NeuraVate Privacy Policy

1.1. NeuraVate is a service operated by PairOx Pty Ltd (ABN 82 154 477 728, ACN 154 477 728), an Australian private company ("PairOx", "we", "us", "our"). The controller of your personal data is PairOx Pty Ltd.

Operator identity. PairOx Pty Ltd's registered address is 4 Lorikeet Street, Glenwood NSW 2768, Australia, and its telephone number is +61 402 614 311. Every right in section 12 is exercisable against us at the contact addresses in 1.2.

1.2. For all privacy matters, requests, and questions, contact us at [email protected]. Written correspondence and notices can also be sent by post to PairOx Pty Ltd, 4 Lorikeet Street, Glenwood NSW 2768, Australia.

1.3. This policy applies worldwide to the NeuraVate service: the NeuraVate website, the NeuraVate web app, the NeuraVate.ai app for iPhone and Android, the public emergency page your card or link opens, and the printed card you can buy (together, the "Service"). In this policy "the app" means the web app and the NeuraVate.ai app alike, unless a sentence or section names one of them. Where we process data on behalf of an organisational customer under a separate data processing agreement (a future offering), that agreement governs that processing; this policy governs everything we do as controller of the consumer Service.

2.1. EU representative. We have no representative in the European Union today: the appointment of an EU representative under Article 27 GDPR is outstanding. Until one is appointed, you can exercise every right in this policy directly with us at [email protected], and you can complain to the data-protection authority of your EU country (section 12.8).

2.2. UK representative. We have no representative in the United Kingdom today: the appointment of a UK representative under Article 27 UK GDPR is outstanding. Until one is appointed, you can exercise every right in this policy directly with us at [email protected], and you can complain to the Information Commissioner's Office (section 12.8).

2.3. When a representative is appointed, its name, address and contact are published in this section, and you may then contact it instead of, or as well as, us.

3.1. We have established a Data Protection Officer function, reachable at [email protected]. The role is held by Rishu Kalra, Director of PairOx Pty Ltd, who is also our privacy officer.

3.2. Why, stated for transparency. We process health information, which is special-category data under Article 9 GDPR, so we have chosen to have a DPO function whether or not the law strictly requires one in our case.

4.1. NeuraVate is a service for adults living with implanted or assistive medical devices (for example pacemakers, ICDs, insulin pumps, neurostimulators, cochlear implants, and orthopaedic implants). Its core is the Emergency Passport: a record you keep of your devices, allergies, medical conditions, blood type, advance directive and emergency contacts — plus an optional emergency link, shown as a QR code and a printable card, that gives anyone who holds it a deliberately limited part of that record (section 5).

4.2. NeuraVate is an informational, record-keeping, and emergency-information-access service. It does not diagnose, treat, or prescribe, it does not monitor you or any device, and nothing in the Service is medical advice. The information shown is the information you entered. See our Terms of Service (terms-of-service), section 5, for the full medical and emergency disclaimer.

This is the heart of the product, so it gets its own section — read it even if you read nothing else.

5.1. How it works. If you switch on emergency sharing, NeuraVate creates an emergency link, shown as a QR code and on a printable card, and, in a version of the NeuraVate.ai app for iPhone that offers it, as an Apple Wallet pass you can add (section 6.8). The link carries a signed code (HMAC-SHA256) that holds no readable personal information, and it does not expire on its own — a card in your wallet must keep working until you decide otherwise. Anyone who scans the QR code or opens the link can see the emergency page without logging in. That is the point of the feature — and it means anyone who has your QR code, card, Wallet pass or link can see the emergency subset described below, not only medical professionals. Treat the card as you would the information on a medical ID bracelet.

5.2. What the emergency page shows. The page is built from a fixed list of fields. It shows only:

• the name you chose to show;
• blood type;
• allergies;
• medical conditions you listed;
• advance-directive summary (DNR status and a reference to the document);
• emergency contacts (name, relationship, phone number);
• your implants and devices: device type, manufacturer, model, implant date, MRI status/compatibility, safety flags, and any emergency instructions you attached;
• the emergency notes you wrote;
• when the information was last updated.

5.3. What the emergency page never shows. The following are deliberately left off the public page, and automated tests check that they stay off: your full legal name (only the name you chose to show appears); your date of birth (which we do collect at sign-up — section 6.1 — but never publish on this page); your email address and address; any internal identifier of your account; and the check-up dates you add to your plan (section 6.2).

5.4. Your controls. You decide whether emergency sharing is on at all; you write the content; and you can replace the link at any time, which immediately stops every earlier link, QR code, printed card and Apple Wallet pass from working. Switching sharing off takes the page offline immediately.

5.5. Lawful basis. We publish your emergency subset only because you set it up: it rests on your explicit consent (Article 9(2)(a) GDPR) together with your deliberate act of creating and carrying or sharing the link. When someone reads the page in an emergency in which you cannot act, that reading is also supported by the protection of vital interests (Articles 6(1)(d) and 9(2)(c) GDPR). We state both because they describe different moments honestly: you consent in advance; the responder reads when you may be unable to consent.

6.1. Account information. Your email address, first name, last name, your password (stored only as a hash inside our self-hosted sign-in system, Keycloak), and your date of birth. When you sign up we also record your explicit consent to processing your health information (its own unticked box, section 7.3), your acceptance of the Terms of Service and this Privacy Policy including the exact version of each, and the language you signed up in.

Your date of birth: why we ask for it. The Service is for adults only. We ask for your date of birth at sign-up and refuse the sign-up if you are under 18 or do not give a valid date. As part of the same age check we derive a country (not a precise location) from the network address of the sign-up request, on our side and never from anything the app tells us. Your date of birth and that country are stored with your account, kept for the life of the account and deleted with it (retention-schedule T-01), never shown on the public emergency page (section 5.3), and not used for advertising, profiling, or anything other than the age check.

6.2. Health and implant information you enter (special-category data, Article 9 GDPR). The content of your passport: your devices and implants (type, manufacturer, model, implant date, MRI status, safety flags, emergency instructions), the check-up dates you add to your plan for them (what each check-up is, the date you enter and whether it is done), allergies, medical conditions, blood type, advance directive (DNR status and document reference), emergency contacts, and notes — together with whether sharing is on and which version of your emergency link is current. All of it is information you chose to enter: NeuraVate never works out or suggests a check-up date. The launch Service does not record medications.

6.3. Emergency-page access records. Each time someone opens your emergency page we record the time and whether the page was shown, so that we can tell you when your card was used. You can see this history yourself: when you are signed in, the passport page of the NeuraVate web app lists each time your emergency page was opened, newest first, with the time and whether the page was shown; a version of the NeuraVate.ai app that includes this list shows it there too. You can also ask us for it (section 12.1). If your page was opened while sharing was off, or with a card you have since replaced, the person who opened it saw nothing, and the list says the page was not shown (such attempts before this version was published were not linked to your account and are not in the list). The stored record also holds the network address the request came from and the scanner's browser user agent (the text a browser sends to describe itself, such as the browser, its version and the type of device). We keep those two for security and to detect misuse (section 6.4), and we never show them to you: the list, and anything we tell you when you ask, gives the time and whether the page was shown, never the network address or the device or browser that opened it. These records do not identify the person who scanned it to you.

6.4. Technical and security information. Records of changes to your passport, your sharing setting and your emergency link; records of administrator access (section 8.2); security events; and operational logs, which include IP addresses and browser details. Our network provider, Cloudflare, also processes the IP address, browser details and request information of every visit to protect and deliver our sites (section 8.3). We do not use any of this to profile you; it exists to keep the Service secure and to show who accessed your information.

Neural Halt. In the NeuraVate web app, Neural Halt lets you turn on a halt that tells NeuraVate's services to refuse neural data about you. We keep the setting (whether your halt is on, and when you turned it on or off) and the history of each time you turned it on or off, as your own record of your preference: we use them only to carry out your choice and to show it to you, as part of running your account (section 7.1). No NeuraVate service processes neural data for your account today, and NeuraVate does not monitor you or any device (section 4.2); a NeuraVate service that starts to process neural data will refuse such data while your halt is on. We keep the setting and its history with your account and delete them with it (retention-schedule T-15); each time you turn it on or off is also written to our audit records, which section 10.1 says how long we keep.

6.5. Order information (the printed card). If you buy a printed card, Stripe collects your payment details, name, email address and shipping address on its payment page. When you order from the app, the app opens that page with your account ID and your email address already filled in (you can change the email); the account ID lets us print the card with your emergency link as it is when we make the card, so you never copy the link. When you order from our website, you can type the link into the order instead. We receive the order, the shipping address, and the account ID or the link, so that we can make and post the card, and Stripe's receipt and payment record. A card number never touches our systems: card data is collected and processed by Stripe, which acts as an independent controller for it. The postal or courier service that delivers your card receives your name and shipping address.

6.6. Messages you send us. The content of emails you send to our support or privacy addresses, which may include health information if you choose to include it. These emails, and our replies, are kept by our mail host, Migadu, in the mailbox where we read and answer them (section 8.3).

6.7. What we do not collect. We do not collect precise location (the country in 6.1 is derived from the network address only, and used only for the age check). We collect no analytics or tracking data: we use no analytics, advertising, tag-management, or tracking service, and set no analytics or advertising cookies. Cloudflare may set a small number of strictly necessary security cookies on our sites; our Cookie Policy (cookie-policy) lists every cookie we use. If we ever introduce an analytics tool, we will update this policy and the Cookie Policy first and ask for your consent where the law requires it.

6.8. The NeuraVate.ai app on your phone. The NeuraVate.ai app for iPhone and Android is another way into the same account. It collects nothing that the web app does not, and it works like this:

• Signing in. The app opens our sign-in page (auth.neuravate.ai) in your phone's own browser, through the sign-in window your phone provides, and you type your password there each time you sign in. The app never asks for, sees or keeps your password. When you create an account in the app, you give the details in section 6.1 other than a password, and you choose your password on our sign-in page, from the link we email you.
• What it keeps on your phone, and where. The app keeps the tokens that keep you signed in; a summary of your account (your account ID, email address, name and account roles); and, each time your passport loads, a copy of your passport (your emergency profile, your implants, your emergency link and its QR code, whether sharing is on, and when the copy was fetched), so that you can open your passport when your phone has no connection. The copy is shown with the time it was fetched, and it never leaves your phone. If you turn on the app lock (below), the app also keeps a setting that says the lock is on. All of this is kept only in your phone's secure storage (the iOS Keychain; on Android, storage encrypted with a key held in the Android Keystore), is not carried over to another phone, even through a backup, and on an iPhone can be read only while the phone is unlocked. When you save or share a picture of your QR code (below), the app also writes the picture, for that moment only, to a temporary file outside secure storage. Our Cookie Policy (cookie-policy, section 2) lists every item the app keeps.
• How long it stays there. The app replaces the copy each time your passport loads, and deletes the tokens, the account summary, the copy and the lock setting when you sign out, or when it finds that your sign-in has ended. On Android, deleting the app also deletes them. On an iPhone, iOS can keep what an app stored in the Keychain after the app is deleted. If the app is installed on that phone again, it deletes them the first time it opens, before it uses any of them to sign anyone in or to show anything, so it starts signed out and shows no earlier copy; to tell a first open, it keeps one marker outside the Keychain that holds nothing about you and goes when the app is deleted. To remove them from an iPhone at once, sign out in the app before you delete it.
• Whom it talks to. The app connects only to our own servers, through Cloudflare (section 8.3): our sign-in service and our service on neuravate.ai. It opens our website, your emergency page and Stripe's payment page for a printed card (section 6.5) in your phone's browser rather than inside the app, and it opens your own mail app when you write to us.
• What it does not do. The app shows no advertising and contains no analytics, advertising or tracking software. It does not read your phone's advertising identifier, does not track you across other companies' apps or websites, and does not send you notifications or ask for permission to.
• The app lock. A version of the app that offers it lets you turn on a lock in Profile. While it is on, the app covers its screens when it opens and each time you return to it, until your phone confirms that it is you, with Face ID or a fingerprint, or with your phone's passcode instead. Your phone makes that check itself (iOS or Android does it) and tells the app only whether it passed: the app never receives, keeps or sends your face, your fingerprint or any other biometric information, and neither do we. The lock covers the app's screens; it does not encrypt anything, and what the app keeps stays in your phone's secure storage as described above. It does not affect your emergency link, QR code, printed card or Wallet pass, which open your emergency page for anyone who has them, as section 5 says. The setting that the lock is on holds nothing else, and the app deletes it when you turn the lock off or sign out.
• Your emergency card in Apple Wallet. A version of the app for iPhone that offers it lets you add your emergency card to Apple Wallet. The pass holds only your emergency link, as a QR code, with our name and the words "Scan for my emergency information"; it shows none of your health information. On an iPhone, Wallet can show a pass without the phone being unlocked, and anyone who scans its QR code sees your emergency page, as with your printed card. Once you switch sharing off, replace your link or your account is deleted, the QR code on the pass opens nothing (section 5.4), but the pass stays in Wallet until you delete it there: signing out of the app or deleting the app does not remove it, and we cannot change or remove a pass after you have added it. The app gets the pass from our servers and hands it to Wallet on your phone. If you use iCloud for Wallet, Apple keeps the pass in your iCloud account and on your other Apple devices, for you and under its own terms, as it does for any pass you add; we send nothing about you to Apple.
• Saving or sharing a picture of your QR code. A version of the app that offers it lets you save or share your QR code as a picture. The app writes the picture to a temporary file on your phone, opens your phone's share sheet with it, and deletes the file when the share sheet closes. Where the picture goes then is your choice: saved to your photos or sent to someone, it is kept wherever you put it, under the terms of that app or service, and anyone who has it can open your emergency page, as with your link, until you switch sharing off or replace your link.
• Apple and Google. If you get the app from Apple's App Store or Google Play, Apple or Google handles your download, your store account and any review you write there under its own terms and privacy policy, as a controller in its own right; the app sends neither of them information about you, and a pass you add to Apple Wallet is kept for you, as the bullet above says. Each gives us statistics about downloads from its store and, from people who have chosen in their phone's settings to share them with app developers, statistics about how the app is used and reports of its crashes. None of these names you.

7.1. The table below maps each purpose to the information used and its legal basis under Article 6 GDPR and — for health information — Article 9 GDPR. We do not process your information for any purpose not listed here.

7.2. Legitimate-interests balancing note. Where we rely on legitimate interests (security, access records, abuse prevention, delivering the Service), our interest is keeping a health-information service trustworthy and secure — an interest your rights point in the same direction as. The processing is limited to technical and security information, is not used for profiling or marketing, and is kept as our retention schedule says. You may object (section 12.6); we cannot run a health-information service without security records.

7.3. Consent is real consent. Your consent to processing your health information is asked for in its own box at sign-up, separate from accepting the Terms and this policy, and is never ticked for you. You can withdraw it at any time by emailing [email protected]. Because we cannot keep a passport without processing the information in it, withdrawing it means we delete your account (section 12.3) unless you tell us otherwise. You can switch off sharing in the app at any time, which withdraws your consent to the emergency page.

7.4. We do not use your information for advertising, we do not build marketing profiles, and we do not train models on your information.

8.1. Anyone with your emergency link. As section 5 explains, if you switch on sharing, anyone who has your QR code, card or link can see the limited emergency subset. At launch there is no other sharing: no caregiver, clinician, or organisation can see your passport through the Service.

8.2. Our own platform administrators — the access you did not grant. There is a further path into your record, and it is not one you control. A person at PairOx holding the platform admin role is admitted to any person's records by the shared authorisation check our account-scoped routes run through — and because the same check guards the routes that write passport content, that access is not limited to reading. This role is given by us, not by you, and you are never asked to consent to it. What constrains it is accountability rather than permission: each such access writes an entry to our audit records naming the administrator, the record reached, the route and the time. That entry is written alongside the access rather than as a condition of it, so it lets us detect and investigate misuse after the fact; it does not prevent it. We use the role only to run the Service and to carry out your own requests (for example deleting your account by hand, section 12.3). We publish this because the rest of this section would otherwise read as the complete list of who can reach your information.

8.3. Service providers (processors acting on our instructions). These providers process personal information for us, under contract and only on our instructions. The versioned list is our Subprocessor Register (subprocessor-register), which we update before adding a new one.

• Hetzner (hosting): our databases and sign-in system run on a server we operate at Hetzner Online GmbH, Falkenstein, Germany, so the information in your account and your emergency passport is stored in Germany.
• Cloudflare (network, security and DNS): every request to our sites passes through Cloudflare, which protects them against attacks, encrypts connections and delivers pages. It processes IP addresses, request details and the pages and data passing through it, at data centres around the world.
• Resend (email delivery): processes your email address and the content of the automatic service emails we send you (email verification and password reset). Resend, Inc. is a US company, and our emails are sent through Amazon SES in its Tokyo region, Japan.
• Migadu (Migadu-Mail GmbH, Switzerland; email hosting, on mail servers in France and Germany): hosts our support, privacy and other email addresses and the mailbox they deliver to, where we read and answer your emails. It receives and stores the emails you send us and the replies we write to you, which may include health information if you include it (section 6.6).
• Backblaze (backup storage, B2): stores our encrypted nightly database backups in its EU Central region (Amsterdam, the Netherlands). Each backup is kept for 30 days and then deleted automatically.

We make your printed card ourselves; the postal or courier service that delivers it receives your name and shipping address. We use no card-printing supplier; if we ever do, we will name it in this section before it receives any order.

Apple and Google are not our service providers. If you get the NeuraVate.ai app from Apple's App Store or Google Play, Apple or Google handles your download and your store account for itself, under its own terms, and the app sends neither of them information about you (section 6.8). If you add your emergency card to Apple Wallet, Wallet keeps the pass on your phone, and Apple keeps it in your iCloud account if you use iCloud for Wallet, for you and not for us (section 6.8).

8.4. Stripe (payments) processes card payments for the printed card. For your payment details it acts as an independent controller under its own terms and privacy policy: it receives them directly, and card numbers never pass through NeuraVate. The order records Stripe keeps in our Stripe account (your name, email, shipping address and what you bought) it keeps for us, as listed in the Subprocessor Register. Those records also hold your account ID if you ordered from the app, or the emergency link you typed in if you ordered from our website.

8.5. Nobody else. We use no advertising networks, no data brokers, and no analytics vendors, and we never sell your personal information — including your health information — to anyone.

8.6. Legal and authority requests. We disclose personal information to public authorities only when legally compelled by a request with a valid legal basis and binding effect on us. We read such requests narrowly, challenge overbroad ones where reasonably possible, and — unless legally prohibited — tell you before disclosure. We give no authority direct or standing access to our systems.

8.7. Business transfers. If PairOx, or the NeuraVate service, is involved in a merger, acquisition, or asset sale, your information may be transferred as part of it; the recipient remains bound by this policy, and we will tell you before your information becomes subject to a different one.

9.1. Australia — APP 8. PairOx is established in Australia, so the Australian Privacy Principles are the rules of our home jurisdiction. Some of the providers in section 8 are outside Australia, so your information is disclosed overseas:

• United States — Cloudflare, Resend, Stripe and Backblaze are US companies;
• Japan — Resend, which sends our emails through Amazon SES in its Tokyo region;
• France and Germany — Migadu, our mail host and the mailbox we read your emails in, whose mail servers are in those two countries;
• Switzerland — Migadu-Mail GmbH, the company that runs Migadu;
• Cloudflare's network — requests are handled at the Cloudflare data centre nearest the visitor, which may be in any country where Cloudflare operates;
• Germany — Hetzner, where our servers are (Falkenstein);
• the Netherlands — Backblaze's EU Central region (Amsterdam), where our encrypted backups are stored.

Before disclosing, we take reasonable steps to make sure each provider handles your information consistently with the Australian Privacy Principles (through its contract and data-processing terms), and under the Privacy Act we remain accountable for what an overseas recipient we engaged does with your information as if we had done it ourselves. Stripe is different: it acts for itself, under its own privacy policy, when it processes your payment.

9.2. EU, EEA and UK. Where personal information of people in the EU, EEA or UK is transferred to a country without an adequacy decision, we rely on each provider's published transfer mechanism — the EU–US Data Privacy Framework certification or the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA) in its data-processing terms. Execution status of each provider's data-processing terms is tracked in the Subprocessor Register (subprocessor-register).

9.3. An honest limit. No qualified Australian privacy practitioner has yet assessed this Service against APP 8 or the other Australian Privacy Principles, and we do not claim a completed assessment. We state the accountability rule because you are entitled to know which regime our home regulator applies. See section 12.8 for how to complain to the OAIC.

10.1. The canonical table of retention periods is our Data Retention Schedule (retention-schedule). In summary:

• your account and passport are kept for as long as your account exists, and deleted when you ask (section 12.3) — they have no time limit after which we delete them on our own, so nobody's emergency information disappears just because they have not signed in for a while;
• records we must or may keep after you leave are kept under a pseudonym (section 12.3 says exactly what that means): which versions of our documents you accepted and the history of your consent choices for 7 years after your account is deleted; access and security records, including the record of each time your emergency page was opened, for 7 years from when each record was made; and tax records of what you bought for 7 years after the end of the financial year of the purchase;
• a note that an account with your internal account number was deleted, and when, is kept without a time limit, so that nothing can recreate your information after the deletion;
• what the NeuraVate.ai app keeps on your phone about your account stays only on your phone, until you sign out, the app finds that your sign-in has ended, or you delete the app (on an iPhone, until the app is next installed there and opens) (section 6.8);
• database backups are encrypted, and each backup is kept for 30 days and then deleted automatically.

10.2. Honest flag. The retention periods for the records in the second bullet are set as working defaults and are not yet enforced by automatic deletion; the schedule says which ones.

11.1. Measures in place:

• Encryption in transit on every connection from your device. Every connection between your device and NeuraVate uses HTTPS (TLS), and Cloudflare re-encrypts traffic on its way to our servers. Traffic between the components inside our own server runs on a private network and is not separately encrypted; we say so rather than write "encrypted everywhere".
• Encryption at rest for the passport content. The content of your passport (your emergency profile, implants and device details) is encrypted in our database with keys our service holds separately from the database.
• Encrypted backups. Nightly database backups are encrypted before they leave our server and are stored with Backblaze (section 8.3).
• Access controls and records. Each account can read and change only its own passport (with the administrator exception in section 8.2). Changes to your passport, your sharing setting and your emergency link, and every opening of your emergency page, are recorded. Cloudflare filters attacks before they reach us.

11.2. Honest limits. No system offers absolute security. What we commit to is collecting little, restricting who can see it, recording access so misuse can be detected, and telling you the truth — including our breach-notification duties under the Notifiable Data Breaches scheme of the Privacy Act and, where they apply, Articles 33 and 34 GDPR, which we follow under a documented internal procedure (breach-notification-procedure). If a breach is likely to result in serious harm to you, we will tell you directly and without undue delay.

These rights come from the Australian Privacy Principles and the GDPR; we apply them to every NeuraVate user worldwide, not only where the law requires it. Exercising them is free. To exercise any right, email [email protected] from the email address on your account. You can also delete your account yourself, in the app (section 12.3).

How we check that a request comes from you. Because the sender of an email can be faked, we do not rely on it. Before acting, we write to the email address stored on your account — never to a different address a request comes from or asks us to reply to — and we act only when you confirm from that mailbox. Everything we send about the request, including a copy of your data, goes only to that address. An authorised agent may act for you with your written authority, and we still confirm with you at that address. When you delete your account yourself in the app, the check is different: you sign in again just before you confirm (section 12.3).

We handle every request you email us by hand, and we answer within 30 days of receiving it — or sooner where the law that applies to you requires it (for example within one month under the GDPR). You can also download a machine-readable copy of your account data yourself, at any time, from Your Data in the NeuraVate web app (section 12.1). Requests about consumer health data covered by Washington law are answered within the 45 days that law allows (see consumer-health-data-privacy-policy).

12.1. Access (APP 12, Art 15) and portability (Art 20). You can download a copy yourself. When you are signed in to the NeuraVate web app, Your Data lets you download a machine-readable file (JSON) of what our database and our sign-in system hold about your account: your account details, your passport content, your consent and acceptance records, and when your emergency page was opened. We make the file when you ask for it and send it straight to your browser; we do not store it. If the file cannot be made, for example because a record in it also concerns another person, Your Data tells you so and asks you to email us instead. For anything else, ask us by email: we will send you, as a file, what we hold about your account, including any order records for a printed card, which the download does not include. Your passport content is also shown in full in the app's passport editor, and in the web app's printable passport view.

12.2. Correction (APP 13, Art 16). You can correct everything in your passport yourself in the app. Anything you cannot change in the app (for example your name on the account), we correct on request.

12.3. Deletion (Art 17). You can delete your account yourself, or ask us by email. Either way, we delete your account by hand within 30 days (within 45 days for consumer health data covered by Washington law) and email you at the address on your account when it is done.

• Yourself, in the app. On our website, sign in, open Account and choose Delete your account. A version of the NeuraVate.ai app that offers it has the same step under Profile, then Delete account; a version that does not offer it shows how to ask by email instead. You sign in again and type DELETE to confirm. At once, you can no longer sign in, and your emergency link is switched off: every QR code, link and printed card of your emergency card stops working. We record that you asked, when, and in which app; that record is one of the access and security records listed below. The 30 days run from your request.
• By email. Email [email protected] from the email address on your account. This always works, whichever app or version you use. We first confirm the request with you at that address (see "How we check that a request comes from you" above), and the 30 days run from when we receive it.

Deleting:

• removes your sign-in account (your email address, name, password and date of birth), your passport and every earlier version of it, your live consent records, and the notifications we hold for you — your emergency link, QR codes, emergency page and printed cards stop working;

• keeps the records we must or may keep, under a pseudonym: your name and email address are not in them, the network address and browser recorded with anything you did while signed in are removed, and in place of your account they keep only the internal number of your deleted account, which no longer leads to an account (our record of your deletion request, below, is what still connects that number to you). They are:

  • which versions of our documents you accepted, and the history of your consent choices — kept for 7 years after your account is deleted, as proof of what you agreed to (Art 7(1) and 17(3)(b); retention-schedule T-06);
  • access and security records, including the record of each time your emergency page was opened: the time, and the network address and browser of whichever device opened it — including your own device, if you opened the page yourself (for example with "Open my printable card" in the app, or by scanning your own QR code), because the page needs no sign-in and records every opening the same way — kept for 7 years from when each record was made, for security and to establish or defend legal claims (Art 17(3)(b) and (e); retention-schedule T-05 and T-08);
  • tax records of what you bought — kept for 7 years after the end of the financial year of the purchase, because tax law requires them (Art 17(3)(b); retention-schedule T-07);

  these periods are not enforced by automatic deletion (section 10.2);

• keeps, without a time limit, a note that an account with that internal number was deleted and when, so that nothing can recreate your information afterwards (retention-schedule T-14);

• reaches backups as they expire: our database backups are encrypted, and each backup is kept for 30 days and then deleted automatically, so a copy made before your deletion is deleted with the backup that holds it. The key that encrypts passport content in our database is one key for every passport, not a key of yours, so deleting your account does not delete it, and a copy of your passport in such a backup stays readable to us until that backup is deleted. We never restore a deleted account from a backup: if we must restore one after a failure, we first re-apply every deletion made since that backup was taken, before the Service is used again;

• reaches our email: we ask our email-delivery provider (Resend) to delete its records of the emails it sent you, and we delete your earlier emails from our mailbox at Migadu, keeping only your request and our answer as the record that we handled it;

• reaches the NeuraVate.ai app on your phone the first time the app renews your sign-in after the deletion, which it does within minutes whenever it is used with a connection: it then finds that your sign-in has ended and deletes the copy of your passport and the rest of what it keeps there about your account (section 6.8). Signing out of the app deletes them at once;

• leaves Stripe's own records of your card payments, which Stripe keeps under its own legal obligations as an independent controller. If you ordered a printed card, we write to Stripe asking it to delete or redact your details (your name, email address, shipping address, and your account ID or the emergency link you typed in) from each card payment we find under your email address or your account ID, except what it must keep; Stripe decides what it keeps. Ordering a card creates no customer record in our Stripe account, so there is none for us to delete.

Our page about deleting an account, www.neuravate.ai/account-deletion, describes both ways.

12.4. Withdrawing consent (Art 7(3)). As easy as giving it: switch off sharing in the app, or email [email protected] to withdraw your consent to processing your health information, which leads to deletion (section 7.3) unless you tell us otherwise. Withdrawal never affects the lawfulness of processing before it.

12.5. Restriction (Art 18). You can ask us to restrict processing while a dispute about accuracy, lawfulness, or an objection is resolved.

12.6. Objection (Art 21). You can object to processing based on legitimate interests (section 7.2); we then stop unless we demonstrate compelling legitimate grounds. We do no direct marketing, so there is nothing to opt out of on that front.

12.7. No automated decision-making. We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Refusing a sign-up under 18 (section 14) is an eligibility rule you can ask us to review by email.

12.8. Complaints. Please tell us first at [email protected]; we answer complaints within 30 days. You can also complain to a regulator at any time:

• In Australia — where PairOx is established — the Office of the Australian Information Commissioner (OAIC, oaic.gov.au), which handles privacy complaints under the Privacy Act 1988 (Cth).
• In the EU — the authority of your residence, workplace, or the place of the alleged infringement. Because we have no establishment in the EU, any concerned authority may act.
• In the UK — the Information Commissioner's Office (ICO, ico.org.uk).
• Elsewhere — your national or state privacy regulator, where one exists; US state residents see section 13.

If you live in Washington, Nevada, California, or certain other US states, you have additional rights over your health information under state law — including separate consent for collecting and sharing consumer health data, deletion rights that extend to archives and backups, a right to a list of third parties who received your information, and (California) the right to limit use of sensitive personal information. Because Washington's My Health My Data Act requires a distinct, standalone policy, the full detail is in our Consumer Health Data Privacy Policy (consumer-health-data-privacy-policy). That document is the authoritative statement of US state health-privacy rights; this section is only a pointer. The contact is the same: [email protected].

14.1. The Service is for people aged 18 or older. We refuse a sign-up if the date of birth given shows the person is under 18 (section 6.1). We do not offer accounts for children or teenagers, and we do not offer a parent or guardian pathway; if we add one, this policy will change first.

14.2. We do not knowingly hold the information of anyone under 18. If we learn that an account belongs to someone under 18, we will delete it as described in section 12.3. If you believe a child is using the Service, tell us at [email protected].

15.1. Every version of this policy carries the slug privacy-policy and a version identifier (header above). When we make a material change — one affecting your rights, the purposes or categories of processing, recipients, or retention — we will tell you by email and, where required, ask you to accept the new version in the app before you continue using signed-in parts of the Service. Non-material changes (typos, contact details) update the version date only. The public emergency page is never blocked by an acceptance prompt.

15.2. Version history. This is version v1.6-2026-10-29-LAUNCH. Section 6.4 now names the Neural Halt setting and its history, sections 5.3 and 6.2 name the check-up dates you add to your plan, and sections 12 and 12.1 say that you can download a copy of your account data yourself in the web app; nothing else changed. v1.6-2026-10-28-LAUNCH said, in section 6.8, how the app lock, your emergency card in Apple Wallet and saving or sharing a picture of your QR code work, in sections 5.1 and 5.4 that a Wallet pass stops working with your link, and in section 8.3 that Apple keeps a Wallet pass for you, not for us. v1.6-2026-10-27-LAUNCH said, in sections 12 and 12.3, how you can delete your account yourself, on our website and in versions of the NeuraVate.ai app that offer it, and that asking by email still works. v1.6-2026-10-24-LAUNCH said, in section 6.3, that the web app lists, for you alone, each time your emergency page was opened and whether it was shown, and still never the network address or the device that opened it, and the table in section 7 said the same. v1.6-2026-10-21-LAUNCH covered the NeuraVate.ai app (sections 1.3 and 6.8) and corrected what section 12.3 says we do about Stripe's records of a card order. v1.5-2026-10-19-LAUNCH said, in sections 6.5 and 8.4, that an order for the printed card placed from the app carries your account ID to Stripe. v1.4-2026-10-15-LAUNCH corrected what section 12.3 says deleting your account removes and keeps. v1.3-2026-10-12-LAUNCH, the version published for the public launch, named the controller, the Data Protection Officer and the providers that v1.2-2026-10-06-LAUNCH described without naming. Earlier versions are available on request at [email protected].

• Controller: PairOx Pty Ltd (ABN 82 154 477 728, ACN 154 477 728), which operates the NeuraVate service (section 1.1)
• Registered address: 4 Lorikeet Street, Glenwood NSW 2768, Australia
• Telephone: +61 402 614 311
• Privacy contact, and requests to access, correct or delete your information: [email protected]
• EU representative: none appointed (section 2.1)
• UK representative: none appointed (section 2.2)
• Data protection officer: Rishu Kalra, Director of PairOx Pty Ltd — [email protected] (section 3.1)
• Website: neuravate.ai

Related documents: consumer-health-data-privacy-policy (US state health privacy) · cookie-policy (Cookie Policy) · retention-schedule (Data Retention Schedule, canonical for retention periods) · subprocessor-register (Subprocessor Register) · terms-of-service (Terms of Service).