NEUROFIT VR INC. PRIVACY POLICY Effective Date: March 1, 2026
Neurofit VR Inc., doing business as Neurofit (“Neurofit,” “we,” “us,” or “our”), is committed to maintaining the confidentiality and security of your personal information (“Personal Information”). This Privacy Policy explains how we collect, use, disclose, retain, and protect Personal Information in connection with our cognitive rehabilitation and assessment platform (the “Service”).
Neurofit provides a Software as a Service platform used by healthcare professionals, clinics, and other organizations to deliver cognitive rehabilitation activities and related services. In the course of providing the Service, we may receive and process personal information, including personal health information, on behalf of our customers and their clients. This Privacy Policy applies to all users of our Service, including Account Holders, Authorized Users, and visitors to our website.
1. Accountability
We are responsible for Personal Information under our control. We have designated a Privacy Officer responsible for compliance with this Privacy Policy and applicable privacy legislation. The identity and contact information of our Privacy Officer shall be made available to you upon request. You may also contact us directly at any time using the information provided in Section 16 below.
2. Applicable Privacy Laws
Neurofit is an Ontario, Canada corporation and is subject to applicable Canadian federal and provincial privacy laws. Depending on the nature of the Personal Information we process, the location of our customers, and the services provided, the following laws and regulations may apply:
• The Personal Information Protection and Electronic Documents Act (PIPEDA), Canada
• The Personal Health Information Protection Act, 2004 (PHIPA), Ontario, Canada
• The Health Insurance Portability and Accountability Act (HIPAA), United States, where applicable
• The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), United States, where applicable
• Other applicable provincial, state, and federal privacy laws We maintain appropriate technical and organizational measures to comply with the requirements of each applicable regime. Where you are a healthcare provider or other covered entity subject to HIPAA, Neurofit will enter into a Business Associate Agreement (“BAA”) upon written request, to the extent required by applicable law.
3. Information We Collect
We collect and process the following categories of Personal Information in connection with the Service:
3.1 Account and Billing Information
When you register for the Service or place an order, we collect information necessary to create and manage your account and process payments, including your legal company name, contact name, street address, email address, telephone number, billing contact information, and payment details (such as credit card information).
3.2 Customer Data (Including Personal Health Information)
In the course of using the Service, Account Holders and Authorized Users may submit, create, or generate data that includes personal and health information relating to their clients (“Customer Data”). Customer Data may include, without limitation, clinical and assessment data, progress records, session information, cognitive rehabilitation activity results, and any other personal or health information of clients submitted to or generated through the Service. Customer Data is owned by you, not Neurofit, as described in our License and Terms of Sale Agreement.
3.3 Usage and Technical Data
We automatically collect certain technical and usage information when you access the Service, including browser type, device information, IP address, pages visited, features used, Active User activity as recorded by the platform, and session duration. This information is used to maintain, improve, and secure the Service.
3.4 De-identified and Aggregated Data
We may create aggregated, de-identified, or anonymized data derived from use of the Service that cannot reasonably be used to identify any individual. Such data is not considered Personal Information or Customer Data under this Privacy Policy or our License and Terms of Sale Agreement, and we may use it for product improvement, research, benchmarking, and other lawful purposes.
4. Purposes for Collection, Use, and Disclosure
We collect, use, and disclose Personal Information for the following purposes:
• To provide, operate, and maintain the Service
• To process transactions and send related information, including billing confirmations and invoices
• To create and manage your account, including verifying your identity and administering access
• To communicate with you about the Service, including technical notices, updates, security alerts, and administrative messages
• To send marketing and promotional communications where you have opted in (see Section 12 below)
• To monitor Active User activity for billing purposes in accordance with the applicable plan
• To enforce our License and Terms of Sale Agreement and other policies
• To comply with applicable legal and regulatory obligations
• To respond to legal process or requests from government authorities
• To protect the rights, privacy, safety, or property of Neurofit, our customers, or the public Where the purposes for collection are clear from the context (for example, when you provide your name, address, and payment information as part of the order process), consent may be implied. In all other circumstances, we will identify the purposes before or at the time of collection.
5. Consent
Your knowledge and consent are required for the collection, use, or disclosure of Personal Information, unless circumstances make it impossible or impractical to obtain such consent, or unless otherwise permitted by law. We will not require you to consent to the collection of Personal Information as a condition of supply of the Service, except to the extent necessary to provide the Service.
You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain aspects of the Service. To withdraw consent, please contact us using the information in Section 16.
6. Limiting Collection
The collection of your Personal Information shall be limited to those details necessary for the purposes identified by us. With your consent, we may collect Personal Information from you in person, over the telephone, through the Service, or by corresponding with you via mail, email, or the internet.
7. Limiting Use, Disclosure, and Retention
Personal Information shall not be used or disclosed for purposes other than those for which it was collected, except with your consent or as required or permitted by law. Personal Information shall only be retained for as long as necessary for the fulfillment of those purposes.
7.1 Data Retention
We retain Personal Information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Upon termination of the Service agreement (other than by reason of your material breach), Neurofit will make Customer Data available for export in a standard machine-readable format (such as CSV) for a period of sixty (60) days following the effective date of termination, provided you submit a written request at or prior to the time of termination. After this sixty (60) day period, Neurofit may delete Customer Data in accordance with its then-current data retention policy. You are solely responsible for maintaining your own copies of Customer Data for regulatory compliance purposes.
7.2 Deletion
You may request deletion of your Personal Information at any time by contacting us using the information in Section 16. We will comply with your request subject to any legal obligations that require us to retain certain information (for example, regulatory record-keeping requirements applicable to health information). We will inform you of any such limitations at the time of your request.
8. Accuracy
Personal Information will be maintained in as accurate, complete, and up-to-date form as is necessary for the purposes for which it is to be used. You are responsible for providing accurate billing and account information and for updating this information within thirty (30) days of any change.
9. Safeguards
Personal Information shall be protected by security safeguards appropriate to the sensitivity of the information. We maintain appropriate technical and organizational measures to protect Personal Information against unauthorized or unlawful processing, as well as against accidental loss, destruction, or damage. These measures include, but are not limited to, data encryption in transit and at rest, access controls, regular security assessments, and staff training on data protection.
Where we process personal health information, we implement safeguards that meet or exceed the requirements of applicable health information privacy legislation, including PHIPA and, where applicable, HIPAA.
10. Openness
We shall make readily available to you specific information about our policies and practices related to the management of Personal Information. This Privacy Policy, as updated from time to time, will be published on our website and within the Service.
11. Cross-Border Data Transfers
In providing the Service, Neurofit may transfer Personal Information across borders, including between Canada and the United States. Any such transfer will be subject to safeguards ensuring a level of protection equivalent to that required by applicable law, including PIPEDA and PHIPA. By using the Service, you acknowledge and consent to such transfers, subject to the protections described in this Privacy Policy.
Where applicable, we enter into data processing agreements with service providers in other jurisdictions that include contractual safeguards for the protection of Personal Information.
12. Marketing Communications
When you initially log into the Service, you will be asked whether you wish to receive marketing and other non-critical Service-related communications from Neurofit. You may opt out of receiving such communications at that time or at any subsequent time by changing your preferences under your account settings or by contacting us directly.
Please note that even if you opt out of marketing communications, we may still send you important operational announcements regarding the Service, including security alerts, billing notices, and changes to our terms or policies.
13. Use by Minors
The Service is intended for use by individuals who are eighteen (18) years of age or older. Where the Service is used by or on behalf of an individual under the age of majority (a “Minor”), the Minor’s parent or legal guardian (the “Parent”) must be the sole contracting party and must provide consent for the collection, use, and disclosure of the Minor’s Personal Information.
The Parent may authorize a third-party provider, such as a licensed healthcare professional or occupational therapist, to administer or facilitate use of the Service with the Minor. In all cases, the Parent accepts full responsibility for the Minor’s use of the Service and for any Personal Information submitted in connection with such use. We do not knowingly collect Personal Information from children under the age of 13 without verifiable parental consent. If we become aware that we have collected Personal Information from a child under 13 without appropriate consent, we will take steps to delete such information promptly.
14. Individual Access and Data Portability
Upon request, you shall be informed of the existence, use, and disclosure of your Personal Information, and you shall be given access to it. You may verify the accuracy and completeness of your Personal Information and request that it be amended if appropriate.
In addition to the right of access and correction, you may also request:
• A copy of your Personal Information in a portable, machine-readable format (data portability)
• Deletion of your Personal Information, subject to legal and contractual limitations (see Section 7.2)
• Withdrawal of your consent to future collection, use, or disclosure (see Section 5) We will respond to your request within the timeframes required by applicable law (generally thirty (30) days under PIPEDA). In certain circumstances permitted by law, we may not be able to provide access to certain Personal Information — for example, where disclosure would reveal information about other individuals, or where there are legal, security, or proprietary restrictions. We will inform you of the reasons for any refusal.
California residents may have additional rights under the CCPA, including the right to know what Personal Information is collected, the right to request deletion, and the right to opt out of the sale of Personal Information. Neurofit does not sell Personal Information. To exercise rights under the CCPA, please contact us using the information in Section 16.
15. Data Breach Notification
In the event of a data breach affecting Personal Information that creates a real risk of significant harm, Neurofit shall notify affected individuals and applicable regulatory authorities promptly and within legally required timeframes, including:
• The Office of the Privacy Commissioner of Canada, as required under PIPEDA
• The Information and Privacy Commissioner of Ontario, where required under PHIPA
• The U.S. Department of Health and Human Services and affected individuals, where required under HIPAA
• Other applicable regulatory bodies as required by law Notification will include, to the extent known, a description of the breach, the types of Personal Information affected, the steps we are taking to address the breach, and recommendations for affected individuals to mitigate potential harm. We will also take all reasonable steps to mitigate any resultant harm.
16. Complaints, Questions, and Contact Information
You may direct any questions, concerns, suggestions, or other enquiries with respect to this Privacy Policy and our privacy practices, including requests to access, correct, or delete your Personal Information, by contacting:
Alexander Theodorou, Privacy Officer Neurofit VR Inc. Email: info@neurofit.ca Website: www.neurofit.ca
If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada or the applicable provincial privacy commissioner.
17. Third-Party Service Providers
We may engage third-party service providers (“sub-processors”) to assist in providing the Service or to perform functions on our behalf. These providers may have access to Personal Information only to the extent necessary to perform their functions and are contractually obligated to protect such information in a manner consistent with this Privacy Policy and applicable law. Categories of sub-processors may include:
• Cloud hosting and infrastructure providers
• Payment processors
• Analytics and performance monitoring tools
• Customer support and communication platforms
• Security and compliance services We conduct due diligence on our sub-processors and require them to maintain appropriate security safeguards. A current list of sub-processors is available upon request.
18. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website and within the Service to personalize your experience, improve functionality, analyze usage patterns, and support security.
18.1 Types of Cookies
• Essential cookies: Required for the operation of the website and Service (e.g., session management, authentication)
• Analytics cookies: Help us understand how visitors interact with our website and Service, enabling us to improve performance and user experience
• Preference cookies: Remember your settings and preferences for a more personalized experience
18.2 Your Choices
You may choose to decline or remove cookies through your browser settings. Please note that disabling cookies may affect the functionality of the website or Service. Where required by applicable law, we will obtain your consent before placing non-essential cookies.
We do not use cookies or tracking technologies for third-party advertising purposes.
19. External Site Links
For your convenience, our website and Service may provide links to third-party websites that are not controlled or owned by us. A link between our website and another website does not mean that we endorse, recommend, sponsor, or approve any such website. We are not responsible for the content or privacy practices of third-party websites, and we encourage you to review the privacy statements of those sites. We make no representation or warranty about the legality, accuracy, or completeness of any third-party website.
20. Confidentiality
All non-public information disclosed in connection with the Service, including Customer Data and any personal health information, is treated as confidential. Obligations of confidentiality with respect to Customer Data that constitutes personal health information shall survive indefinitely to the extent required by applicable law. Additional confidentiality terms are set forth in our License and Terms of Sale Agreement.
21. Changes to This Privacy Policy
We reserve the right to modify this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy on our website and, where appropriate, by direct notification through the Service or by email. Your continued use of the Service following the posting of changes constitutes your acceptance of such changes. We encourage you to review this Privacy Policy periodically.
22. Governing Law
This Privacy Policy shall be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of law provisions. Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of the Province of Ontario, Canada. Neurofit VR Inc. - Privacy Policy
23. Signing In With Google
You may choose to create an account or sign in using your Google account rather than a password. If you do, Google provides us with your email address, your name, your profile picture and a unique identifier for your Google account. We request nothing further from Google, and we do not receive access to Gmail, Drive, Calendar, Contacts or any other Google service.
We retain that unique identifier in order to recognize you on subsequent sign-ins, together with a record that the account is linked to Google and the date of that linkage. We never receive or store your Google password, and we retain no access to your Google account after you have signed in.
Where an email address is already associated with a Neurofit account secured by a password, signing in with Google will not alter that account or grant access to it.
You may disconnect Neurofit from your Google account at any time at myaccount.google.com/permissions. Doing so ends sign-in by Google but does not delete your Neurofit account or your Personal Information; to request deletion, contact us using the details in section 16.