Consumer Health Data Privacy Policy

NeuroYogaNYC LLC | Neuroscience and Yoga

Last updated: September 18, 2026

1. Scope and contact

This policy explains how NeuroYogaNYC LLC, operating as Neuroscience and Yoga and NeuroYogaNYC (“we,” “us,” or “our”), handles consumer health data subject to Washington’s My Health My Data Act. It applies to covered Washington residents and people whose consumer health data is collected in Washington, subject to the Act’s scope and exclusions.

Email: jonathan@neuroyoganyc.com

Mailing address: NeuroYogaNYC LLC, 418 Broadway, Suite N, Albany, NY 12207, United States.

Consumer health data includes information linked or reasonably linkable to a person that identifies their physical or mental health status, including relevant inferences or information showing that they are seeking a health-related service. Replacing names with subject numbers does not make linkable information anonymous.

This notice covers relevant information associated with our health-related programs, including the Headache Relief Blueprint, and covered evaluation or research activities. It is not the privacy notice of a separate medical practice. Qualifying research information may be excluded from the Act; an exclusion applies only when its legal conditions are met. Study-specific information, consent and applicable law continue to govern excluded research records.

2. Categories, sources and purposes

Identifying and linkage information: Names, email addresses and subject numbers associated with health responses. We use these to connect relevant records, administer the disclosed activity, communicate with participants and respond to requests.

Health responses: Diagnoses, medications, questionnaire answers and scores, and relevant health information supplied in a program or study. Purposes include the disclosed evaluation, research or requested program activity, analysis of outcomes, and appropriate follow-up.

Derived information: Scores, changes over time or other findings derived from responses for the disclosed evaluation or research. These are not used to create health-condition advertising profiles.

Related participation and communications: Program enrollment, attendance, purchases, requests and correspondence to the extent these records reveal consumer health information. We use them to deliver and administer the requested service, manage access or payment, and address the participant’s request. Registering for professional education does not automatically establish that someone has the condition being discussed.

Sources are information you provide, your relevant interactions and participation, the systems used to deliver the activity, and analysis of those records. Study documents identify any additional authorized research sources. We do not buy consumer health data from data brokers for advertising. A specific activity does not necessarily collect every category listed here.

3. Research storage, coded exports and consent

Research-response databases are maintained in Qualtrics. Research exports replace direct identifiers with subject numbers. Coded records remain protected personal information while a person can reasonably be reidentified. Research is kept separate from marketing systems and conducted under applicable institutional review board approval and study-specific documents.

For covered consumer health data, collection and use require the applicable prior consent or must be necessary to provide a product or service you requested, as permitted by law. When sharing requires consent, sharing consent is separate from collection consent. Agreement to general website terms or continued browsing is not health-data consent.

You may withdraw consent to future collection or sharing by contacting us. We will explain when this prevents continuation of an activity that needs that information. Declining optional research or an unrelated disclosure does not prevent an unrelated service. New categories or new purposes requiring consent are disclosed and authorized before they are introduced.

4. Data disclosed and recipient categories

Survey and storage processors: Qualtrics processes identifying information, responses and associated records in the research-response workflow. Other contracted storage or analysis processors may handle authorized coded exports where permitted by the relevant activity. Processing is limited to the disclosed task and applicable binding instructions; merely calling a recipient a provider does not create a legal exemption.

Research and oversight recipients: Authorized research personnel, the collaborating researchers or institutions identified in study documents, and the relevant institutional review board may receive the information permitted for their role. Exported research datasets use subject numbers instead of direct identifiers. Access to the identifiable source database is restricted to authorized people who need it. Study permission, not ordinary event registration, determines research disclosures.

Transaction and delivery providers: Relevant names, contact details, order information and program participation records may be processed by the providers involved in the requested service, such as HeySummit, ThriveCart, Stripe, PayPal, Zoom, Vimeo or Google Workspace. A program title or enrollment record can itself reveal health information. Diagnoses, medications and questionnaire responses are not supplied to a payment processor merely to take payment.

Specifically authorized recipients: We may disclose the particular information to a person or organization you expressly authorize, under the applicable legal conditions. An identifiable health story, case example or testimonial requires specific permission for the audience and use. General event-recording permission does not authorize publication of private research or intake records.

Legally permitted recipients: A disclosure for a legal obligation, security matter or business transfer is made only to the extent permitted by applicable law. This is not a general exception to health-data consent requirements.

We do not share covered consumer health data with corporate affiliates. For a rights request, we identify the third parties and affiliates to whom your covered data was disclosed as required by the Act.

5. Advertising, AI and publication restrictions

We do not sell or offer to sell consumer health data. We do not use covered consumer health data for behavioral advertising, customer-list matching or advertising conversion reporting. Research diagnoses, medications and questionnaire information are not used to tag people by health condition in Kit, Google or Meta. We do not use health-facility geofencing to identify, track or advertise to people seeking care.

Direct identifying information is removed before participant-related material is submitted to AI-assisted tools. Any remaining coded or otherwise linkable health information is still protected and may be processed only under the applicable permissions, study requirements and provider arrangements. Removing a name does not itself authorize unrestricted disclosure to an AI service.

Public findings use aggregate or appropriately de-identified information unless a separate, specific authorization permits an identifiable publication. Where information is represented as de-identified under applicable law, we take reasonable measures to prevent identification, do not attempt to reidentify it, and require the corresponding commitments from recipients. This is distinct from a coded dataset whose authorized linkage remains available.

6. Security and retention

Access is limited to authorized people and providers who need information for its disclosed and permitted purpose. We use reasonable administrative, technical and physical safeguards appropriate to the information. No system can guarantee absolute security.

Retention depends on the purpose, program or study, applicable permissions and legal obligations. There is no single retention period for every record. Research retention follows the relevant study arrangements. We do not claim that all research or business records are exempt from deletion. A valid statutory deletion request takes precedence over a general preference to retain records, subject to an actually applicable legal exclusion.

7. Your rights and requests

Where the Act applies, you may confirm whether we collect, share or sell your consumer health data; access it; obtain the required list of third parties and affiliates that received it and a means of contacting them; withdraw consent to collection or sharing; and request deletion.

Email jonathan@neuroyoganyc.com and identify the relevant account or activity. You do not need to create a new account or initially send detailed medical records. We use proportionate verification and request only information reasonably needed to authenticate the request and locate the records.

We respond without undue delay and within 45 days after receipt. A legally permitted extension may add up to 45 days when reasonably necessary; we explain it within the initial period. Verification does not automatically restart the response clock. Required information is provided free up to twice annually. Fees or refusal for manifestly unfounded, excessive or repetitive requests are used only where permitted and with an explanation.

For a valid deletion request, we delete covered records and notify the affiliates, processors, contractors and other third parties that received the information so they can honor the request. Where permitted, deletion from archives or backups may be delayed for no more than six months after authentication. Any applicable exclusion is explained.

8. Appeals and complaints

To appeal a refusal, reply to our decision or email jonathan@neuroyoganyc.com stating that you wish to appeal the health-data decision. No special form or new account is required. We provide a written explanation of the appeal outcome within 45 days after receipt.

If the appeal is denied, we provide a way to contact the Washington State Attorney General about a complaint. You may also use the Attorney General’s consumer-complaint process directly. We do not unlawfully discriminate against you for exercising these rights.

9. Changes

We date updates to this notice. Before collecting, using or sharing additional categories or using covered information for an additional purpose requiring consent, we provide the required disclosure and obtain the required affirmative consent. Posting an updated policy does not itself grant that consent or retrospectively authorize a past disclosure.