeuropathIQ does not sell personal information and does not share personal information for cross-context behavioral advertising. You have the right to opt out of the sale or sharing of your personal information — but we have no such practices to opt out of. Exercising this right will have no effect on your access to the Platform.
We do not collect sensitive personal information as defined under CPRA. The "Limit the Use of My Sensitive Personal Information" right is acknowledged but inapplicable to our current data practices.
California residents have the following additional rights under CCPA/CPRA:
To submit a CCPA rights request, email privacy@neuropathiq.com. We will verify your identity and respond within 45 days (extendable by a further 45 days with notice). You may authorize an agent to submit a request on your behalf.
NeuropathIQ recognizes and honors Global Privacy Control signals as a valid opt-out of the sale and sharing of personal information, as required under CCPA/CPRA. Since we do not sell or share personal information, honoring a GPC signal will have no practical effect but we process it as required.
NeuropathIQ does not use automated decision-making technology (ADMT) to make decisions with legal or similarly significant effects on California residents. AI-generated research insights are hypothesis-generating tools for qualified researchers and are not decisions.
California residents may request information about personal information disclosed to third parties for their direct marketing purposes during the past calendar year. NeuropathIQ does not disclose personal information to third parties for direct marketing purposes. There is nothing to report under this provision.
This section supplements the rest of this policy for residents of the European Union, European Economic Area, and United Kingdom.
In addition to the rights in Section 11, EU/EEA/UK residents have the right to:
We conduct DPIAs for processing activities that may present high risk to individual rights, including our use of AI processing via the Anthropic API. Our assessment concluded that risk to individuals is low because: (a) we process only research queries, not sensitive personal data; (b) AI outputs are advisory only and do not affect individual rights or access to services; (c) we do not build individual profiles or make automated decisions.
NeuropathIQ does not currently have a formal EU Representative under GDPR Article 27, as our processing of EU resident data is not systematic, large-scale, or likely to result in high risk to EU residents. If this changes, we will appoint a representative and update this policy.
NeuropathIQ is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy legislation.
Under PIPEDA you have the right to access personal information we hold about you and to challenge its accuracy. Contact our Privacy Officer at privacy@neuropathiq.com.
In the event of a breach of security safeguards that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA, within 72 hours of becoming aware of the breach.
To contact the Office of the Privacy Commissioner of Canada: priv.gc.ca · 1-800-282-1376
NeuropathIQ uses a minimal set of cookies. We do not use advertising cookies, cross-site tracking, third-party marketing pixels, Google Analytics, or any behavioral tracking technology.
| Cookie | Purpose | Duration | Required |
|---|---|---|---|
| Session cookie | Maintains your login session | Session | Yes — strictly necessary |
| Search counter | Tracks free search count (pre-registration) | 30 days | Yes — Platform function |
| Preferences | Remembers UI settings | 1 year | No — clearable in browser settings |
We honor Global Privacy Control (GPC) browser signals. We do not use non-essential cookies without your consent. Because we use only strictly necessary and functional cookies, a cookie consent banner is not required under ePrivacy Directive standards — but you may clear all cookies in your browser settings at any time.
We implement appropriate technical and organizational security measures to protect personal information against unauthorized access, loss, destruction, or alteration:
No transmission over the internet is 100% secure. In the event of a breach posing real risk of significant harm, we will notify affected individuals and applicable regulators within 72 hours (PIPEDA) or 72 hours (GDPR Article 33) of becoming aware.
NeuropathIQ is designed exclusively for qualified scientific, medical, and research professionals. It is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18.
If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@neuropathiq.com and we will delete it promptly.
We will notify you of material changes to this policy by email (where we hold your email address) and by posting a prominent notice on the Platform, at least 30 days before changes take effect. The "Last updated" date at the top of this page reflects the date of the most recent revision.
For non-material changes (such as clarifications or corrections that do not affect your rights), we will update the policy without notice but will update the "Last updated" date.
Your continued use of the Platform after the effective date of any revised policy constitutes acceptance of the updated terms.
Privacy Officer
NeuropathIQ Inc.
British Columbia, Canada
Email: privacy@neuropathiq.com
We aim to respond to all privacy requests within 30 days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant supervisory authority:
Legal note: This privacy policy is provided for informational purposes and reflects NeuropathIQ's good-faith compliance efforts as of the date noted above. It is not a substitute for legal advice. Privacy laws evolve rapidly — we review and update this policy at least annually. If you have compliance questions specific to your organization's use of the Platform, we recommend consulting qualified legal counsel.