Privacy Policy

Privacy & Data Use Your privacy is central to how MyBrainOS and SEEFA are designed. SEEFA is a developmental and educational workplace self-regulation profile. It helps you reflect on how executive self-regulation patterns show up in work or study. It is not a diagnostic tool, not a clinical assessment, and must not be used for hiring, firing, promotion, compensation, performance appraisal, or fitness-for-role decisions. We treat assessment data as sensitive. This means we collect only what is needed, explain why it is collected, and give you meaningful control over your data. 1. What We Collect We may collect the following categories of data when you use MyBrainOS or complete SEEFA. Account information If you create an account, we may collect your email address, account creation date, login method, and basic account settings. If password login is available, passwords are never stored in plain text. Password credentials are processed through secure authentication systems and are not visible to MyBrainOS staff. Assessment responses We collect your responses to SEEFA items. Depending on the version you complete, this may include: * SEEFA-Brief responses * SEEFA-Full responses * Quality-control responses * Environmental Fit Module responses * Contextual Intake Module responses These responses are used to generate your personal profile, scores, interpretation, and coaching-oriented recommendations. Assessment metadata To support scoring quality, accessibility review, and research calibration, we may collect limited assessment metadata such as: * assessment version * instrument version * item order * completion status * timestamps * response latency * revision counts * pause counts * quality-control flags * device or display context where needed for technical reliability This metadata helps us identify incomplete, automated, inconsistent, or unusually low-effort submissions. It is not used to diagnose you. Slow responding is not treated as a failure by itself. It may reflect careful responding, dyslexia, ADHD, non-native language use, assistive technology, fatigue, or accessibility needs. ### Environmental and contextual data SEEFA may ask about your work or study environment, such as interruption load, task switching, clarity of deadlines, focus time, structure, and autonomy. These data are used to interpret your profile in context. They are not treated as personal deficits. SEEFA may also ask optional contextual questions about sleep, stress, recent disruption, or neurodivergence/diagnosis status. These questions are used only where appropriate for state/context qualification, fairness monitoring, research calibration, or safeguarding. Questions about neurodivergence, diagnosis, disability, or health-related context are optional. They require clear consent and are not shown to employers at an individual level. Reports and generated outputs We may store reports, scores, radar profiles, coaching suggestions, PDF exports, and user-controlled sharing records associated with your account or session. Technical and security data We may collect limited technical data needed to keep the platform secure and reliable, such as: * browser and device type * approximate timezone * error events * security events * rate-limit signals * anti-abuse signals We use this information to maintain the service, prevent abuse, debug errors, and protect user accounts. 2. How We Use Your Data We use your data for the following purposes. Personal insight and reporting We use your assessment responses and contextual data to generate your SEEFA profile, factor scores, highlighted patterns, environmental lens, state/context caveats, and practical coaching experiments. SEEFA does not produce a diagnosis. It does not label you as having ADHD, autism, dyslexia, anxiety, depression, or any other clinical condition. Product improvement and calibration We may use aggregated or de-identified data to improve scoring quality, item clarity, accessibility, reliability, validity evidence, and report usefulness. For example, we may analyze completion time, dropout points, item response distributions, quality-control patterns, or aggregate factor trends. We do not use aggregated data to identify individual users. Research and validation SEEFA is evidence-informed and undergoing validation. We may use appropriately protected data to evaluate reliability, factor structure, fairness, accessibility, measurement quality, and differential response patterns. Where research use requires additional consent, we will ask for it separately. Security and abuse prevention We use technical metadata, quality-control signals, and security logs to protect the platform from spam, bots, fraudulent submissions, unauthorized access, and misuse. 3. What We Do Not Do We do not sell your individual assessment data. We do not rent or trade your individual profile to advertisers. We do not provide your individual results to your employer without your explicit action or consent. We do not allow SEEFA to be used for hiring, firing, promotion, compensation, performance appraisal, fitness-for-role decisions, or employee ranking. We do not use SEEFA to diagnose ADHD, autism, dyslexia, anxiety, depression, or any other medical or psychological condition. We do not show individual neurodivergence, diagnosis, disability, or health-related information in employer reports. 4. AI Processing MyBrainOS may use AI systems to help generate explanatory reports, summaries, or coaching-oriented suggestions. When AI processing is used, we apply data minimization. We aim to send only the information needed to generate the relevant output, such as factor scores, score bands, selected context, work/study goals, and non-identifying profile information. We do not intentionally send your password, raw authentication credentials, payment details, or unnecessary account identifiers to AI systems. Where available, we use provider settings and contractual terms designed to limit training use and retention of submitted prompts and outputs. AI-generated content is used to support reflection and coaching. It is not medical advice, not a diagnosis, and not a substitute for a qualified professional. 5. Analytics and Error Tracking We may use privacy-conscious analytics and error-tracking tools to understand how the product is used and to keep it stable. Analytics may include page views, feature usage, completion events, consent choices, and general product interaction patterns. Error tracking may include technical information needed to diagnose bugs, crashes, or failed requests. Where possible, these tools are configured to reduce or mask personal data. Cookie-based or non-essential analytics should only run where consent has been granted, depending on the user’s location and applicable law. 6. User-Controlled Sharing Your individual SEEFA results are private by default. You may choose to share your report with a coach, psychologist, mentor, manager, or another person you trust. Sharing is controlled by you. A manager or organization should not receive your individual report unless you choose to share it. If you share a report, you should treat it as sensitive personal information. 7. Organizational and B2B Use For organizational use, SEEFA is designed for aggregate wellbeing and work-design insight only. Allowed organizational outputs may include aggregate factor patterns, environmental demand/support patterns, work-design recommendations, and team-level wellbeing insights. Organizational reports must not include individual employee scores, named employee profiles, neurodivergence status in small groups, employee risk scores, or recommendations about hiring, firing, promotion, compensation, or performance appraisal. Aggregate reporting should use minimum cell-size protections. Small groups and sensitive subgroups should be suppressed where there is a risk of identifying individuals. 8. Your Data Rights Depending on your location and applicable law, you may have rights to: * access your personal data * receive a machine-readable copy of data associated with your account * correct inaccurate information * request deletion of your account and associated assessment data * restrict or object to certain processing * withdraw consent where processing is based on consent * opt out of certain analytics or sharing where applicable * request information about how your data is used Under GDPR, you may have the right to access your personal data and the right to data portability in a structured, commonly used, machine-readable format. Under California privacy laws, eligible users may have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights. To protect your account, we may ask you to confirm your identity before providing a data export or completing a deletion request. 9. Data Export You can request or download a machine-readable copy of personal data associated with your account. This export may include: * account details * consent history * assessment sessions * item responses * factor scores * generated reports * user-controlled sharing records * relevant activity records Some information may be excluded where necessary to protect security, prevent abuse, comply with legal obligations, protect the rights of others, or avoid exposing system-only information. Excluded data may include password hashes, session tokens, reset tokens, CSRF tokens, internal security signals, proprietary system logic, unrelated third-party data, and raw infrastructure logs where they are not appropriate for user export. 10. Deletion You may request deletion of your account and associated assessment data. When deletion is completed, we delete or anonymize personal data that is no longer needed, subject to limited exceptions such as legal obligations, fraud prevention, security, dispute resolution, backup retention, and audit requirements. Deleted data may remain in encrypted backups for a limited period before being permanently removed through normal backup rotation. 11. Anonymous or Guest Sessions If you use SEEFA without creating an account, your assessment may be linked to an anonymous session identifier. You may be able to claim that session by creating an account, depending on the product flow. Unclaimed anonymous sessions may expire or be deleted after a defined retention period. 12. Data Retention We keep personal data only for as long as needed for the purposes described in this policy, unless a longer retention period is required for legal, security, financial, research integrity, or operational reasons. Assessment and report data linked to an account are retained while the account remains active, unless you delete them or request account deletion. Anonymous or unclaimed sessions may be retained for a shorter period. Aggregated or de-identified data may be retained for product improvement, validation, research, and statistical analysis, provided it is not reasonably used to identify you. 13. Children MyBrainOS and SEEFA are intended for adults and professional or study-related self-reflection. They are not intended for children or for school-based assessment of minors unless a separate, appropriate consent and safeguarding framework is in place. 14. Important Disclaimer SEEFA is developmental and educational. It is not a diagnosis. It is not a medical device. It is not a clinical assessment. It is not an ADHD test, autism test, dyslexia test, anxiety test, depression test, or objective cognitive ability test. It should not be used for employment selection, performance decisions, compensation decisions, or fitness-for-role decisions. If your results raise concerns about your wellbeing, work, study, or daily life, consider speaking with a qualified professional or a trusted support person. 15. Contact If you have questions about privacy, data rights, data export, deletion, or consent, contact us at: support@mybrainos.io