Version 2.0 · Last updated: 16 October 2026

Privacy Policy

This policy explains how Auto Train Brain Inc. collects, uses and shares personal data for Auto Train Brain, NeuroSphere, ATB Games, ATB Edu and EyeZenith (the “services”). Users in Türkiye are covered by the Turkish KVKK Aydınlatma Metni of HMS Health Mobile Software A.Ş.

1. Who we are

Auto Train Brain Inc., 112 Capitol Trail, Suite A3131, Newark, DE 19711, USA. Privacy requests: privacy@autotrainbrain.com. General: info@autotrainbrain.com, +1 213 423 0846.

2. What we collect

Account data: username, email, date of birth or age range, optional first name and gender.
Purchase data: what you bought, when, and the amount. Card details are handled by Stripe, Apple or Google; we never receive full card numbers.
Usage and device data: app version, device model, operating system, pseudonymous app and installation identifiers, approximate location from IP address, in-app events and crash reports (Google Firebase Analytics and Crashlytics).
Consumer health data: EEG brain-wave signals and session performance (headset products); heart-rate variability and heart-rate samples (NeuroSphere, EyeZenith, Apple HealthKit / Health Connect if you allow it); eye-movement and blink metrics derived on your device (EyeZenith). EyeZenith camera frames and audio are processed on your device and are not uploaded.
AI Coach messages: what you type to the AI Coach and optional context (first name, age range, wellness trend).

3. How we use it

To provide the services you request, produce your readings and reports, and support you.
To keep the services secure and fix errors.
To meet legal, tax and accounting obligations.
To send marketing emails, only if you opt in. You can opt out at any time.
To improve the services and for research, only with de-identified data or with your separate consent.

We do not sell personal data, we do not use consumer health data for advertising, and we do not use HealthKit data for advertising or share it with data brokers.

4. Consent for health data

We collect and use consumer health data only after you give separate, opt-in consent in the app, for the purposes shown at that time. Using the services or accepting our terms is not consent. You can withdraw consent in the app settings or by writing to privacy@autotrainbrain.com; we then stop collecting that data and delete what we hold, except where the law requires us to keep it.

5. Who we share it with

Service providers under written contracts: Amazon Web Services (hosting, USA and Germany), MongoDB Atlas (database, Germany), Google Firebase (analytics and crash reports, USA), Stripe (payments, USA), Apple and Google (app stores and payments).
AI providers: AI Coach messages are sent to large-language-model providers (OpenAI, Anthropic or Google) under enterprise terms that prohibit training on your data. Raw EEG, HRV and eye-tracking measurements are not sent.
Our affiliate HMS Health Mobile Software A.Ş. (Türkiye), which provides development and support.
Researchers: only de-identified data, or identifiable data with your separate consent.
Authorities where the law requires it.

6. International transfers

Data is stored in Germany and the USA and may be accessed from Türkiye for support. Transfers from the EU/EEA, UK and Türkiye use the European Commission’s Standard Contractual Clauses or the Turkish standard contracts approved by the KVKK Board, with encryption in transit and at rest.

7. How long we keep it

Account data: while your account is open, plus 1 year.
Consumer health data: while your account is open, plus 6 months, or sooner if you withdraw consent or ask us to delete it.
Purchase and tax records: 7 years (US) or 10 years (Türkiye).
Usage logs and analytics: 12 months.
Support messages: 1 year.

8. Children

Auto Train Brain, ATB Edu and ATB Games are designed for children aged 5–12 and are used through a parent or guardian account. Under the Children’s Online Privacy Protection Act (COPPA), we collect personal information from a child under 13 only after obtaining verifiable consent from the parent or guardian, who creates the account and gives that consent. We collect only what is needed to run the child’s sessions, we do not show behavioural advertising to children, and we do not share children’s data with third parties for marketing. A parent can review the child’s data, ask us to delete it, or withdraw consent at any time by writing to privacy@autotrainbrain.com.

EyeZenith and NeuroSphere are not directed to children under 13. If we learn that we collected data from a child under 13 without parental consent, we delete it.

9. Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut and similar laws)

This section applies to consumer health data as defined by the Washington My Health My Data Act and similar state laws.

Categories: EEG signals, session performance, heart-rate and HRV values, eye-movement and blink metrics, and wellness scores derived from them.
Purposes: providing the readings, sessions and reports you request.
Sources: you, your EEG headset, your phone’s sensors, and Apple Health or Health Connect if you connect them.
Sharing: only with the service providers in section 5 that host or process it for us. We do not sell consumer health data.
Your rights: to confirm whether we collect, share or sell your consumer health data; to access it and the list of third parties and affiliates we share it with; to withdraw consent; and to have it deleted.
How to use them: email privacy@autotrainbrain.com. We respond within 45 days. If we decline, you can appeal by replying to our answer; if the appeal is denied you may contact your state Attorney General.

10. California and other US state rights

Depending on where you live, you may have the right to know, access, correct and delete your personal information, to opt out of the sale or sharing of personal information and of targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising, and we use sensitive personal information only to provide the services you request. We honour Global Privacy Control signals. To make a request, email privacy@autotrainbrain.com; an authorised agent may act for you with your written permission.

11. EU/EEA, UK and Canada

If the GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing the service), legitimate interests (security, error fixing, improvement), legal obligation (tax records), and explicit consent (health data and marketing). You have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your data protection authority. Canadian users have the rights described under PIPEDA and may complain to the Office of the Privacy Commissioner of Canada.

12. Breach notification

We are not a HIPAA covered entity or business associate. If unsecured health data is breached, we notify affected users without unreasonable delay and no later than 60 days after discovery, and we notify the Federal Trade Commission as required by the FTC Health Breach Notification Rule and applicable state law.

13. Security

We use encryption in transit and at rest, role-based access controls, multi-factor authentication for staff and regular security reviews. No system is completely secure.

14. Apple HealthKit and Health Connect

EyeZenith reads heart-rate samples from HealthKit or Health Connect only with your permission, processes them on your device and does not send them to our servers. You can revoke access in your phone’s settings at any time.

15. Cookies

Our website uses essential cookies and, only with your consent, analytics and advertising cookies. You can change your choice at any time from the cookie settings link in the footer.

16. Changes

We will post updates here and change the date above. For material changes we will notify you by email or in the app before they take effect, and we will ask for new consent where the law requires it.

17. Medical disclaimer

Our services are general wellness products. They are not medical devices and are not intended to diagnose, treat, cure or prevent any disease.