IDUN Insights Privacy Policy

IDUN Insights, the Cognitive Intelligence Platform (CIP), is provided by IDUN Technologies AG, Vega-Strasse 3, 8152 Glattpark (Opfikon), Switzerland. We are responsible for the personal information described in this policy. For privacy questions or requests, contact dpo@iduntechnologies.com.

1. About Insights

Insights provides Cognitive Engagement, Relaxation and Brain Battery wellness estimates relative to your baseline, not medical assessments. It is optional; IDUN Guardian earbuds work as conventional audio devices without it.

2. Your information and choices

With your explicit consent, Guardian processes brain and movement signals, contact-quality information and voluntary jaw-control input. Raw signals are processed on the earbuds and deleted after feature extraction or command detection. Raw EEG is not uploaded or stored for core Insights.

Derived features, insights, calibration statistics and activity context are stored on your phone and in our cloud services to provide your history and personalised experience. Check-ins and external-context integrations are optional.

We also use account details, device identifiers, consent records, subscription and payment information, and support communications to operate and support the service.

Product improvement or classifier development using brain-derived information requires separate consent. Optional raw EEG collection has its own purpose, access and retention information before you opt in.

3. Optional calendar connections

If you connect Google Calendar or Microsoft Outlook, we read event titles, identifiers, dates, start and end times, all-day status and event status to show activities alongside your insights. These connections are read-only. We do not request event descriptions, locations, attendees or attachments.

With your consent, relevant event titles and timing are stored with your IDUN account to provide calendar context.

You can stop calendar access in Settings or through Google or Microsoft. Section 6 explains deletion of stored information.

We do not use information obtained through Google Workspace APIs, including derived calendar context, to develop, improve or train general-purpose or other non-personalised AI or machine-learning models.

4. Brain Agent

If you use the Brain Agent, OpenAI processes your messages, relevant cognitive insights and activity context to generate personalised replies. Voice conversations also involve audio and transcripts. With your external-context consent, calendar context supplied automatically includes meeting timing and duration, without event titles.

We do not use CIP personal information to train brain foundation models.

5. Security and service providers

We protect information with encrypted Bluetooth transmission, TLS connections, encrypted AWS storage and access controls. Primary cloud hosting is in AWS Frankfurt, Germany, with authorised IDUN access from Switzerland.

AWS and Automat.it support our cloud infrastructure. Stripe handles payments and HubSpot supports customer relationships; they are not intended to receive brain-derived information. We use applicable adequacy decisions or appropriate safeguards for international transfers, including the OpenAI processing described above. Details are available on request.

We do not sell neurodata or share it for third-party advertising or commercial profiling. Insights is not used for workplace monitoring, medical diagnosis, inference of protected characteristics, or decisions determining access to employment, credit, insurance or other services.

6. Retention and deletion

Core features, insights, calibration statistics and consent-dependent context, including calendar information, are deleted when you withdraw the relevant consent or delete your account. Core records and account information are also deleted after 12 months of account inactivity; shorter periods may apply when information is no longer needed.

Consent-dependent app data is deleted following withdrawal or account deletion, subject to your device's technical operation. Separately consented raw EEG recordings are deleted after withdrawal or the disclosed retention period. Limited consent, payment, tax and transaction records may be retained where needed for legal or accountability obligations. You can request deletion of your information or account at dpo@iduntechnologies.com.

7. Consent and your rights

Brain-derived processing relies on consent. We treat raw EEG, user-linked EEG-derived features, cognitive insights, personal calibration statistics and connected health data as special category personal data and require explicit consent for their enabled purposes. External-context and product-improvement purposes are separate choices. Account and payment processing relies on contract. Proportionate security, administration and support may rely on legitimate interests where they do not require brain-derived special category data.

Review or withdraw consent in Settings → Privacy & Consent. Withdrawal stops the affected processing; earlier lawful processing remains lawful. Withdrawing core consent stops Insights; optional withdrawal leaves unrelated features available.

You may have rights to access, correct, delete, export or restrict information, and object to processing based on legitimate interests. Contact dpo@iduntechnologies.com; we normally respond within one month. You can complain to the Swiss FDPIC, UK ICO or your local authority.

8. Updates

We may update this policy as the service changes. We will provide notice where appropriate and obtain fresh consent before materially expanding consent-based processing where required.