Privacy Notice
This notice explains how NeuroVeya LTD uses personal information when you visit or use VeyaNeuro, create an account, take part in the beta, use rehabilitation and wellbeing features, contact a coach, join Connect or manage a membership.
Last updated: 29 September 20261. Who is responsible for your information?
NeuroVeya LTD, company number 17391971, is the controller for the VeyaNeuro personal information described in this notice unless we tell you otherwise.
VeyaNeuro is a product of NeuroVeya LTD. Neurological Rehabilitation Wales may have contributed rehabilitation experience or feedback to the product, but that does not by itself make NRWales the controller of VeyaNeuro account data.
2. Who this notice applies to
This notice covers visitors, registered users, invited beta testers, members and people who contact NeuroVeya LTD about VeyaNeuro.
VeyaNeuro is being designed for adults and, in future, for younger users. General access for children and young people will only be introduced with appropriate age, parent or guardian, privacy and safeguarding arrangements. This notice will be updated before any wider younger-user processing begins.
3. Personal information we use
Account and security information
- Name, email address, account ID and account creation details.
- Password hash and authentication/security information. We do not store your plain-text password.
- Password-reset records, session information and remembered-login tokens where you choose “Remember me”.
Onboarding, pathway and health/safety information
- Your selected VeyaNeuro pathway.
- Answers about activity limitations, recent treatment, concerning symptoms, movement or pain, falls/unsteadiness and support needs.
- Optional health notes you enter.
- A health-review flag generated from those answers to identify where extra support or caution may be appropriate. This is not a diagnosis.
- The version and date of safety information or waivers you acknowledge.
Movement, progress and check-in information
- Programmes, days and exercises you open or complete.
- Timed-set results, repetitions, effort ratings and optional exercise notes.
- Daily check-ins including pain, fatigue, confidence, mood and optional notes.
- XP, rewards, streaks, trophies, league progress and other motivational records.
- Monthly Challenge participation, display name, saved attempts and repetition totals where you use that feature.
Assessments and Brain Training
- Assessment responses, task scores, calculated results, dates and review history.
- Brain Training sessions, responses, scores, completion and progress information.
Profile, Connect and Private Chat with Coach
- Profile picture, if you choose to upload one.
- Connect posts, comments, reactions, reports and optional images that you choose to submit.
- Private Chat with Coach threads and messages between you and authorised VeyaNeuro staff/coaches.
Membership and billing information
- Membership plan, subscription status, billing-period information and Stripe customer/subscription references.
- VeyaNeuro does not intend to store your full payment-card details; payment details are handled by Stripe when you use Stripe Checkout or the billing portal.
Technical and device information
Our hosting and security systems may process session identifiers, browser/device information, IP addresses and routine server or security logs needed to operate, troubleshoot and protect the service. Browser storage and PWA caching are explained separately in our Cookie & Device Storage Policy.
4. Why we use personal information and our lawful bases
| Purpose | Examples | Typical UK GDPR basis |
|---|---|---|
| Provide VeyaNeuro | Accounts, programmes, progress, Brain Training, assessments, coach chat and membership features. | Contract, where processing is necessary to provide the service you request. |
| Operate health/safety features | Onboarding health questions, check-ins, assessment and rehabilitation information. | An Article 6 basis plus a valid Article 9 condition is required where health data is involved. See section 5. |
| Protect users and the service | Authentication, security logs, anti-abuse measures, fraud prevention and incident investigation. | Legitimate interests and, where applicable, legal obligation. |
| Run payments and membership | Stripe Checkout, subscription status, invoices and billing administration. | Contract and legal obligation for relevant financial/accounting records. |
| Provide optional community and support features | Connect content, profile images and Private Chat with Coach. | Contract or legitimate interests, depending on the feature and context. |
| Respond to requests and complaints | Support, rights requests, privacy complaints and dispute handling. | Legal obligation and legitimate interests. |
Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and whether your rights and interests override them.
5. Health and other special category information
Information about health, symptoms, disability, treatment, rehabilitation or functional ability can be special category personal data. UK data protection law requires NeuroVeya LTD to have both an Article 6 lawful basis and a separate Article 9 condition before processing it.
Where explicit consent is the Article 9 condition used for a beta feature, that consent must be specific, clearly separated from general terms or safety acknowledgements, recorded, and capable of being withdrawn. A VeyaNeuro safety waiver is not treated as blanket consent for all health-data processing.
If NeuroVeya LTD uses a different Article 9 condition for a particular future route, the relevant condition and purpose will be documented and explained before that processing begins.
6. Scores, flags and automated processing
VeyaNeuro automatically calculates some results such as progress percentages, XP, leaderboard scores, assessment totals, pain averages and similar summaries. Onboarding answers can also generate a health-review flag to indicate that additional support or caution may be appropriate.
These calculations are intended to organise the experience, support safety prompts and show progress. They are not intended to diagnose a condition or make solely automated decisions that have legal or similarly significant effects about you.
7. Connect and Private Chat with Coach
Connect is a member-only community area. Other signed-in members may see the content you choose to post there, including your reduced display identity, comments, reactions and any community image you upload. Reports and moderation information are available to authorised staff.
Private Chat with Coach is separate from Connect. Messages are intended to be visible only to the relevant member and authorised staff/coaches who need access to provide the service, administer it or respond to safety/security concerns.
Neither feature is an emergency service. Avoid posting information in Connect that you do not want other members to see.
8. Who we share information with
We may share personal information only where needed for a legitimate purpose and with appropriate safeguards. This can include:
- Web-hosting, database, infrastructure and security providers.
- Email or communications providers used for account and service messages.
- Stripe for subscription checkout, billing, payment processing and customer-portal functions.
- Professional advisers, insurers, auditors or technical specialists where necessary.
- Regulators, courts, law-enforcement bodies or other authorities where disclosure is legally required or otherwise lawful.
We do not sell VeyaNeuro personal information to advertisers.
9. International transfers
Some suppliers may process personal information outside the United Kingdom. Where UK data-protection rules treat that as a restricted transfer, NeuroVeya LTD will use an applicable UK transfer mechanism and carry out the checks required for the transfer.
10. How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected, together with any additional period needed for legal, accounting, security or dispute-resolution reasons.
- Account, programme and progress information is normally kept while the account is active and then handled through the account-closure/deletion process.
- Health, check-in and assessment history is kept only while needed for the VeyaNeuro feature and the applicable retention schedule.
- Private coach-chat and Connect records are kept for as long as needed for the feature, moderation, safeguarding, security or complaint handling, then deleted or anonymised according to the retention schedule.
- Remembered-login tokens expire after approximately 30 days unless renewed or revoked sooner.
- Payment/accounting records may need to be retained for longer where law or accounting requirements apply.
NeuroVeya LTD should maintain a documented retention schedule and review it as VeyaNeuro moves from beta to wider release.
11. How we protect information
VeyaNeuro uses measures including authenticated access, CSRF protection, restricted routes, password hashing, secure session cookies, server-side validation and role-based staff access. Some uploaded images are served through authenticated endpoints rather than public file links.
No system can be guaranteed completely secure. We review security controls as the service changes and investigate suspected security incidents where necessary.
12. Your data-protection rights
Depending on the circumstances, you may have rights including access, rectification, erasure, restriction, data portability, objection, withdrawal of consent where consent is the basis, and rights relating to certain automated decision-making.
These rights are not all absolute. We may need to verify your identity before acting on a request and may retain information where the law permits or requires us to do so.
13. Data-protection complaints
You can complain directly to NeuroVeya LTD if you believe your personal information has been handled incorrectly. We will provide a way to raise a data-protection complaint, acknowledge it within 30 days, investigate it without undue delay, keep you informed and communicate the outcome without undue delay.
If you remain dissatisfied, you can complain to the UK Information Commissioner’s Office (ICO). See the ICO’s complaint guidance.
14. Changes to this notice
We may update this notice as VeyaNeuro changes, new features or suppliers are introduced, legal requirements change, or the beta moves toward wider release. The latest version and update date will be published here.