Join Now

Privacy Policy

Data Privacy Policy

The “NeuroScores” platform respects users’ privacy and is committed to handling their personal data responsibly and transparently. This policy explains the types of data we may collect, the purposes for which we collect and use it, how we store, protect, share, retain, and delete it, and the rights users have regarding their data when using our website and services.

1. Data collected

The platform may collect the following data based on the services the user uses and the information the user provides or agrees to share:

  • Metadata: The name, email address, account ID, and information provided by the user when creating an account or updating their profile.
  • Google login credentials: We may receive your name, email address, Google account ID, and profile picture (if available and required), in accordance with the permissions requested by the app and agreed to by the user.
  • Performance Data and Tests: User responses, test results, response times, mental exercise history, scores, metrics, and reports generated from the use of the services.
  • Transaction and Payment Information: Order information, payment details, purchase history, and account balance, when these services are available. Payment data is processed through the payment service providers we use, and we do not store full credit card details on our servers, depending on the payment method used.
  • Technical Specifications: This may include your Internet Protocol (IP) address, browser and device type, operating system, error logs, and data regarding your connection and interaction with the website, to the extent necessary to operate, improve, and protect the services.
  • Contact Information: Information that users submit through contact forms, when contacting technical support, or when submitting inquiries and complaints.

The type of data collected depends on the feature used and the permissions granted by the user. The mention of a particular type of data in this policy does not imply that the platform collects it from all users or in all cases.

2. Purposes of Data Collection and Use

Depending on the nature of the service, we use the data for the following purposes:

  • Creating and managing user accounts, as well as logging in and verifying user identity.
  • Link the user's account to a Google account when the user chooses to sign in this way.
  • Provide cognitive tests, reports, results, and related indicators.
  • Save the user's progress and results, and provide features associated with their account.
  • Process orders, payments, and purchases, and manage account balances when available.
  • Improving website performance and service quality, and resolving errors and technical issues.
  • The use of analytical tools or artificial intelligence technologies, when enabled, is limited to the stated purposes and the data necessary for the service.
  • Protecting accounts and systems, and detecting unauthorized use, fraud, and malicious activities.
  • Communicate with the user regarding the account, transactions, technical support, and necessary updates.
  • Compliance with applicable legal and regulatory obligations.

3. Sign in with Google

The NeuroScores platform allows users to sign in or create an account using Google to facilitate account access and management. Users choose this method voluntarily, and the data we receive is subject to the permissions requested by the app and agreed to by the user.

Data accessed:
The app may receive your name, email address, Google Account ID, and profile picture, if available and required by the authentication scopes used. Access is limited to the data permitted by the actual permissions requested by the app. Using Google Sign-In does not mean that the app automatically accesses your Gmail content, Google Drive files, or data from other Google services.

How to Use Google Data:
We use the data we receive for authentication purposes, to create an account or link it to an existing account, to verify the user’s identity, to log in, to manage the account, and to provide related features. We do not use Google data for purposes unrelated to the stated functions or in a manner that conflicts with the granted permissions or Google’s policies.

Google Data Storage:
Basic data necessary for account operation, such as the user ID, email address, and name, may be stored in the platform’s database. This data is managed in accordance with approved security controls and retained for the period necessary to provide the service and fulfill the purposes outlined in this policy.

If the app uses OAuth access tokens or refresh tokens to access Google services, they are protected and stored securely when needed, and are not retained once the legitimate need for them has ended. This text is not intended to imply that the platform stores these tokens if the login mechanism used does not require it.

Sharing Google Data:
We do not sell, rent, or use Google personal data for targeted advertising. The minimum necessary data may be processed by hosting or technical service providers when necessary to operate the features requested by the user, or when there is a legal obligation to do so. Any such processing or sharing is subject to the restrictions applicable to Google data, including the Google API User Data Policy and limited use requirements, where applicable.

We do not permit the use of Google data or its transfer to third parties for the purposes of selling data, targeted advertising, or other unauthorized purposes. Any human access to this data is limited to cases permitted by our systems and policies, such as addressing a security issue or complying with a legal obligation, subject to restrictions on the type of data and the permissions used.

Google Data Protection:
We implement appropriate measures to protect user data from unauthorized access, loss, alteration, or disclosure. Depending on the technical architecture used, these measures include restricting access privileges, securing communications, protecting credentials, and managing access to systems and databases.

Revoking Access and Deleting Data:
Users can manage access to apps linked to their account through their Google Account settings. They can also request that their account and associated personal data be deleted from the NeuroScores platform via the page Contact us. The request is reviewed, the requester’s identity is verified, and the request is processed in accordance with regulatory requirements, taking into account any data that must be retained for legal reasons.

We are committed to ensuring that the data received from Google API services is used only for the purposes explained to the user, in accordance with the Google API User Data Policy and the Limited Use requirements, where applicable.

4. The Legal Basis for Data Processing
Data is processed to the extent necessary to provide services and fulfill user requests, or based on the user’s consent when required, or to pursue legitimate interests such as protecting the website and improving its performance, or to comply with legal and regulatory obligations. We respect users’ rights and comply with the requirements of applicable regulations in the Kingdom of Saudi Arabia, including the Personal Data Protection Act and its related regulations, where applicable.

5. Cookies and Similar Technologies
The website may use cookies and similar technologies to manage login sessions, remember preferences, enhance security, improve website performance, and measure usage when analytics tools are available. Some third-party services may use their own cookies depending on the tools enabled on the website.

Users can manage cookies through their browser settings and any consent options available on the website, if applicable. Disabling certain essential cookies may affect the login process or the website's functionality.

6. Sharing Data with Third Parties

The platform does not sell or rent users' personal data. Certain data may be processed or shared, to the extent necessary, with the following categories of recipients when using the associated services:

  • Hosting Providers and Technical Infrastructure: To operate the website and to store, maintain, and protect data.
  • Payment Service Providers: To process payments, orders, and transactions as they come in.
  • Authentication Providers: To provide a login and identity verification feature, in accordance with the necessary data and permissions.
  • Providers of analytics or technical tools: When these services are activated, and within the limits of the stated purposes and the data necessary for their operation.
  • Competent Authorities: When disclosure is required by regulations or by an order issued by a competent authority.

We are committed to limiting data sharing to what is necessary to provide the service, protect our systems, or comply with regulatory obligations. Data processing by third parties is subject to their respective terms and policies, subject to Google’s data restrictions when Google data is included in the processed data.

7. Data Processing Using Artificial Intelligence
The platform may use artificial intelligence technologies or automated systems to perform certain functions, such as analyzing test results, generating reports, or improving services, if such functions are available. The use of data is limited to what is necessary to provide the relevant function, subject to the terms of service providers, privacy policies, and applicable regulatory restrictions.

We do not use Google data received from Google APIs to train general-purpose AI models or for purposes unrelated to the stated functionality if such use is prohibited by Google’s policies or applicable terms of service. Users should not enter sensitive personal information in fields that are not required by the service.

The results of automated tests or analyses do not, on their own, constitute a medical or psychological diagnosis or a definitive assessment of the user’s abilities, unless otherwise clearly stated in the description of a specific service.

8. Data Protection and Information Security
We implement appropriate technical and organizational measures to protect data from unauthorized access, loss, alteration, or unlawful disclosure. These measures may include encrypting communications using HTTPS/SSL, restricting access privileges, protecting login credentials, updating systems, and securing databases and backups, depending on the technical infrastructure used.

Authentication data and access tokens are protected during use in a manner commensurate with their sensitivity level; OAuth tokens or credentials should not be transmitted insecurely. Despite the measures taken, the security of information cannot be absolutely guaranteed when it is transmitted or stored electronically.

We advise users to keep their login information confidential and not to share it with others, and to notify us if they suspect unauthorized use of their account.

9. Data Retention and Deletion
We retain personal data for as long as necessary to fulfill the purposes described in this policy, provide services, manage accounts and transactions, comply with legal obligations, resolve disputes, and protect rights.

The retention period varies depending on the type of data and the purpose for which it is used. For example, we may retain account data for as long as the account is active or as long as it is necessary to provide services, and we may retain transaction records for the period necessary to comply with regulatory or accounting obligations. These examples are not fixed time periods unless specified by the platform in its actual procedures.

Once the data is no longer needed, we strive to delete it, destroy it, or anonymize it in an appropriate manner, unless its retention is required or permitted by law. Backup copies may be retained for a limited period in accordance with the approved technical retention cycle.

10. Request to Delete the Account and Data
Users can request the deletion of their account and the personal data associated with it via the page Contact us. Please specify that the request concerns the deletion of the account and personal data, and provide the information necessary to verify ownership of the account.

After the request is verified, it is reviewed and processed in accordance with approved procedures and regulatory requirements. Deletion includes data for which there is no longer a legitimate need to retain it, including Google-linked login data, to the extent that the platform retains such data. Certain records may continue to be retained when required by law or necessary to resolve disputes or protect rights.

Revoking access from a Google account does not necessarily result in the deletion of the account or the data stored on the NeuroScores platform; therefore, a separate deletion request must be submitted to the platform if the user wishes to have their data deleted from it.

11. Transfer of Data Outside the Kingdom
Hosting, payment, authentication, or analytics services may require the processing or storage of certain data outside the Kingdom of Saudi Arabia, depending on the locations of the service providers and the technical infrastructure used. When requirements for the transfer of personal data outside the Kingdom apply, the relevant regulatory controls and requirements are observed.

12. Data on Children and Minors
Services are provided in accordance with the terms of use and age categories specified for each service. We do not intend to collect children’s personal data without obtaining the consents or following the procedures required by applicable regulations. If we become aware that a child’s data has been collected inappropriately, please contact us so that we can review the situation and take appropriate action in accordance with regulatory requirements.

13. User Rights

In accordance with applicable regulations and subject to the conditions under which each right applies, the user may request the following:

  • To know what personal data is being processed and the purposes for which it is used.
  • Access their personal data and obtain a copy of it in accordance with regulatory requirements.
  • Request that inaccurate information be corrected, or that missing information be added or updated.
  • Request to delete personal data when the legal requirements for doing so are met.
  • Withdrawal of consent to processing when the processing is based on consent, without affecting the lawfulness of the processing prior to the withdrawal.
  • Submit an inquiry or complaint regarding the processing of personal data.

Applications can be submitted via the page Contact us. We may request appropriate information to verify the applicant’s identity and protect their data. Requests are processed in accordance with regulatory requirements, taking into account any legal obligations or other legitimate rights.

14. Third-Party Links and Services
This website may contain links to third-party websites or services. The platform has no control over the privacy practices, content, or security measures of those third parties. Therefore, we recommend that you review their privacy policies before providing them with any personal information.

15. Letters and Notices
We may send necessary messages regarding your account, transactions, security, or the operation of our services. Marketing or promotional messages, when sent, are subject to relevant consents and regulatory requirements, and you may opt out of them by using the available opt-out method or by contacting us. Unsubscribing from marketing messages does not affect messages that are necessary for account operation or service provision.

16. Changes to the Privacy Policy
We may update this policy to reflect changes in our services, technologies, or regulatory requirements. The updated version will be posted on this page. When we make a material change to how we access, use, or share user data, we will take the necessary steps to notify the user and obtain the required consents before implementing the new use, whenever necessary.

17. Communication and Inquiries Regarding Privacy
If you have questions, requests, or complaints regarding data privacy, signing in with Google, or requesting account deletion, you can contact us via the page Contact us, please specify the nature of your request so that we can review it and respond.

18. Acceptance of the Privacy Policy
By using the website and its services, users are given the opportunity to review this policy and understand how their data is processed. This paragraph does not serve as a substitute for obtaining explicit consent when required by law, nor does it limit the rights granted to the user under applicable laws.

Google API User Data Policy: The use of data received from Google APIs is subject to the Google API User Data Policy, including the "Limited Use" requirements where applicable. For more information, please see Google API User Data Policy.