Neuro Progeny
Privacy Policy
Privacy PolicyTerms of ServiceSMS Terms

Privacy Policy

Effective September 24, 2026 · Last updated September 24, 2026

Who we are

Neuro Progeny, Inc. is a Delaware corporation with its principal place of business in Waynesville, North Carolina. This policy covers the Neuro Progeny University platform at university.neuroprogeny.com (the “Platform”).

We currently operate in the United States only.

What the Platform is, and is not

Neuro Progeny provides educational nervous system capacity training. The Platform delivers courses, coaching sessions, biofeedback training and assessments.

It is not a medical service. Nothing on the Platform diagnoses, treats, cures or prevents any disease or condition, and nothing on it is medical advice. Our assessments describe how systems are functioning; they do not identify or rule out a medical condition. If you have a health concern, speak to a licensed clinician.

Who may use the Platform

The Platform is for adults. You must be 18 or older to hold an account. Where a young person takes part in a program, a parent or legal guardian holds the account, gives consent, and is the person we deal with.

We do not knowingly collect information from a child under 13. If you believe a child has given us information, contact us and we will delete it.

The information we collect

Account and profile. Your name, email address, password (stored hashed by our authentication provider), and anything you choose to add to your profile: phone number, date of birth, city, state, country, time zone, occupation, industry, a short biography, an avatar image, your reasons for joining, and how you heard about us. Your notification and display preferences.

Program participation. Which programs and cohorts you belong to, your progress through lessons, your responses to in-lesson questions, your check-ins, your onboarding answers, your program feedback and reviews, and any notes you keep.

Sessions and scheduling. The sessions you book, when they are, who delivers them, the meeting link, and the record of changes to a booking. If you book a discovery call without an account, the name, email address, phone number and topic you give us, plus a one-way hash of your IP address used solely to limit abuse of that form.

Physiological measures. Where you use our biofeedback or HRV programs, the Platform receives and stores your session measurements: heart rate variability metrics, heart rate, beat-to-beat intervals, derived scores, and the events of the session. These reach the Platform from the training application and our companion reporting system. You can see your own results in the Platform. This is sensitive information about your body and we treat it as such.

Assessments. Your responses to our assessments and the scores derived from them, including where an assessment is completed before you hold an account.

Journal and communications. Anything you write in the journal, including transcriptions of audio you record. Messages you send within the Platform, conversations with our AI coaching features, support tickets and their attachments.

Payment. We never receive or store your card number. Our payment processor gives us a token that identifies your saved card, plus its brand, last four digits and expiry date so that you can recognise it. We store the amounts you have paid and the records of those payments.

Calendar, for staff only. If you are a facilitator who connects a Google Calendar, see the Google section below. Participants do not connect calendars.

Usage. Pages visited, durations, device type and viewport, and an audit record of significant actions on your account.

Google user data

This section describes our handling of data obtained through Google APIs, and is the section governing our use of those APIs.

What we access. Only facilitators and staff connect a Google Calendar. With your permission we request the scopes calendar.readonly and calendar.events.

What we use it for. Two things, and nothing else:

  • Free/busy times. We read the busy intervals of the calendars you have ticked as selected in your Google sidebar, so that the Platform does not offer a booking slot at a time you are already occupied. We read only that a period is busy. We do not read event titles, descriptions, attendees, locations or any other event content for this purpose.
  • Creating and removing session events. When a session is booked we create a calendar event for it, and we remove that event if the session is cancelled. The event we create contains the participant’s name, the session time and the meeting location. We do not add participants as attendees and we do not send their email address to Google.

What we do not do with it. We do not sell it. We do not use it for advertising. We do not use it to build a profile of you. We do not send Google user data to any artificial intelligence service, and we do not use it to train any model. No human at Neuro Progeny reads your calendar content, other than as necessary to resolve a fault you have reported, to investigate abuse, or where the law requires it.

How long we keep it. Busy intervals are cached for up to two minutes to avoid repeated requests, and are not stored beyond that. Your authorization token is held in an encrypted vault. When you disconnect your calendar, we revoke the token at Google and delete it, and the Platform stops reading your calendar immediately.

Limited Use. Neuro Progeny’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Artificial intelligence

Some Platform features use a third-party AI service, Anthropic, to produce written interpretations and suggestions. We tell you plainly what those features send:

  • Coaching interpretation. Your name and the measurements of the biofeedback session being interpreted.
  • Progress summaries. Your recent session records.
  • In-Platform AI conversations. The conversation itself.

What is never sent to an AI service: your Google Calendar data, your card or payment details, your password, your journal entries (unless you explicitly ask a feature to work with them), and your assessment responses.

The AI service processes this to generate a response and, under our current arrangement with that provider, may retain it for a limited period for abuse monitoring. It is not used to train the provider’s models.

Outputs from these features are educational and are not medical advice, diagnosis or treatment. They can be wrong. Treat them as a prompt for your own thinking, not as instruction.

If you do not want to use these features, do not use them; the rest of the Platform works without them.

Who else receives your information

We use a small number of service providers to run the Platform. Each receives only what it needs.

  • Supabase — the Platform database and authentication: everything described above. Hosting the Platform’s data.
  • Vercel — requests to the Platform, including IP address. Hosting the Platform.
  • Stripe — your email address and name, the amounts, and your card details entered directly with them. Taking payment; we never see your card number.
  • Resend — your email address and the contents of emails we send you. Sending confirmations, reminders and notices.
  • Twilio — your phone number and the text of the message. Sending text reminders, only if you have consented.
  • Anthropic — as described in “Artificial intelligence” above.
  • Google — as described in “Google user data” above. Calendar availability and session events.
  • Zoom — the facilitator’s email address and the session time. Creating the meeting; no participant data is sent.
  • xRegulation — your name, email address and enrolment details. Provisioning access to the VR training programs.
  • Slack — your name and the subject of a support ticket you raise. Alerting our team to your request.

We do not sell your information. We do not share it with advertisers. We do not allow any of these providers to use your information for their own purposes.

We may disclose information where the law requires it, to protect the safety of a person, or as part of a sale or merger of the business, in which case we will tell you first.

Research

We conduct internal research to improve our programs. Participation is opt-in. You are asked separately and explicitly, and you may decline and continue using the Platform in full. You may withdraw your consent at any time.

Research use is internal only. If we ever intend to publish or share research externally, we will seek review from an Institutional Review Board and will seek your consent again for that purpose.

Records from a related practice

The database that supports the Platform also holds functional and performance assessment records created by a related practice that has since wound down. These are records of movement, balance, sensory and cognitive performance, and the exercises recommended from them. They are not medical records: no diagnosis was made and no treatment was planned.

They are part of a different product and the Platform does not use them. No Platform account reaches them, whatever its role, and no Platform feature reads them. They are reachable only by the separate reporting and practice-management applications they belong to.

If you have records with that practice and want a copy, or want them deleted, contact us at the address below.

How long we keep your information

We keep your account and program information for as long as your account exists.

When you close your account, or ask us to delete your information, we delete it within 30 days, except where we must keep something to meet a legal obligation (payment records for tax purposes, for example) or where it has been irreversibly anonymised for research you consented to.

Google calendar tokens are deleted when you disconnect, as described above.

Your choices

You may:

  • see and correct your profile information at any time in the Platform;
  • turn reminder messages off in your profile. Notices about a confirmed or cancelled session, or a failed payment, will still reach you by email, because they are about something that has happened to your account and you need to know;
  • decline research participation, or withdraw it;
  • remove your saved card;
  • disconnect your Google Calendar, if you are a facilitator;
  • ask us for a copy of your information, or ask us to delete it.

Residents of some states have additional rights under state privacy law. We honour those requests from anyone who asks, without requiring you to prove where you live.

Security

Access to your information is restricted by policy at the database level, so that you see your own records and our staff see only what their role requires. Payment card numbers never reach our systems. Authorization tokens are held in an encrypted vault. We keep an audit record of significant actions on accounts.

No system is perfectly secure. If we become aware of a breach affecting your information, we will tell you.

Changes to this policy

If we change how we handle your information we will update this page and change the date at the top. If the change is significant we will tell you directly.

Contact

Neuro Progeny, Inc., Waynesville, North Carolina. onboarding@neuroprogeny.com

All policies