Who this policy covers
This policy applies to the Psio mobile app, the Psio web accounts at clients.psio.app, facilitators.psio.app and admin.psio.app, and our website at psio.app. In it, "Psio", "we" and "us" mean Psio, Inc.
How we handle your information depends on how you use Psio.
- Through a clinic covered by HIPAA. If your clinic is a healthcare provider covered by HIPAA, we handle your information on the clinic's behalf as its business associate, under an agreement that limits what we may do with it. Your clinic's notice of privacy practices also applies, and some requests, such as a copy of your clinical record, go through the clinic.
- Through another practice or facilitator. Some practices, such as Colorado natural medicine healing centers and facilitators, are not covered by HIPAA. We provide Psio to them under a contract, and this policy explains how we handle your information.
- Directly with Psio. If you start care with Psio directly, Psio is responsible for your information. You sign a participant services agreement with us in the app. Your permission to collect and use brain data is a separate consent, described below.
- On our website. If you only use psio.app, this policy and our consumer health data notice apply.
Information we collect
Account details. Your email address and password, and your role (client, facilitator or administrator). Accounts are created by invitation; we do not offer open sign-up.
Details your facilitator enters. Your name, email address, birth year, sex if you choose to share it, the type of care you are receiving, the areas you are working on, and the questionnaires chosen for you.
Brain and body measurements. When you wear the Psio headband, the app records brain activity (EEG) and how well each sensor is in contact. From these it calculates measures such as the strength of different brain rhythms. Where supported, it also records heart rate and heart rate variability from the headband.
Session records. For a medicine session: the type of care, the substance and dose, timings, the moments your facilitator marks during the session, any music playing at those moments, and your facilitator's notes. For neurofeedback practice: which program you trained, how long, and how the session went, including any rating or short note you leave.
What you write. Your intentions, journal entries, questionnaire answers, and messages with your facilitator. Some of these are currently kept only on your device.
Photos of paper notes. A facilitator can photograph handwritten session notes so the app can read the text. The text is recognized on the device itself; the photo is not kept and never leaves the device.
Device and technical information. Your headset's model and firmware, the app version, a notification token if you allow notifications, crash reports, and app usage events with an app instance identifier, which Firebase collects so we can see how the app is used and where it breaks. These events do not include health information.
From our website. What you submit through our forms: an early-access request from a clinic or facilitator; a request to start care, with your name, email address, phone number and a short message; and, if you ask for your full assessment results, your name, email address, score and results. We do not keep your individual assessment answers. psio.app does not use advertising or tracking cookies.
The Psio headband connects to your phone or tablet directly over Bluetooth. The app asks for Bluetooth access to do that, and for camera or photo access only when reading paper notes. It does not use your microphone, your contacts, or your location.
Brain data and your consent
Recordings of brain activity are "neural data" under some state privacy laws, and raw recordings may be treated as biometric identifiers, because in principle they could be used to recognize a person. We do not use them to identify anyone.
We collect brain data only with your consent. In the Psio app, a separate consent screen appears after you sign your participant services agreement and before anything is recorded. Nothing is recorded until you check both boxes (one to collect and use, one to share as described below) and select "I agree"; "Not now" is always an equal choice, and the app then records nothing. Clients who signed our earlier participant agreement are asked to accept this consent before their next recording. On our website, we ask for your consent before you send us health information through a form.
You can withdraw your consent at any time in the app (Settings, Privacy, Brain data) or by emailing help@psio.app. We then stop recording, stop using your identifiable data to improve our algorithms, and delete your raw recordings, unless the law or your clinic's record-keeping obligations require us to keep or return them, in which case we tell you. De-identified data and combined statistics already created, and algorithm improvements already made, cannot be undone.
How we use it
- To provide the service: recording sessions, building and running your neurofeedback program, and showing progress to you and your care team.
- To compare your measurements with reference data from other people, so changes can be put in context.
- To let you and your facilitator stay in touch, and to send you reminders and notifications you have allowed.
- To keep the service secure and working: signing you in, preventing misuse, and fixing crashes and errors.
- To answer requests you send us, including early-access, start-care and support requests, and to email you your assessment results when you ask for them. If you give us your email address through a website form, we may also send occasional updates, which you can unsubscribe from at any time.
- To improve Psio's own algorithms and software, such as how we calculate brain measures, build reference comparisons and design neurofeedback programs. This work is done inside Psio, with your name and contact details kept separate from the brain data used for it.
- To create combined statistics across many clients, such as an average change across a group, for reports, funding materials, our website and marketing. Combined statistics never show an individual's own results.
- Only if you turn on that choice in the app, or give us separate written permission: to show your own results, such as brain maps and questionnaire scores, labeled with a code instead of your name, on our website and in our materials. Someone who knows you well might still recognize your story. You can withdraw this for future materials at any time; we cannot recall materials already published or printed.
Values such as brain rhythm measures, comparisons and training targets are calculated by fixed, tested methods. Psio does not diagnose or treat any condition.
What we do not do
- We do not sell your information.
- We do not use your information for advertising, and we do not share it with advertisers.
- We do not give your recordings to outside companies to build their own products or AI models.
- We do not try to re-identify anyone from de-identified data, and anyone we share de-identified data with must agree in writing not to try either.
- Psio does not currently send your information to any AI model. Before any AI feature processes your information, we will update this policy and ask for your permission where the law requires it, and we will not allow any outside AI provider to train its models on your information.
Who can see your information
- You. You can see your own history, intentions and messages in the app and at clients.psio.app.
- Your facilitator and clinic. They can see your session records, measurements and messages, and the intentions, journal entries and questionnaire answers you share with them.
- Psio's care team, if you receive services from Psio directly: the registered nurse and neuroscientist who oversee the direct program.
- Psio staff, for support and to improve our algorithms. Access is limited by role. When a clinic needs help, a small number of Psio administrators can view its records; each access is time-limited, records a reason, and is logged.
- Service providers who run parts of Psio for us and may only use the information to do so (listed below).
- Research partners, only if you turn on the research choice, and then only de-identified data, under a written agreement that protects it at least as strongly as we do and forbids re-identifying anyone.
- When the law requires it, for example in response to a valid legal order, or to protect someone's safety.
Service providers
- Google Cloud and Firebase: hosting, databases, file storage, sign-in, notifications, crash reporting and app usage events.
- Supabase: storage for older parts of Psio while they are moved to Google Cloud.
- Resend: sending invitation emails.
- Netlify: hosting psio.app and receiving its form submissions.
- Zapier and Google Workspace: passing website form submissions to our team and sending assessment results by email.
Research, publication and your own results
Two choices in the app are separate from your main consent. Each is off unless you turn it on, and saying no does not change your price, your care, or your program.
- Research and publication. We include your de-identified measurements, keeping only your age range and sex, in research and in papers and presentations we prepare, including with academic research partners. If a specific study needs ethics board approval, we will ask you separately before including you.
- Showing your own results. We may show your individual results, labeled with a code instead of your name, on our website and in our materials, as described above.
When we de-identify data, we remove your name, contact details and other direct identifiers, and keep only your age range and sex. Because brain recordings are personal by nature, we protect de-identified recordings with the same security as the rest of your information. If you turn a choice off, we stop using your data for it in new work, but we cannot remove data already used in completed analyses or publications.
Where your information is stored and how it is protected
We store information in the United States, with Google Cloud. It is encrypted in transit and at rest, access is limited by role, and staff support access is logged. Some session information is kept on your device until it is saved to our servers, and may be included in your device's own backups.
If there is a breach
No system is perfectly secure. If a breach affects your information:
- If you use Psio through a clinic covered by HIPAA, we will tell your clinic promptly, within the time our agreement with it sets, and the clinic will notify you unless that agreement asks us to.
- Otherwise, we will notify you directly, without unreasonable delay and within the time the law sets (30 days in Colorado), and we will notify the authorities where the law requires.
How long we keep it
We keep information only as long as we need it, then delete it or keep it only in a form that no longer identifies you.
- Raw brain recordings are deleted once they are no longer needed for the purpose we collected them for, and no later than 24 months after your last session or other contact with us. If your clinic must keep records longer by law, we return your recordings to the clinic rather than delete them first. The measures calculated from them stay with your session records.
- If you use Psio through a clinic, we keep your records for as long as our agreement with your clinic requires. When that agreement ends, we give the clinic a full copy of its records, then delete ours within 90 days, unless the law requires us to keep them longer.
- If you receive care from Psio directly, we keep your session records and measures for 7 years after your last session, so your care history is available to you and to us, then delete them.
- Website form submissions from people who do not go on to use Psio are deleted 2 years after our last contact.
- App usage events and crash reports are kept for no more than 14 months.
- Records of who accessed information, such as staff support access, are kept for 6 years.
- Records of your consent and choices are kept for the life of your account plus 6 years.
- Backups are overwritten on a rolling basis, so deleted information leaves them within 35 days.
- De-identified data may be kept without a time limit, under the commitments above.
Your choices and rights
- Ask for a copy of your information.
- Ask us to correct information that is wrong.
- Ask us to delete your account and your information.
- Withdraw your consent to collecting brain data, or turn off either optional choice, at any time in the app or by email.
- Turn notifications off in your device settings.
To make a request, use our account and data request form, or email help@psio.app from the address on your account. We will confirm your identity before acting, and if your request concerns records your clinic holds, we will work with them to respond. If you live in Washington, Nevada or Connecticut, our consumer health data notice describes further rights, and you may have rights under other local laws too.
Children
Psio is for adults. We do not knowingly collect information from anyone under 18.
Changes to this policy
If we change this policy, we will update the date at the top. If a change affects how we use information we already hold, we will tell you in the app or by email before it takes effect.
Contact us
Questions about this policy or your information: help@psio.app. By mail: Psio, Inc., 2525 Arapahoe Ave, Suite E4-1260, Boulder, CO 80302.