1. Preamble & Scope
The International Neurofeedback Center (INFC) is committed to respecting your privacy and protecting your personal data. This policy applies to our website (neuromaroc.com), our patient portal, and related applications during your sessions in our centers (Casablanca, Marrakech, Tangier, Kenitra). We process your data in strict compliance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data.
2. Data Collected
As part of your support, we collect two types of data:
A. Standard Data
First name, last name, email address, phone number, appointment history, and INFC centers visited.
B. Biometric & Physiological Data (Sensitive Data)
Raw and processed electroencephalographic (EEG) signals, captured via our hardware devices (e.g. bands or scanners like Brainbit) during dynamic brain training sessions.
3. Purposes of Processing
Your data is only used for specific and justified purposes:
- Managing your appointments, billing, and tracking your sessions.
- Analyzing your brain signals in real time during sessions to provide the neurofeedback service.
- Generating progress and cognitive monitoring reports accessible on your client portal.
- Sending information relating to your appointments or your support (via email, SMS, or WhatsApp).
Under no circumstances is this data sold to third parties or used for commercial profiling.
4. Express Consent & Legal Basis
In accordance with Law 09-08, processing sensitive data related to health and physiological signals requires your explicit, free, and informed consent. This consent is collected via a non-pre-checked opt-in system before any use of our connected services. You may withdraw your consent at any time, which will result in the suspension of the neurofeedback sessions.
5. Data Security & Encryption
To ensure the security required by Article 24 of Law 09-08, INFC implements reinforced technical and organizational security measures: SSL/TLS encryption for all data transmissions (in transit), database volume encryption at rest (AES-256), strict isolation of user access to their own data, and access control with logging (audit logs) for authorized clinical staff.
6. Retention Period
Your identification and commercial tracking data is kept for the duration of the commercial relationship plus 3 years [TO COMPLETE]. Neurofeedback session data and physiological signals are stored in a secure environment for 3 years [TO COMPLETE] from your last dynamic brain training session, before being anonymized or permanently deleted.
7. Data Sharing & Recipients
Your personal data is intended exclusively for authorized INFC professionals in our various centers and our technical service providers for the sole operation of our platform. No data is transferred outside Morocco without prior specific declaration or authorization from the CNDP.
8. User Rights
Under Law 09-08, you have the following rights regarding your personal data:
- Right of Access: Obtain confirmation that data concerning you is processed and receive a copy.
- Right of Rectification: Request update or correction of your inaccurate or incomplete data.
- Right to Object: Object to the processing of your data for legitimate reasons (excluding legal obligations).
- Right to Be Forgotten / Erasure: Request the permanent deletion of your data and session history.
To exercise these rights, you can contact us at the dedicated email address: privacy@neuromaroc.com or by mail at our registered office.
9. Processing of Sensitive Data (EEG)
In accordance with Moroccan regulations regarding health and biometric data:
Nature of signals: The EEG signals collected do not allow the identification of your thoughts, intimate emotions, or memories. They measure the overall electrical activity of the cortex in the form of frequencies (alpha, beta, theta, etc.) to guide dynamic feedback.
CNDP Authorization: This health data processing is subject to a Prior Authorization Request submitted to the CNDP (currently pending final receipt issuance).