Your brain data is personal.

“Peak Brain,” “we,” “us,” and “our” mean Peak Brain Institute and the Peak Brain entity identified in your service agreement. That entity is responsible for your service records unless the agreement or a local privacy notice says otherwise.

This policy covers our websites and forms; inquiries, consultations, scheduling, purchasing, and account administration; in-office and remote QEEG, neurofeedback, biofeedback, coaching, education, and support; and information received from you or a person or service you ask us to involve.

Some locations are separately operated and may provide an additional local notice. A more specific local notice controls records held by that location if the notices differ. This policy does not control an unrelated third-party site or service linked from our website.

We apply privacy and security safeguards based on the sensitivity of the information and the laws applying to the particular entity, person, service, and record.

Depending on how you interact with us, we may collect:

• Directly from you or your authorized representative.
• Automatically from your browser or device when you use a covered site.
• From a Peak Brain location, employee, contractor, coach, or provider involved in requested services.
• From a clinician, coach, family member, school, employer, or other person when you authorize the exchange or law otherwise permits it.
• From payment, scheduling, communication, shipping, security, and technology providers supporting your interaction.

• Answer questions, provide program information, and arrange consultations.
• Assess appropriateness and safely provide QEEG, neurofeedback, biofeedback, coaching, education, and support.
• Personalize protocols, coaching, progress reviews, and service communications.
• Coordinate the authorized team working with you and communicate with people you designate.
• Schedule appointments, support remote clients, manage equipment, process payments, and maintain service records.
• Operate, secure, troubleshoot, and improve our services and websites and prevent fraud or security incidents.
• Meet legal, professional, accounting, insurance, and recordkeeping obligations.

We do not use identifiable brain, health, or coaching information for testimonials, unrelated advertising, or general-purpose AI-model training without separate valid permission when required.

Where GDPR or UK GDPR applies, the legal basis depends on the purpose and context.

If we rely on consent, you may withdraw it prospectively. Withdrawal does not make earlier processing unlawful or require deletion of a record that another legal basis or retention duty requires us to keep.

Peak Brain is a small practice led by a primary provider. Staff help that provider deliver and administer client services, so every current team member whose role includes that support may need access to client information. Those people are part of the authorized Peak Brain service team.

• Information may be used only for assigned service, support, safety, payment, or administrative work.
• Staff may share information internally only with another authorized team member who needs it for that work.
• No one may access a record from curiosity or use it for gossip, personal benefit, unrelated research, personal projects, or unauthorized marketing.
• Staff use approved accounts, systems, devices, and communication methods and report suspected privacy or security incidents promptly.
• Confidentiality duties continue after a person’s work with Peak Brain ends, and access is removed when no longer required.

We disclose only the information reasonably needed for the purpose and only to appropriate recipients.

A coach who is part of your authorized Peak Brain team may receive relevant QEEG findings, goals, protocol information, session observations, and progress measures. We use information for legitimate coaching and coordination purposes.

We keep coaching and brain information within the authorized Peak Brain team unless you ask us to involve an outside coach, clinician, family member, school, employer, or other person, or a narrow legal or safety exception applies. When separate permission is required, we obtain it before sharing.

For employer-, school-, or team-sponsored programs, we do not provide session content, brain maps, coaching notes, or individual outcomes unless you direct us or law requires it. Administrative information and aggregate or deidentified reporting may be provided as described in advance.

In a group coaching, mindfulness, or education session, other participants may hear what you choose to share. We ask participants to respect confidentiality, but we cannot guarantee another participant’s conduct.

Our public website uses essential technologies and tools from providers such as Google Analytics and Google Tag Manager, Meta, Reddit, and SiteBehaviour. These tools may receive online identifiers, device and browser details, referral information, pages viewed, approximate location derived from an IP address, and interactions with the public website. We use this information to operate and secure the website, understand traffic, improve communications, measure campaigns, and prevent fraud.

Our cookie banner provides available accept and decline choices. Some limited cookieless measurement or page-view signals may be sent before you make a choice. After acceptance, additional analytics and advertising technologies may operate. Browser settings and provider controls may also limit cookies, although blocking them can affect website functions.

We do not intentionally send identifiable QEEG results, brain maps, coaching notes, client Slack content, or other client service records to these providers for advertising. We also do not intentionally place general advertising or session-replay tools inside authenticated client systems unless the configuration and vendor relationship have been reviewed for the information involved and applicable privacy requirements.

Some laws may call certain advertising-related disclosures a “sale,” “sharing,” or targeted advertising even when no money changes hands. Where such a law applies to Peak Brain, you may use available cookie controls or contact us to exercise the applicable opt-out right.

We keep personal information only as long as reasonably necessary for the stated purpose, requested services, and applicable legal, professional, tax, accounting, security, insurance, dispute, and recordkeeping requirements. The period depends on the record, responsible entity, client age, jurisdiction, and any legal hold or active dispute.

When information is no longer needed, we delete it, deidentify it, or place it beyond routine use. Deletion is not absolute. Certain client, brain-data, billing, authorization, security, or legal records may need to be retained. When required, we explain why requested information cannot be deleted and limit further use to the retained purpose.

We use administrative, technical, and physical safeguards designed for the sensitivity of the information. Depending on the system, these may include encryption, access controls, multi-factor authentication, role-based permissions, logging, secure backups, workforce training, vendor review, incident response, and secure disposal.

No transmission or storage method is perfectly secure. Ordinary email and text may be less secure than a designated portal or approved service channel. If we discover a breach, we investigate, contain, document, and notify affected people and authorities when applicable law requires it.

Depending on the law and record type, you may have the right to:

Rights are subject to legal exceptions. We take reasonable steps to verify identity and authority, respond within the required period, and explain denials and appeal options where required.

Peak Brain operates and uses providers in more than one country. Information may be processed in the United States or another country whose privacy laws differ from those where you live.

Where GDPR, UK GDPR, or another law restricts a transfer, the responsible Peak Brain entity uses an approved mechanism as applicable, such as an adequacy decision, EU Standard Contractual Clauses, the UK transfer addendum or agreement, or another lawful safeguard.

Our general websites are intended for adults and are not designed for a child to submit personal or health information independently. Services may be provided to minors through a parent, guardian, or another person authorized by law.

We obtain permissions required for the child’s age, location, and service, recognizing that a minor may control some information or decisions under applicable law. Contact us if you believe a child submitted information through a general form without appropriate permission.

Last updated: January 1, 2026

We may update this policy as services, technology, or law changes. We will post the revised version with a new “Last updated” date. If a change materially affects how we use information already collected, we provide additional notice or seek consent when applicable law requires it.

Related client document: Program Agreement and Informed Consent.

For urgent medical or safety concerns, do not use the privacy email or website form. Contact an appropriate emergency or medical service.