Privacy Policy

Handran India Private Limited ("Handran," "we," "us," "our") builds non-invasive neural interfaces with privacy at their architectural core. This Privacy Policy describes how we collect, use, protect, and share information when you use our products, software, services, and related applications.

This Privacy Policy applies to all personal information and neural data collected through:

• NH1 Pro 8ch, NH1 Max 16ch, and NH1 Max 32ch devices
• Handran App (all subscription tiers)
• Neurocare Enterprise Pro
• Our website (handran.in)
• Associated mobile applications and web services

1. Our Privacy-First Architecture

At Handran, privacy is not an afterthought—it is foundational to our product design. Unlike competitors requiring cloud processing, our Mentis custom neural processing chip enables on-device processing by default.

On-Device Processing (Default)

• All neural signal acquisition and processing occurs locally on your NH1 device
• Mentis AI inference runs entirely on-device
• NeuraTxT (EEG to Text) processes through on-device LLM inference
• No internet connection required for core functionality
• Your neural data never leaves your device unless you explicitly opt in

Cloud Services (Optional, with Explicit Consent)

• Cloud backup of neural data (disabled by default)
• Cross-device synchronization
• Advanced analytics and data visualization
• Firmware and software updates via cloud
• You can disable cloud connectivity at any time; on-device functionality continues uninterrupted

Data Portability & No Vendor Lock-in

• Export your neural data anytime in open formats (EDF, BDF, CSV)
• No fees, no penalties, no waiting periods
• Your data works with other tools and platforms
• Handran cannot prevent or restrict your data portability

2. Information We Collect

2.1 Neural Data (Special Category Personal Data)

Neural data comprises EEG signals, brain-computer interface signals, neural patterns, frequency bands, and derived metrics obtained from Handran devices.

• Collected only during active device use (when you initiate a session)
• Not collected passively
• Stored locally on the device's secure storage
• Processed on-device by the Mentis chip
• Transmitted to Handran servers only if you explicitly enable cloud backup
• You own 100% of your neural data

Retention

• On-device: Retained until you delete it
• Cloud backup: Retained until you request deletion; deleted within 30 days
• Not retained after account closure (except backups you explicitly stored)

2.2 Biometric Data

Certain sensor data may qualify as biometric data under applicable laws (GDPR, CCPA, Indian DPDP Act). Same protections as neural data apply—on-device by default, cloud processing only with explicit consent.

2.3 Account & Profile Data

• Full name, email address, account credentials
• Optional: Date of birth, location, profession
• Account settings and subscription/billing information

Retention: Retained while your account is active; deleted within 90 days of account closure.

2.4 Device & Usage Data

• Device model and firmware version
• Session length and frequency (anonymized)
• Feature usage statistics (aggregated, no neural content)
• Crash reports and error logs
• Device health metrics

Opt-out: You may disable usage analytics via device settings. Core functionality continues without restriction.

2.5 Payment Data

Payment data is processed by PCI DSS-compliant third-party processors (Stripe, Razorpay). Handran does NOT store full credit card numbers. Transaction records retained for 7 years for tax compliance.

2.6 Support & Communication Data

Customer support inquiries, email communications, chat logs, and bug reports. Retained for 2 years after resolution.

3. How We Use Your Information

1. Provide Services: Deliver core functionality of all devices and software
2. Process Transactions: Billing, subscription management, payments
3. Account Management: Authentication, security, password recovery
4. Technical Support: Respond to requests, troubleshoot, documentation
5. Security & Fraud Prevention: Monitor for unauthorized access and fraud
6. Product Improvement: Anonymized, aggregated usage analysis
7. Research & Development: With explicit opt-in consent only
8. Legal Compliance: Fulfill legal obligations, respond to lawful requests
9. Communication: Account notifications, security updates (with opt-out)
10. Aggregate Analytics: Anonymized reports with no individual identification

We DO NOT use your information for:

• Selling to third-party advertisers
• Behavioral targeting or profiling
• Discrimination or algorithmic decision-making
• Any purpose beyond those listed above without your consent

4. Neural Data Rights & Commitments

4.1 Ownership

You own 100% of your neural data. Handran claims no ownership rights, intellectual property interest, or usage rights beyond those necessary to provide the service you've requested.

4.2 Portability

You may export your neural data at any time in EDF, BDF, or CSV formats. No fees, no waiting periods, no restrictions. Export is instantaneous for on-device data.

4.3 Deletion

• Cloud-stored data deleted within 30 days of request
• On-device deletion is immediate upon confirmation
• Handran retains no copies after deletion except as required by law

4.4 Processing Control

Cloud backup is disabled by default. You must explicitly enable it. You may revoke consent and disable cloud services at any time. On-device features continue without cloud connectivity.

4.5 No Vendor Lock-in

Open data formats (EDF, BDF, CSV) ensure your data is interoperable. You may transfer your data to competing platforms at any time.

5. On-Device vs. Cloud Processing

On-Device Processing (Default)

Cloud Processing (Optional, Consent Required)

6. Data Sharing & Third Parties

When We Share Data

Service Providers (Data Processors)

• Payment processors (Stripe, Razorpay)
• Cloud infrastructure providers (AWS, Google Cloud)
• Email service providers
• Analytics platforms (aggregate only, no neural data)
• Customer support platforms (Zendesk)

All service providers execute Data Processing Agreements restricting their use of data.

Legal & Regulatory Compliance

When required by valid legal process (subpoena, court order, warrant). Handran will provide notice unless prohibited by law and will challenge overbroad requests.

Business Transfers

In the event of merger, acquisition, or sale—data transfers only to successor entities with equivalent or stronger privacy protections.

Anonymized Research (Explicit Opt-In)

Data anonymized such that individuals cannot be re-identified. Separate opt-in consent required. Users may withdraw at any time.

What We Do NOT Share

Handran NEVER:

• Sells neural or biometric data to any third party
• Shares neural data with advertisers, marketing firms, or data brokers
• Shares data with insurance companies or employers
• Combines data from other sources for profiling
• Uses neural data for discriminatory decision-making

7. Data Security

Encryption

• At Rest: AES-256-GCM, keys stored separately from data
• In Transit: TLS 1.3, certificate pinning, no unencrypted storage

Access Controls

• Role-based access control (RBAC)
• Multi-factor authentication (MFA) for all employee accounts
• Audit logging of all data access
• Principle of least privilege

Compliance & Audits

• SOC 2 Type II audit (annual)
• ISO 27001 certification
• OWASP Top 10 vulnerability assessments
• Annual penetration testing

Vulnerability Disclosure

Report vulnerabilities to security@handran.in. Acknowledgment within 48 hours. No legal action against good-faith researchers.

8. Data Retention

9. International Data Transfers

Handran operates globally. If you are located outside India, your data may be transferred to and processed in India and other countries.

EU/EEA Users

Transfers protected by Standard Contractual Clauses (SCCs) with supplementary technical and organizational measures.

California Users

CCPA rights fully respected. CCPA restrictions apply regardless of transfer location.

Indian Users

Compliance with India's Digital Personal Data Protection Act, 2023.

You may object to international data transfers by contacting privacy@handran.in.

10. Children's Privacy

Handran products are not intended for children under 16. We do not knowingly collect personal information from children under 16. If a parent or guardian discovers we have collected data without proper consent, we will delete it promptly.

11. Your Privacy Rights

EU/EEA Users (GDPR)

• Access: Request a copy of your data
• Rectification: Correct inaccurate information
• Erasure: Request deletion (within 30 days)
• Restrict Processing: Limit to storage only
• Data Portability: Export in EDF/BDF/CSV
• Object: Object to processing for legitimate interest
• Withdraw Consent: At any time
• Lodge Complaint: With your national data protection authority

California Users (CCPA/CPRA)

• Right to Know, Delete, Correct, and Opt-Out
• Right to Limit Use of sensitive personal information
• Right to Non-Discrimination for exercising your rights

Indian Users (DPDP Act)

• Rights to Access, Correction, Erasure, and Grievance Redressal

Exercise your rights at privacy@handran.in or contact our Data Protection Officer at dpo@handran.in.

12. Cookies & Tracking

• Session Cookies: Expire when you close your browser
• Persistent Cookies: Remain for up to 12 months
• Third-Party Cookies: Analytics only, no personal tracking

You may refuse cookies via browser settings. Opt-out of analytics via account settings or browser extensions.

13. Third-Party Links

Our website may contain links to third-party websites. This Privacy Policy does not apply to third-party sites. Review their privacy policies before sharing information.

14. Changes to This Privacy Policy

Material Changes: 30 days advance notice via email, in-app notification, and website banner.

Continued use after notice constitutes acceptance. If you do not agree, you may terminate your account and request data deletion.

15. Contact Us

Response Times

• Privacy inquiries: 7 business days
• Data access requests: 30 days
• Data deletion requests: 30 days
• Complaints: 30 days with interim response at 7 days

If you are unsatisfied with Handran's response, you may lodge a complaint with your national data protection authority.