Axite B.V. Brain Activity Monitoring Service
Introduction
At Axite B.V. ("Company," "we," "our," or "us"), your privacy is our priority. We are committed to safeguarding your personal data and ensuring full compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws. This Privacy Policy explains how we collect, use, share, and protect your data when you interact with our brain activity monitoring service ("Service").
This policy is intended for end-users aged 16 and above who use our products and services. If you are under 16, please do not use the Service without parental or guardian consent.
Data We Collect
When you use our Service, we may collect the following types of data:
Android Apps (Neurojournal or Tacet)
Smartphone Usage Data
The model of the mobile device on which the app is installed.
The timing of each touchscreen interaction, including time zone.
The names and launch times of the apps run on the mobile device.
The battery log of the mobile device.
Usage patterns, and performance and stability indicators of the Axite apps themselves.
Motion data from the device's motion sensors (raw accelerometer, pedometer and gyroscope), including derived activity types such as walking, or travelling by car or train.
Optional data
Providing this information is entirely at the user's discretion. In research contexts researchers may choose to turn on or off the request of the following information:
Sensor data when using the Muse EEG hardware
Brain activity data recorded using EEG device(s).
Functional Near-Infrared Spectroscopy (fNIRS)
Gyroscope data
Accelerometer data
EEG Device type and device ID
Journal Functionalities
Tags, labels, or keywords manually created or added via our speech-to-text feature. We do not store your audio data.
Check-ins about reported life events
Seizure information, including type, frequency, duration, symptoms, and additional notes.
Medication information, including type, dosage, and frequency.
Other
Cognitive test performance data (if participating for research purposes).
Voluntary survey responses related to brain health (if participating for research purposes).
Physiological data from optional wearables, including heart rate, sleep patterns, and activity levels.
Contact details, including username and email address. First and last name, if a user contacts us with an inquiry or feedback about the app.
Billing details when you buy a subscription. Checkout is handled by our payment provider, Stripe, which collects your card details directly on its own systems. We never receive or store your card number or your bank account number (IBAN). From Stripe we receive only what we need for our records and invoices, such as your name, billing address, VAT number, the country of the card and the last four digits.
Demographic information such as age and gender. We collect month and year of birth only, not full date of birth.
Any personal data is retained prior to anonymization to facilitate deletion requests. Once anonymized, data can no longer be linked to an individual and therefore cannot be deleted.
Website (Neurojournal Hub)
Login information including email address, password, first and last name and optional username.
Information about your projects including name, description and durations.
This Website (axitetech.com)
This section covers our public website, which is separate from the apps and the NeuroJournal Hub described above.
What the website collects. The website sets no cookies and runs no analytics, advertising or tracking scripts. The only personal data it collects is what you type into one of our forms:
Waitlist form: your name, email address, the role you select, and optionally your organisation and a short message. One of the role options identifies you as a person with epilepsy or as a caregiver. If you choose it, or if you describe a health condition in the message field, that is health data under Article 9 GDPR and we process it only on the basis of your explicit consent, given by submitting the form after reading this notice.
Contact form: your first and last name, email address and the message you write.
Mailing list: your email address only.
We use these details solely to reply to you, to assess whether NeuroJournal fits your study, and — for the mailing list — to send occasional product and research updates. We do not sell them or use them for advertising. You can ask us to delete them at any time by emailing info@axitetech.com.
Processors used by the website.
Webstudio and Cloudflare host and deliver the site. Cloudflare terminates the connection and keeps short-lived server logs, including IP addresses, for security and abuse prevention.
Google (Apps Script, Sheets and Gmail) receives and stores form submissions. When you submit a form, its contents are written to a Google Sheet in our Google Workspace account and emailed to us. Google acts as our processor under its data processing terms.
Google Calendar powers the appointment scheduler embedded on our "Book a demo" page. Opening that page loads content from Google, which receives your IP address and may set its own cookies. The details you enter when booking are handled by Google and by us as the meeting host.
Google Fonts serves the typefaces used across the site. Your browser requests them from Google's servers, which receives your IP address.
Stripe handles NeuroJournal subscription checkout. When you click a purchase link you leave our website for Stripe's hosted checkout. Stripe collects and processes your payment details directly; we never see or store your full card number. Stripe's own privacy policy applies to that step.
Some of these providers are established outside the European Economic Area. Where that is the case, transfers are covered by the European Commission's Standard Contractual Clauses and the providers' supplementary safeguards.
Retention. Form submissions are kept for as long as we are in contact with you about your enquiry, and reviewed periodically. Mailing-list entries are kept until you unsubscribe.
How We Use Your Data
We use the collected data for the following purposes:
To provide you with personalized insights and reports.
To improve and develop our products and services.
For research and analytical purposes.
Commercial Use: Anonymized data may be used for commercial purposes such as product development, marketing insights, and business analytics.
To comply with legal and regulatory requirements.
Who Can Access Your Data
Access to your personal and EEG data is strictly limited to authorised Axite developers and technical staff who need it to operate, maintain, or improve the Service. All such access is protected by confidentiality agreements and role-based permissions. We do not share identifiable data with third parties except trusted service providers (such as our cloud host, Supabase) acting under our instructions and under data-processing agreements. The hosting regions of those providers, and the safeguards that apply to them, are set out under “Data Storage and Security” below. Researchers may access your data if you have explicitly consented to participate in a study.
Legal Basis for Processing
We process your personal data based on the following legal grounds:
Your explicit consent. Where we process health-related data — such as EEG recordings, seizure information or medication information — we rely on your explicit consent under Article 9(2)(a) GDPR. You give that consent through a clear affirmative action when you create an account, enrol in a study or switch on an optional data source. Continuing to use the Service is not by itself treated as consent, and you can withdraw consent at any time without affecting processing that already took place.
Compliance with legal obligations.
Legitimate interests in improving our Service while maintaining privacy safeguards.
Data Storage and Security
International transfers — under review. We are currently verifying the hosting region of each of our cloud providers and consolidating all storage onto EU infrastructure. Until that review is finished we do not claim that every component is hosted inside the EEA. Where personal data is transferred outside the EEA, we rely on the European Commission’s Standard Contractual Clauses. We will replace this paragraph with the confirmed providers, regions and safeguards as soon as the review concludes. If you need our current position before then, email info@axitetech.com and we will tell you where your data sits.
All collected data is encrypted and stored securely on cloud servers (Supabase, AWS and Microsoft Azure) under anonymised codes.
Data transmission from your device to our servers only occurs over secure networks.
We implement industry-standard security measures to prevent unauthorized access, alteration, or loss of your data.
If provided personal data is stored securely before anonymization to facilitate deletion requests.
Sharing your data
We may share anonymized data with:
Third-party partners for research and development purposes.
Regulatory bodies if legally required.
Your Rights Under GDPR
As a data subject under GDPR, you have the following rights:
Right to Access: Request access to the data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your data (before anonymization).
Right to Withdraw Consent: Withdraw your consent at any time and stop using our service.
Right to Restriction of Processing: Ask us to limit how we use your data while a dispute about its accuracy or our legal basis is resolved.
Right to Data Portability: Request transfer of your data in a structured format.
Right to Object: Object to data processing based on legitimate interests.
You can send a request for access, rectification, erasure, or data transfer of your personal data or a request to withdraw your consent or object to the processing of your personal data to info@axitetech.com. We will respond as quickly as possible, and in any case within one month of receiving your request, as required by Article 12(3) GDPR.
Axite B.V. also wants to inform you that you have the option to file a complaint with the national supervisory authority, the Dutch Data Protection Authority. This can be done via the following link:
https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/tip-ons
Automated Decision-Making
Axite uses automated processing to produce the cognitive measures at the heart of the Service. Specifically:
Machine-learning algorithms derive your cognitive function scores from EEG and smartphone-interaction data.
Mathematical comparisons against aggregated and normative datasets place those scores in context.
These scores are descriptive measurements. They are not used to make decisions that produce legal effects for you or similarly significantly affect you, and NeuroJournal is not CE marked, so the scores are not used for diagnosis, treatment or any clinical decision. Where a researcher or clinician uses them, a human being always interprets them and decides what follows. If you believe an automated output has affected you, you have the right under Article 22 GDPR to obtain human intervention, to express your point of view and to contest the outcome — write to info@axitetech.com.
Data Retention
We retain your data for as long as necessary to provide the Service and comply with legal obligations. If you withdraw consent, we will delete your data within 30 days. Personal data will be stored only until it is anonymized. After anonymization, data cannot be traced back to you and therefore cannot be deleted.
Cookies and Tracking Technologies
Our public website (axitetech.com) sets no cookies of its own and runs no analytics or advertising trackers, so there is no cookie banner to accept. Third-party content embedded on the site — the Google Calendar scheduler on our "Book a demo" page — may set cookies from Google when you open that page. Our apps and the NeuroJournal Hub use only the cookies and local storage needed to keep you signed in and to remember your preferences. You can clear or block cookies through your browser or device settings, though signing in may stop working if you do.
Third-Party Services
Our Service may include links to third-party platforms such as QuantActions, Muse, Brainbit, Emotiv, Oura or Garmin. We are not responsible for their privacy practices, and we encourage you to review their respective privacy policies.
How we secure personal data
Axite B.V. takes the protection of your data seriously and takes appropriate measures to prevent misuse, loss, unauthorized access, unwanted disclosure, and unauthorized modification.
Encryption: We encrypt your (personal) data both in transit and at rest to prevent unauthorized access.
TLS encryption (HTTPS) to protect data during transfer.
Access to personal data is limited to authorized personnel and protected with multi-factor authentication.
We regularly update our systems and software to fix vulnerabilities and maintain security.
We perform regular, encrypted backups of our systems and test recovery procedures to ensure data can be restored if needed.
We only collect and store personal data that is necessary for our services.
We integrate data protection measures into all our processes and systems from the start.
We maintain clear procedures for the handling, storage, and deletion of personal data, and conduct regular audits to ensure compliance.
Updates to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices. We will notify you of significant changes through our website or app. If you are participating in a research study you will be informed by the lead researcher of any changes of the privacy policies.
Contact Information
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at:
Axite B.V.
Langegracht 70, 2312 NV Leiden, Netherlands
Email: info@axitetech.com
Phone: +31649972892