Privacy policy

Last Updated: May 27, 2026

Brain Health Network Ltd (“Company”, “we”, “us”, “our”) is committed to protecting your personal information and your right to privacy. This Privacy Policy governs our main website www.brain.health (the “Website”) and all related educational, academic, and upcoming commercial services (collectively, the “Services”).

For the purposes of applicable data protection laws, including the UK Data Protection Act 2018 and the UK GDPR, Brain Health Network Ltd is the Data Controller of your personal information.

1. The Information We Collect

Depending on how you interact with our Services (currently as an informational resource, or in the future via our integrated commerce platform), we collect different tiers of information.

 

Information You Disclose to Us

• Identity and Contact Details: Name, email address, and communication preferences when you sign up for our informational resources or interact with our Meta Lead Generation ads.

• Inferred Wellness Interests: When you subscribe to our newsletter or engage with our educational content, we note your general interest in wellness and preventive health lifestyle topics. We do not collect medical history, clinical data, or information regarding any specific health conditions or diagnoses.

• Commerce Platform Data (Upcoming): Billing addresses, shipping addresses, payment card details, and transaction histories will be securely processed once our integrated shopping platform launches.

 

Information Automatically Collected

When you navigate the Website or click through our digital advertisements, we automatically capture diagnostic data via cookies and tracking pixels:

• Device and Network Data: Your IP address, browser type, operating system, device identifiers, and imprecise location data (derived from your IP address).

• Usage Logs: How you interact with the website, time stamps, pages viewed, and general interaction metrics.

• Strictly Necessary Shopify Cookies: While marketing tracking is entirely optional and deactivated by default, our platform utilises technical, session-based cookies that are strictly necessary to allow the website to load safely, preserve your navigation state, and handle future e-commerce cart sessions. These functional cookies do not compile advertising profiles.

2. How We Use Your Information

We process your data for the following specific business purposes:

3. Marketing, Pixels, and Third-Party Retargeting

We utilise digital marketing infrastructure to fund and target our awareness campaigns:

• Meta Ads & Instagram Retargeting: We deploy the Meta Pixel on our Website and utilise Meta Lead Generation frameworks. This infrastructure allows Meta to recognise overall website traffic hits and match them to Instagram and Facebook profiles. We only retarget users based on general, aggregate sitewide traffic; we do not segment, track, or share data with Meta regarding individual user engagement with specific health pillars or URLs.

• Google Ads & Remarketing: Google Analytics and Tracking Tags are used to monitor overall website visits, analysing general user traffic trends to display relevant educational advertisements across the Google Display Network to our broad audience.

How to Opt Out: You can restrict targeted advertising through the Global Privacy Control (GPC) signal on your browser, via the Digital Advertising Alliance choice page (https://optout.aboutads.info/), or by adjusting your ad preferences directly within your Meta and Google account settings.

4. Detailed Grounds for Disclosing and Sharing Your Information

We do not sell your personal data. We share your information only in the specific, legally protected scenarios outlined below:

 

Third-Party Vendors and Service Providers

We share data with third-party vendors, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We have data processing contracts in place with these parties designed to safeguard your personal information. They cannot do anything with your personal information unless we have explicitly instructed them to do so. These partners include:

• Platform Hosting: Shopify Inc. hosts our underlying architecture, data pipelines, and will anchor our upcoming commerce transactions.

• Advertising & Analytics Platforms: Meta Platforms Ireland Ltd and Google Ireland Ltd.

• Communications: Third-party email delivery service providers used to distribute our academic research papers and newsletters.

 

Payment Gateways and Transaction Security (Upcoming)

Once our commercial platform launches, all financial transactions will be managed by third-party payment processors (such as Shopify Payments, Stripe, or PayPal). We do not store your raw credit card numbers on our servers. Your financial information is provided directly to these processors, whose use of your data is governed by their respective privacy policies. These entities comply with PCI-DSS standards to guarantee secure transactional loops.

 

Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

 

Legal Obligations and Protection of Rights

We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, judicial proceedings, court orders, or legal processes (such as responding to a subpoena or a public authority meeting national security or law enforcement requirements).

 

Vital Interests and Fraud Prevention

We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person, and illegal activities, or as evidence in litigation in which we are involved.

5. International Data Transfers

Brain Health Network Ltd is based in the United Kingdom. Because our platform utilises globally distributed service providers like Shopify, Meta, and Google, your data may be transferred to and processed in countries outside the UK and European Economic Area (EEA), including the United States.

Whenever such transfers occur, we safeguard your data using UK International Data Transfer Addendums (IDTA)or European Commission Standard Contractual Clauses (SCCs) to guarantee an equivalent layer of data protection.

6. Data Security and Retention

We maintain technical and organisational safeguards to secure your personal data. However, no internet transmission is completely flawless: you transmit data at your own risk.

We retain your information only as long as necessary to fulfil its intended purpose (such as maintaining your active newsletter subscription). If you request account erasure or unsubscribe from our services, your information is securely deleted or anonymised within 30 days, unless statutory tax or legal requirements demand temporary storage.

7. Children's Privacy

Our academic information and upcoming store elements are entirely directed at adults. We do not knowingly collect or solicit personal information from individuals under the age of 13. If we discover any such inadvertent collection, we will permanently purge the record from our active databases immediately.

8. Your Legal Rights (UK & EEA Residents)

Under the UK GDPR and EU data protection frameworks, you have specific, enforceable rights over your data:

• Right of Access: Request a complete copy of all personal information we hold about you.

• Right to Rectification: Mandate corrections to any inaccurate or incomplete records.

• Right to Erasure: Request the permanent deletion of your data files (the "right to be forgotten").

• Right to Restrict or Object: Halt data processing for direct marketing or profiling based on legitimate interests.

• Withdrawal of Consent: Revoke your opt-in consent for tracking or newsletters at any time, with immediate effect.

To enforce any of these rights, contact our privacy compliance team directly at the verified endpoints listed below. If you believe our handling of your personal data breaches regulatory standards, you have the right to lodge a formal complaint with the UK Information Commissioner's Office (ICO) or your local EEA supervisory authority.

9. US State Privacy Rights (Including California)

If you are a resident of California or other US states executing comprehensive privacy laws, you are granted specific rights regarding access to your personal information under frameworks like the CCPA/CPRA:

• Right to Know and Access: You have the right to request the categories and specific pieces of personal data we have collected, the categories of sources, and the business purpose for collecting it.

• Right to Delete and Correct: You can request the deletion or correction of inaccurate personal data held by us.

• Right to Opt Out of Sharing for Targeted Advertising: We do not sell personal information for monetary compensation. However, our use of advertising pixels constitutes "sharing" for cross-context behavioural advertising under California law. You can exercise your right to opt out of these tracking technologies by using a browser equipped with the Global Privacy Control (GPC) signal or by updating your preferences via our cookie consent interface.

• Shine the Light Law: California Civil Code Section 1798.83 permits users who are California residents to request, once a year and free of charge, information regarding categories of personal information (if any) we disclosed to third parties for direct marketing purposes.

To exercise any of these rights, please submit a verifiable request to our compliance team at [email protected]. We will not discriminate against you for exercising your privacy rights.

10. Automated Decision-Making and Profiling

As an automated safety protocol against online theft, our platform utilises Shopify’s fraud-analysis mechanisms. When you attempt a transaction on our upcoming commerce platform, automated systems evaluate your IP address, device telemetry, and billing details to generate a fraud risk score. If an interaction is flagged as high-risk, the system may automatically decline the transaction.

Under UK/EEA frameworks, you have the right to challenge any automated decision that blocks your transaction and request a manual, human review by contacting us at [email protected].

11. Contact Us

If you have questions, comments, or wish to exercise your data rights, please contact us exclusively at our verified business endpoints.

• Email: [email protected]

• Postal Address: Brain Health Network Ltd 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ