Privacy Policy | Neux Science

Last Updated: April 18th, 2026

1. Introduction

NeuxScience® is a trademarked specialised software-as-a-service platform of Neux Ltd, designed for the computational modelling of working memory and related higher-order cognitive constructs. It enables researchers to build, simulate and empirically validate cognitive architectures, which may then be deployed as adaptive cognitive interventions or high-precision assessment tools, with integration across EEG, neuroimaging and VR-based research environments.

Neux Ltd (“the Company”, “we”, “us”, “our”) is committed to protecting and respecting your privacy in connection with your access to and use of NeuxScience®. This Privacy Policy (the “Policy”) sets out the legal basis upon which we collect, process, store, and protect personal data obtained via NeuxScience®, whether you are a researcher, clinician, institutional user, study participant, or client organisation.

This Policy should be read in conjunction with any other privacy notices provided within the NeuxScience® platform. Capitalised terms not otherwise defined herein shall have the meaning ascribed to them under applicable data protection legislation.

2. Data Controller Information

Neux Ltd is a company incorporated in England and Wales under company number 09021397, with its registered office at 86-90 Paul Street, London, EC2A 4NE, United Kingdom. The Company’s VAT number is 194 6179 68.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Company is the data controller in respect of personal data processed in connection with NeuxScience®, except where the Company processes study participant or research data on behalf of a client organisation as a data processor under a separate data processing agreement.

3. Categories of Personal Data Collected

For the purposes of this Policy, “personal data” means any information relating to an identified or identifiable natural person. The Company collects, processes, and stores the following categories of personal data via NeuxScience®.

3.1 Registration Data. Upon account creation, the Company collects the following personal data: full name (given name and surname), year of birth, gender, and email address.

3.2 Professional and Research Data. The Company may collect job title, department, research specialisation (including but not limited to cognitive neuroscience, psychology, or psychiatry), user role within the subscribing organisation, and access permission levels.

3.3 NeuxScience® Usage Data. The Company automatically collects information pertaining to user interaction with the platform, including but not limited to cognitive model builds, simulation runs, empirical validation workflows, deployment of adaptive interventions, assessment tool configurations, integration sessions with EEG, neuroimaging, or VR equipment, login frequency, features accessed, and navigation paths.

3.4 Technical Data. The Company collects IP addresses, browser type and version, device identifiers, operating system, platform information, and integration endpoint data arising from connections to EEG, neuroimaging, or VR systems.

3.5 Cognitive Performance and Research Data. The Company collects cognitive performance data, EEG recordings, neuroimaging data, VR interaction data, working memory task parameters, cognitive architecture specifications, simulation inputs and outputs, empirical validation datasets, and assessment results.

The Company does not use any personal data for marketing purposes. No marketing communications are sent to data subjects.

4. Lawful Bases for Processing

The Company processes personal data only where a lawful basis under Article 6 of the UK GDPR applies. The following lawful bases are relied upon.

4.1 Contractual Necessity. Processing is necessary for the performance of a contract with the user or the user’s organisation, including the provision of NeuxScience® SaaS services.

4.2 Legitimate Interests. Processing is necessary for the purposes of the Company’s legitimate interests, namely: securing platform access, ensuring platform reliability and scientific validity, resolving user issues, keeping users informed of essential platform updates and security notices, and enhancing the platform for research applications, except where such interests are overridden by the fundamental rights and freedoms of the data subject.

4.3 Legal Obligation. Processing is necessary for compliance with a legal obligation to which the Company is subject, including data protection laws, research ethics obligations, and applicable medical device regulations.

The Company does not rely on consent for any processing activity, as no direct marketing or optional data processing is undertaken.

5. Purposes of Processing

The Company processes personal data for the following purposes, relying on the lawful bases set out in Section 4 of this Policy.

5.1 Account Management. Registration Data (name, surname, year of birth, gender, and email address) is processed to create, manage, and authenticate user accounts.

5.2 Core SaaS Delivery. Cognitive Performance Data, EEG data, Research Data, Usage Data, and Professional Data are processed to deliver cognitive architecture modelling, simulation, empirical validation, intervention deployment, assessment tools, and EEG, neuroimaging, and VR integration.

5.3 Anonymisation for Research Analysis. Prior to any research analysis, personal data is anonymised such that only year of birth and gender are retained. Name and email address are removed from all research datasets.

5.4 Platform Maintenance and Improvement. Technical and Usage Data are processed to maintain, troubleshoot, and improve platform performance, including cognitive model accuracy and integration reliability.

5.5 User Support. Name, surname, and email address are processed to respond to research or technical support requests.

5.6 Essential Service Notifications. Email address is processed to send essential service notifications, including security alerts, maintenance notifications, and updates that materially affect the operation of NeuxScience®. No marketing or promotional communications are sent.

5.7 Analytics and Platform Enhancement. Anonymised data (year of birth and gender) together with Technical Data, Usage Data, and Cognitive Performance Data are processed to analyse usage patterns and improve user experience and modelling accuracy.

5.8 Legal Compliance. All relevant data categories are processed as necessary to comply with legal and regulatory requirements.

6. Anonymisation

For the avoidance of doubt, where the Company conducts analysis of study results, personal data is anonymised prior to such analysis. Anonymisation constitutes the irreversible removal of all direct and indirect identifiers such that the data subject is no longer identifiable. Following anonymisation, only year of birth and gender are retained for analytical purposes. Name and email address are excluded from all research datasets. Anonymised data does not constitute personal data and is not subject to the provisions of the UK GDPR.

Anonymised data is not routinely deleted or removed from research datasets. The Company retains anonymised data indefinitely for research, analytical, and platform improvement purposes. Anonymised data will only be removed when an individual submits a formal data withdrawal request concerning a specific single record. Upon receipt and verification of such a request, the Company shall delete that specific anonymised record from its research datasets.

7. Data Sharing and Disclosure

The Company does not share any personal data — specifically name and email address — with any third party.

The Company currently does not share any data, whether personal data or anonymised data, with any third parties for commercial, research, or operational purposes. All data submitted, uploaded, or generated via NeuxScience® remains within the Company’s secure systems.

Notwithstanding the foregoing, the Company may disclose personal data where required to do so by law, by court order, or by a competent regulatory authority. In such circumstances, disclosure shall be limited to the minimum data strictly required by law, and the data subject shall be notified in advance where permitted by law.

The Company does not sell, rent, or trade personal data to any third parties. The Company does not transfer name, surname, or email address to any third party for any purpose.

8. International Data Transfers

NeuxScience® currently processes and stores all personal data within the United Kingdom. The Company does not transfer personal data outside the United Kingdom or the European Economic Area.

In the event that the Company establishes international collaborations or expands its infrastructure, any international data transfer shall be subject to appropriate safeguards in accordance with Chapter V of the UK GDPR, including but not limited to the UK International Data Transfer Agreement or an adequacy decision by the Secretary of State.

9. Data Security

The Company has implemented appropriate technical and organisational security measures in accordance with Article 32 of the UK GDPR, including: encryption of data at rest and in transit; role-based access controls; multi-factor authentication options; regular security testing and vulnerability assessments; audit logging of user activity; and separate handling protocols for research participant data.

Access to personal data is restricted to authorised personnel of the Company who have a legitimate business need for such access. All such personnel are bound by duties of confidentiality.

10. Data Retention

Personal data shall be retained only for as long as is necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, tax, accounting, research ethics, or reporting requirements. The Company periodically reviews its retention periods to ensure they remain necessary for the purposes stated herein. The Company may retain data for longer periods in the event of a complaint or where there is a reasonable prospect of litigation.

Specific retention criteria are as follows.

10.1 Registration Data (Personal). Retained for the duration of the active NeuxScience® subscription plus a reasonable grace period following termination to allow for account reactivation or data export, unless the data subject requests earlier deletion.

10.2 Usage and Technical Data (Personal). Retained only as long as necessary for analytics, security, and platform improvement purposes, unless the data subject requests earlier deletion.

10.3 Cognitive Performance and EEG Data (Personal). Retained in accordance with the terms of the applicable subscription agreement or as otherwise agreed in writing, provided that such terms reflect a retention period necessary for the purposes of delivering the contracted services.

10.4 Research Participant Data (Personal). Retention governed by research ethics approvals and applicable legal requirements.

10.5 Anonymised Data. Anonymised data (comprising year of birth and gender together with cognitive performance data, EEG data, and other research outputs) is retained indefinitely for research, analytical, and platform improvement purposes. Anonymised data is not subject to routine deletion. Deletion of anonymised data occurs only when an individual submits a valid data withdrawal request concerning a specific single record. Upon such request, the Company shall delete that specific record as set out in Section 6.

Upon termination of the NeuxScience® subscription, personal data shall be deleted or anonymised in accordance with the applicable agreement, unless a longer retention period is required by law or research ethics obligations. Upon expiry of the applicable retention period, personal data shall be securely deleted or anonymised in accordance with this Policy.

11. Data Subject Rights

Data subjects have the following rights under the UK GDPR, subject to certain conditions and exemptions.

11.1 Right of Access. The right to obtain confirmation as to whether personal data concerning the data subject is being processed, and to request access to such data.

11.2 Right to Rectification. The right to require the Company to correct inaccurate or incomplete personal data.

11.3 Right to Erasure (Right to be Forgotten). The right to require the Company to delete personal data, subject to research retention obligations.

11.4 Right to Restriction of Processing. The right to require the Company to restrict processing in specified circumstances.

11.5 Right to Data Portability. The right to receive personal data in a structured, commonly used, machine-readable format and to transmit such data to another controller.

11.6 Right to Object. The right to object to processing based on legitimate interests.

In addition, data subjects have the right to submit a formal data withdrawal request in relation to a specific single anonymised record, as set out in Sections 6 and 10.5 above.

To exercise any of the foregoing rights, data subjects should contact the Company using the details provided in Section 12. The Company may require verification of identity before processing such requests.

12. Cookies and Tracking Technologies

NeuxScience® uses essential cookies for authentication, session management, and security. The Company may also use analytics cookies to improve platform performance. Cookie preferences may be managed within the NeuxScience® dashboard or via browser settings. Further details are set out in the Company’s separate Cookie Policy.

13. Contact Information and Complaints

All enquiries concerning this Policy or requests to exercise data subject rights should be directed to:

By post: Data Protection Enquiries, Neux Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

By email: dorota@neuxscience.com (reference “NeuxScience® Privacy” in the subject line)

Data subjects have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, at www.ico.org.uk. The Company requests that data subjects contact the Company in the first instance to allow for resolution of any concerns.

14. Amendments to This Policy

The Company reserves the right to update this Policy from time to time. The updated version shall be indicated by an updated “Last Updated” date at the top of this Policy. Material changes shall be notified to data subjects via the NeuxScience® platform or by email. Continued use of NeuxScience® following such notification shall constitute acceptance of the amended terms.