Privacy policy.

01Who is the data controller?

The controller of personal data is:

NEURO INSTITUTE EMMANUEL SRL
Tax ID (CIF): 51226054
Registered office: 2 Intrarea Tocului, Sector 1, Bucharest
Trade Register no.: J2025007209001

General email: contact@emmanuel-clinix.ro
Email for data protection requests: contact@emmanuel-clinix.ro
Phone: +40 790 099 070

In this policy, the terms "NeuroFit", "we", "the Controller" or "the company" refer to the entity identified above.

02What is NeuroFit?

NeuroFit is a concept dedicated to brain wellness, built around experiences such as:

FOCUS · RELAX · RESET · LONGEVITY

NeuroFit experiences are wellness and complementary in nature and do not, in themselves, constitute medical diagnosis or treatment services.

When specialised services are needed, they may be provided separately through Emmanuel CliniX, by the appropriate professionals, within the limits of their competence and qualifications.

This distinction is also relevant to how certain categories of data may be collected and processed.

03What data may we collect?

The data collected depends on how you interact with NeuroFit.

A. IDENTIFICATION DATA

We may collect:

• last name;
• first name;
• date of birth, when necessary;
• other identification information needed for the requested service.

We do not request identification data that is not necessary for the purpose for which it is collected.

04Contact details

We may collect:

• email address;
• phone number;
• address, when needed for invoicing;
• other contact details provided voluntarily.

This information may be used to manage bookings, memberships, your account and our communications with you.

05NeuroFit account data

If the website allows you to create an account, we may process information such as:

• the account identifier;
• secure login credentials;
• the active membership;
• the number of sessions/credits;
• booking history;
• sessions used;
• cancellations;
• reschedulings;
• the membership renewal date;
• account preferences.

Passwords must be kept using appropriate technical security mechanisms and must not be stored in readable form.

06Booking data

When you make a booking, we may process:

• the chosen service or experience;
• the date and time of the booking;
• the location;
• booking history;
• the booking status;
• cancellations and reschedulings;
• information needed to prepare the session.

This information is used to manage the relationship between NeuroFit and the client.

07Payment and transaction data

We may process:

• the products or services purchased;
• the transaction amount;
• the currency;
• the payment date;
• the payment status;
• information needed for invoicing;
• transaction identifiers;
• information about refunds, if any.

Online payments are processed through the payment service providers integrated into the website.

NeuroFit must not store the full card number, the CVV/CVC code or other complete card authentication data when these are processed directly by the authorised payment provider.

08Safety and screening data

Before using certain NeuroFit technologies, we may ask you to complete a safety screening.

Its purpose is to identify situations that may require:

USE · ADAPTATION · EXCLUSION · POSTPONEMENT

of a particular technology.

The screening may include questions about:

• implanted medical or electronic devices;
• pacemaker;
• neurostimulators;
• cochlear implant;
• relevant metal implants or materials;
• a history of epilepsy or seizures;
• neurosurgical procedures;
• relevant head injuries;
• certain neurological conditions;
• certain cardiovascular conditions;
• pregnancy or possible pregnancy;
• photosensitivity;
• skin conditions or lesions;
• relevant medication;
• recent changes to treatment;
• other information relevant to the contraindications, precautions and conditions of use of the device concerned.

The list is indicative.

The information requested must be adapted to the technology and device actually used.

09Health data

Some information provided during the screening may constitute health data, a special category of personal data.

This information benefits from an additional level of protection.

Health data will only be processed when there is both a legal basis for processing personal data and the additional condition required for processing special categories of data under applicable law.

When processing is based on explicit consent, that consent must be given separately, in an informed and unambiguous way, and may be withdrawn under the conditions provided by law.

We do not use health data provided during the NeuroFit screening for behavioural advertising, remarketing or building commercial audiences.

10Minimising health data

NeuroFit follows the principle of data minimisation.

This means we must not ask for a person's entire medical history when it is not necessary.

The screening should mainly cover information relevant to:

• the safe use of the device;
• the applicable contraindications;
• the applicable precautions;
• eligibility for the experience concerned.

NeuroFit does not use the screening to make a medical diagnosis.

11Your communications with us

If you contact us by:

• email;
• contact form;
• phone;
• WhatsApp;
• social media;
• other communication channels,

we may process the data you provide and the content of the communication in order to respond to your request and manage our relationship with you.

We recommend that you do not send medical information or other sensitive data through unsecured channels unless necessary.

12Technical data

When you use the website, certain technical information may be collected, such as:

• IP address;
• browser type;
• device type;
• operating system;
• the pages visited;
• time of access;
• online identifiers;
• technical session information;
• information about your interaction with the website.

How cookies and similar technologies are used is described separately in the NeuroFit Cookie Policy.

13Why do we process data?

Depending on the situation, we may process data for:

BOOKINGS

Creating, confirming, changing and managing bookings.

MEMBERSHIPS

Managing the membership, sessions and credits.

PAYMENTS

Processing and recording transactions.

INVOICING

Issuing tax documents and complying with financial and accounting obligations.

COMMUNICATION

Sending confirmations, reminders and information about purchased services.

SAFETY

Carrying out the screening and checking the conditions of use of the technologies.

SUPPORT

Handling questions, requests and complaints.

SECURITY

Protecting the website, accounts and systems.

LEGAL OBLIGATIONS

Complying with obligations imposed by applicable law.

ANALYTICS

Understanding how the website is used, when permitted and, if necessary, based on consent.

MARKETING

Sending commercial communications and measuring campaigns, when there is a legal basis.

14Legal bases

Depending on the purpose, data may be processed on the basis of:

PERFORMANCE OF A CONTRACT

When processing is necessary for:

• making the booking;
• managing the membership;
• providing the service;
• managing the account;
• processing the purchase.

PRE-CONTRACTUAL STEPS

When you contact us before buying a service and we need to respond to your request.

LEGAL OBLIGATION

When we must keep or provide certain information under applicable law.

LEGITIMATE INTEREST

Where we have a legitimate interest and it does not override the rights and freedoms of the data subject.

Depending on the situation, this may include:

• the security of systems;
• fraud prevention;
• defending our rights;
• managing certain operational matters.

CONSENT

When the law requires consent, including for certain:

• commercial communications;
• optional cookies;
• tracking technologies;
• processing of special categories of data, when explicit consent is the legal condition relied on.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.

15Screening data is not marketing data

We keep a clear separation between information needed for safety and information used in commercial activities.

Screening answers and information about conditions, medication, implants, contraindications or other health data are not used to personalise ads.

This data must not be intentionally uploaded to Meta, Google, TikTok or other advertising platforms to create audiences or commercial profiles.

16Marketing

If you choose to receive commercial communications, we may use your contact details to send information about:

• NeuroFit;
• experiences;
• memberships;
• events;
• news;
• offers;
• launches.

When marketing is based on consent, that consent may be withdrawn at any time.

Unsubscribing from marketing does not affect operational communications needed to manage a service you have already purchased.

For example, we may continue to send booking confirmations, payment notifications or essential membership information.

17Who may we share data with?

We may use external providers to operate our services.

Depending on the final configuration, these may include:

E-COMMERCE PLATFORM

For example Shopify, if that is the platform used.

PAYMENT PROCESSOR

For processing transactions.

BOOKING SYSTEM

For managing bookings.

HOSTING AND IT INFRASTRUCTURE

For operating and securing the services.

EMAIL / SMS

For confirmations and communications.

INVOICING AND ACCOUNTING

For complying with financial and accounting obligations.

ANALYTICS

Only under the conditions permitted by law and in line with your cookie preferences.

ADVERTISING

Only for permitted data and purposes and where there is a legal basis.

ADVISERS

Lawyers, accountants, IT consultants or other professionals, when access is necessary.

AUTHORITIES

When disclosure is required by law.

Providers must receive only the data needed to fulfil their role and must comply with applicable data protection obligations.

18Emmanuel CliniX and specialised services

NeuroFit offers brain wellness experiences.

Specialised services available through Emmanuel CliniX may involve additional data processing and may be subject to specific legal and professional requirements.

If a person accesses services such as:

• psychotherapy;
• psychiatric consultation;
• neurological consultation;
• BrainMap/qEEG;
• other professional services,

they must be properly informed about how their data is processed in the context of that service.

The fact that a specialised service is commercially included in a package or membership does not change the distinct professional nature of the service.

19Transfers outside the European Economic Area

Some technology providers may process data in countries outside the European Economic Area.

When an international data transfer takes place, we will aim to use the applicable legal mechanisms, such as:

• adequacy decisions;
• standard contractual clauses;
• other safeguards recognised by applicable law.

20How long do we keep data?

We do not keep data longer than necessary for the purpose for which it was collected, except where the law requires a longer period.

The retention period may depend on:

• the nature of the information;
• the existence of an account;
• the length of the membership;
• the contractual relationship;
• financial and accounting obligations;
• the need to resolve a complaint;
• statutory limitation periods;
• applicable professional obligations;
• the need to demonstrate compliance with safety conditions.

Data must not be kept "just in case" without a justified purpose.

For screening data and any health data, retention periods appropriate to the purpose and applicable obligations must be set.

21Data security

We apply technical and organisational measures designed to protect data against:

• unauthorised access;
• unauthorised disclosure;
• loss;
• alteration;
• destruction;
• misuse.

Depending on the nature of the data, measures may include:

• access control;
• individual staff accounts;
• authentication;
• role-based access restrictions;
• backup;
• IT security measures;
• staff training;
• internal procedures for sensitive data.

Access to screening information must be limited to the people who need it to carry out their duties.

However, no IT system can guarantee absolute security.

22Confidentiality of the screening

Information provided for the safe use of the technologies is treated with a higher level of confidentiality.

Staff must only access this information when access is necessary for their role.

NeuroFit aims to avoid unnecessarily displaying sensitive data in:

• general dashboards;
• notifications;
• marketing systems;
• analytics tools;
• advertising platforms.

23Your rights

Under the conditions provided by applicable law, you may benefit from:

THE RIGHT OF ACCESS

You can request information about the data we process about you.

THE RIGHT TO RECTIFICATION

You can request that inaccurate data be corrected or completed.

THE RIGHT TO ERASURE

Under certain conditions, you can request that data be erased.

This right is not absolute when there is a legal obligation or another basis for keeping the data.

THE RIGHT TO RESTRICTION OF PROCESSING

You can request that certain processing be restricted under the conditions provided by law.

THE RIGHT TO DATA PORTABILITY

In the situations provided by law, you can request that certain data be transmitted in a structured, commonly used and machine-readable format.

THE RIGHT TO OBJECT

You can object to certain processing based on legitimate interest.

THE RIGHT TO WITHDRAW CONSENT

When processing is based on consent, you can withdraw it.

RIGHTS RELATED TO AUTOMATED DECISIONS

You benefit from the rights provided by law where decisions based solely on automated processing are used and the relevant legal conditions are met.

24How do you exercise your rights?

You can send your request to:

contact@emmanuel-clinix.ro

To protect data, we may ask for reasonable information to verify the identity of the person making the request.

We will respond to requests within the time limits provided by applicable law.

25The right to lodge a complaint

If you believe your personal data is being processed in breach of the law, you have the right to lodge a complaint with the competent data protection authority.

In Romania, the competent authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

This right does not affect your ability to contact us first to clarify or resolve the situation.

26Minors' data

Certain experiences or services may be available to minors only under the conditions set by NeuroFit and applicable law.

When necessary, a minor's data is processed with the involvement of their legal representative.

For a minor's safety screening, information may be requested from the legal representative.

Minors' data, especially health information, receives extra attention and is not used for advertising profiling based on health status.

27Cookies and tracking

The website may use cookies and similar technologies.

Strictly necessary cookies allow the website to work.

Optional cookies, including those for analytics or marketing, are managed in line with the user's stated preferences and applicable law.

For details, see the NeuroFit Cookie Policy.

Preferences can be changed through:

Cookie settings →

28Automated decisions and profiling

NeuroFit does not use health information from the screening to make automated commercial decisions or to create advertising profiles based on health status.

If automated systems that produce legal effects or similarly significant effects on people are introduced in the future, the policy will be updated and the safeguards provided by law will be applied.

29Changes to this policy

We may periodically update this Privacy Policy to reflect:

• legislative changes;
• changes to the services;
• the introduction of new providers;
• technological changes;
• changes in how we process data.

The date of the last update will be shown at the top of the document.

When changes are significant, we will use reasonable means of informing you, where necessary.

30Contact

For questions about data protection or to exercise your rights:

NEURO INSTITUTE EMMANUEL SRL
Tax ID (CIF): 51226054
Registered office: 2 Intrarea Tocului, Sector 1, Bucharest
Trade Register no.: J2025007209001

General email: contact@emmanuel-clinix.ro
Data protection email: contact@emmanuel-clinix.ro
Phone: +40 790 099 070