Your Privacy Rights (US)

1. Introduction

Under US state privacy laws — including the California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (CDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and others — you have rights regarding your personal information.

This page explains your rights and how to exercise them. For full details on our data practices, see our Privacy Policy.

2. Your Rights Summary

• Right to know: Request details about what personal information we collect, use, disclose, and sell
• Right to delete: Request deletion of your personal information
• Right to correct: Request correction of inaccurate data
• Right to opt out of sale: We do not sell your data
• Right to opt out of targeted advertising: We do not serve targeted ads
• Right to limit use of sensitive personal information: We do not collect sensitive PI
• Right to non-discrimination: We will not discriminate against you for exercising your rights
• Right to data portability: Receive your data in a portable format

3. We Do Not Sell Your Personal Information

✓ NeuroBreath does NOT sell your personal information.
✓ We do NOT share your information for cross-context behavioral advertising.
✓ We do NOT use third-party advertising networks or tracking pixels.

Because we do not engage in these practices, the "opt-out of sale" and "opt-out of targeted advertising" rights do not apply.

4. We Do Not Collect Sensitive Personal Information

Under California law, "sensitive personal information" includes Social Security numbers, financial account information, precise geolocation, race, religion, health data, and more.

NeuroBreath does not collect sensitive personal information as defined by CCPA/CPRA.

Specifically:

• We do not collect health data or biometric data
• We do not collect Social Security numbers or financial information
• We do not collect precise geolocation
• We do not collect information about race, religion, political views, sex life, or sexual orientation

5. How to Exercise Your Rights

5.1 Submit a Request via Email

Email us at privacy@neurobreath.co.uk with:

• Subject line: "Privacy Rights Request"
• Your full name and email address
• Which right you wish to exercise (e.g., "Request to know" or "Request to delete")
• Any details to help us locate your data (approximate account creation date, device ID, etc.)

5.2 Verification

To protect your privacy, we will verify your identity before fulfilling your request. This may include:

• Confirming your email address (we'll send a verification link)
• Matching information you provide with our records

5.3 Authorized Agents

You may designate an authorized agent to submit a request on your behalf. The agent must provide:

• Proof of authorization (signed permission or power of attorney)
• Verification of your identity

6. Right to Know

You can request the following information about your personal data:

• Categories of personal information we collect
• Specific pieces of personal information we hold about you
• Categories of sources from which we collect data
• Business purposes for collecting or selling data
• Categories of third parties with whom we share data

Response timeline: We will respond within 45 days. Complex requests may extend to 90 days (we will notify you).

Format: We will provide data in a portable format (JSON or CSV).

7. Right to Delete

You can request deletion of your personal information. We will comply unless we have a legal reason to retain it (e.g., completing a transaction, security, legal compliance).

What will be deleted: Progress data, preferences, device profiles, any account data (if applicable).

Timeline: Deletion within 30 days of verification.

Local data: If your data is stored locally in your browser (guest progress), you can delete it yourself by clearing browser data.

8. Right to Correct

You can request correction of inaccurate personal information. Email us with details of what needs correcting.

Timeline: We will make corrections within 45 days.

9. Right to Data Portability

You can request your data in a structured, machine-readable format (JSON or CSV) to transfer to another service.

How to request: Email privacy@neurobreath.co.ukwith "Data Portability Request".

10. Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights. Specifically, we will not:

• Deny you goods or services
• Charge different prices or rates
• Provide a different level or quality of service
• Suggest you will receive a different price or service

You will receive the same access and quality of service whether or not you exercise your rights.

11. Response Timeline

• Initial response: Within 10 business days (confirmation of receipt)
• Full response: Within 45 days (may extend to 90 days for complex requests)
• Urgent requests: Contact us if you believe your data is at risk

12. Appeals (State-Specific)

If we deny your request, you have the right to appeal in certain states (California, Virginia, Colorado, Connecticut).

To appeal, reply to our denial email with "Appeal" in the subject line. We will review your appeal within 45 days (or as required by your state law).

13. Contact the Attorney General (If Applicable)

If you are not satisfied with our response, some state laws allow you to contact your state Attorney General:

• California: https://oag.ca.gov
• Virginia: https://www.oag.state.va.us
• Colorado: https://coag.gov
• Connecticut: https://portal.ct.gov/AG

14. Contact Us

To exercise your privacy rights, contact us at:

Email: privacy@neurobreath.co.uk
Subject line: "Privacy Rights Request"
Location: Southwark, London, United Kingdom