Backed by Decades of Scientific Research

Effective Date: October 18, 2024

Cambridge Brain Sciences Inc., also operating as Creyos, and its subsidiaries and affiliates (collectively, “Creyos,” “we,” “us,” or “our”) may collect personal information in the course of your access and use of our websites that link to this Policy (“Sites”) and the web-based platform we make available through our Sites (“Platform”). The Platform and the Sites are collectively, the “Services.” This Privacy Policy (“Policy”) describes the personal information collected by or on our behalf when you access and use our Services and describes how the personal information we collect is used and disclosed. If you have questions or concerns about this Policy, please contact us at the coordinates set out at the end of this Policy. 

This Policy applies to Personal Information Creyos collects about you only in those instances when Creyos determines the purposes and means of processing your Personal Information, including when you are a visitor of our Sites. This policy does not apply to Personal Information which we may process on behalf of our customers in the context of providing our services to them. Our customer’s collection and use of your Personal Information is subject to their posted privacy notices and our collection and use of Personal Information, when collected and used on behalf of our customers, is governed by our contracts with such customers. IN CERTAIN INSTANCES, YOU MAY BE ACCESSING SERVICES AT THE REQUEST OF YOUR HEALTH CARE PROVIDER AND YOU MAY PROVIDE HEALTH OR MEDICAL INFORMATION THAT IS "PROTECTED HEALTH INFORMATION" ("PHI") AS DEFINED BY THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996, AS AMENDED, AND ITS RELATED REGULATIONS (COLLECTIVELY, "HIPAA"). OUR CUSTOMER’S COLLECTION AND USE OF YOUR PHI IS SUBJECT TO OUR CUSTOMERS’S HIPAA NOTICE OF PRIVACY PRACTICES OR OTHER POSTED PRIVACY NOTICES AND OUR COLLECTION AND USE OF PHI IS GOVERNED BY THE CONTRACTS CREYOS EXECUTES WITH ITS CUSTOMERS (I.E., YOUR HEALTH CARE PROVIDER), AND NOT THIS PRIVACY POLICY. IF YOU HAVE ANY QUESTIONS, PLEASE CONTACT US AS SET FORTH BELOW OR REFER TO YOUR HEALTH CARE PROVIDER FOR FURTHER INFORMATION. 

We may modify this Policy at any time. All changes will be effective immediately upon posting to the Services. Material changes will be conspicuously posted on the Services or otherwise communicated to you. 

If you are a resident of Canada, please see Section 10 below for additional privacy disclosures that may apply to you.

We may collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you (“Personal Information”) when you use our Services or otherwise interact with us. The Personal Information we collect falls into three categories: (a) information you provide to us; (b) information we collect through automated methods when you use our Services; and (c) information we collect from other sources. 

You can visit the Services without submitting Personal Information. However, Personal Information is required to use certain features of the Services, for example, to receive or request data from us through the Services. In such circumstances, we may be unable to provide you with our services unless you provide your Personal Information. 

Information You Provide to Us

We collect Personal Information that you provide directly to us. If you elect to provide data that personally identifies you, such as your contact information and other similar information, we will collect, use, and share such Personal Information pursuant to this Policy and applicable law. This may occur in the following ways:  

Accounts. To access and use the Platform, you may need to register for a Creyos account. During the registration process, you may be asked to provide us with information such as your full name, email address, gender, city or town, education level and occupation. You may also be asked to choose a username, password, and security questions. In some instances, your health care provider will create or obtain an account on your behalf by providing your email and/or a unique Account ID to Creyos.

Contact Us. If you reach out to contact us, we may collect your name, email address, phone number, and any other information that you choose to provide us as part of that communication. 

Mailing Lists. Our Services allows you to sign up for our mailing lists. To sign up for our email lists, you must submit your email address. 

Applying to Work with Creyos. If you submit a job application through the Services, we will collect your resume and all other materials and information that you provide in the course of submitting that application. This may include your picture, education history, and salary expectations. That information will be submitted to our career portal service provider for evaluation purposes. We may use the Personal Information you submit as part of the job application process to evaluate your qualifications and to otherwise consider or respond to your inquiry. Your submission of a job application does not in any way require Creyos to review that application or consider you for employment.

Marketing Communications. With your consent, we may use Personal Information to send you promotional and other electronic communications. We may use third parties or service providers to deliver communications to you. You may opt-out of such marketing emails by using the unsubscribe link in the email or contacting us at help@creyos.com with “Unsubscribe” in the subject line. Opting out of marketing communications does not opt you out of non-marketing communications.

Business Contracts with Us. When a business contracts directly with us for the use of our Platform, we may collect the business contact information of those involved. The processing of any information provided in such a business context is governed by the contracts between that business and Creyos.

Feedback. When you provide comments or feedback about our Services, the content on the Services, or our products or services ("Feedback"), we may use that Feedback for any purpose in our sole discretion so long as it does not personally identify you. Feedback will be used without attribution or compensation to you.

Data Automatically Collected

We may use automated technologies to collect Personal Information from your device when you use certain portions of our Services. We may combine this Personal Information automatically collected from you with other Personal Information. This may include the following:

Tracking Technologies. Our Services may use cookies, web beacons, pixel tags and other tracking technologies (collectively "Tracking Technologies"). A cookie is a small text file that our Services saves onto your computer or device when you use the Services that provides us certain information about your activities. Cookies allow the Services to remember your actions and preferences and recognize you or your browser, along with some information you provided. Web beacons / pixel tags are small graphics on a webpage that monitor your activity when viewing a webpage.

Most browsers automatically accept Tracking Technologies. You can disable this function by changing your browser settings but disabling certain Tracking Technologies may impact your use and enjoyment of the Services. Not all features or functions of the Services may work properly if you disable Tracking Technologies. You cannot disable all Tracking Technologies, such as Tracking Technologies that are essential to the functioning of the Services.

The Tracking Technologies on certain portions of our Services may collect information such as:

• IP addresses assigned to the computers and other devices you use;
• your internet service provider;
• device ID number;
• approximate geographic location;
• browser type;
• Services pages visited;
• websites you access before and after visiting the Services, and 
• data related to how and when you use the Services. 

California's "Do-Not-Track" Requirement. we currently do not honor “do not track” requests. 

We use Personal Information that we collect for the following purposes:

As Stated or Agreed to at the Point of Collection. We may use Personal Information for the purposes stated or agreed-to (or as is obvious) at the point of collection. For example, we use Personal Information to respond to your questions, comments, or complaints. We may also use Personal Information as requested or consented to by you. 

Administration. We use Personal Information for administrative purposes, such as to inform our business strategies, and to understand demographics and user preferences.

Services Management. We use Personal Information for Services management, such as troubleshooting problems, improving the content and functionality, to perform statistical and other analyses, and to customize the Services to our users. 

Analytics. We use Personal Information for business analytics purposes, including to assess the effectiveness of our services and advertising, and to analyze market trends and consumer demand. 

Advertising and Communications. We may use Personal Information to perform targeted advertising, to notify you of new services, products, or programs, to notify you of new features of our Services, to notify you of changes to our terms or this Policy, and for other similar communications.

To Protect Our Rights. We may use Personal Information to protect our legal rights or interests, or those of other parties, including to bring a legal action against you or anyone who may be causing harm to us, our Services, or to other users of the Services. We may also use Personal Information to seek business, financial or legal advice, and to respond to other legal requests. 

To Create Deidentified or Aggregate Data. We may process Personal Information to create deidentified and aggregated data regarding or derived from our Services. We may collect, use, disclose, transfer, and otherwise process such information that we receive or create for any purposes in our sole discretion, in compliance with applicable laws. We are the sole and exclusive owner of such deidentified or aggregated information, including if we anonymize or deidentify Personal Information so that it no longer considered Personal Information under applicable laws.

How We Use Data Collected by Tracking Technologies. We use Tracking Technologies to: (i) make our Services function properly; (ii) provide personalized experiences; (iii) tailor our interactions with you; (iv) provide us with valuable data and statistics about the usage and effectiveness of our Services and to help us improve our Services; and (v) help us improve our services. 

• Google Analytics. We use Google Analytics to collect and process information about your use of the Services. Google sets cookies on your browser or device, and then your web browser will automatically send information to Google. Google uses this information to provide us with reports that we use to better understand and measure how users interact with our Services. 

To learn more about how Google uses data, visit Google’s Privacy Policy and Google’s page on “How Google uses data when you use our partners’ sites or apps.” You may download the Google Analytics Opt-out Browser Add-on for each web browser you use, but this does not prevent the use of other analytics tools. To learn more about Google Analytics cookies, visit Google’s “Google Analytics Cookie Usage on Websites” page. 

Online Behavioral Advertising. We use third parties and/or service providers to provide interest-based advertising services. These services may serve advertisements on our behalf that are customized based on predictions about your interests generated from your visits to websites (including our Services) over time and across different websites. The data collected may be associated with your Personal Information. These advertisements may appear on the Services and on other websites and may be sent to you via email. 

Google Ads. We use Google Ads to serve ads across various websites. Google uses Cookies to collect data about your visits to the Services to generate targeted advertisements to you on other websites that you visit. To opt-out of this type of advertising by Google, to customize your ad preferences, or to limit Google’s collection or use of such data, visit Google’s Safety Center and Google’s Ad Settings and follow Google’s personalized ad opt-out instructions. Opting out will not affect your use of the Services.

To change your preferences with respect to certain online ads or to obtain more information about ad networks and online behavioral advertising, visit National Advertising Initiative Consumer opt-out page or the Digital Advertising Alliance Self-Regulatory Program. Changing your settings with individual browsers or ad networks will not necessarily carry over to other browsers or ad networks. As a result, depending on the opt-outs you request, you may still see our ads. Opting out of targeted advertising does not opt you out of all ads, just those targeted to you.

We will keep Personal Information for the period necessary to fulfill the purposes described in this Policy unless a longer retention period is permitted or required by law.

We may disclose Personal Information to the following categories of parties, in compliance with applicable laws:

Employees and Affiliates. We may disclose Personal Information to our employees and affiliates who have a need to know the information for our business purposes.

Third Parties and/or Service Providers. We may disclose Personal Information with service providers that provide services for us. For example, we may disclose Personal Information to vendors to help us host and manage the Services, improve the content and functionality of the Services, perform data analysis and statistical analysis, provide targeted advertising and other marketing; troubleshoot problems with the Services, and support or provide the security of the Services. 

Government Officials / Law Enforcement. We will cooperate with law enforcement and other governmental agencies, and may disclose Personal Information:  (i) if we believe in good faith we are legally required to disclose that Personal Information, (ii) if we are advised to disclose Personal Information by our legal counsel, or (iii) when necessary to identify, contact or bring a legal action against someone who may cause or be causing harm to, or interfering with the legal rights of Creyos or any other party.

Professional Advisors. We may disclose Personal Information to our professional advisors, such as our attorneys, accountants, financial advisors, and business advisors, in their capacity as advisors to Creyos. 

Change in Ownership. In the event Creyos is the subject of a change of control or in the event the Services change ownership, in whole or in part, or in the event of a bankruptcy, receivership or a similar transaction, we may provide Personal Information as part of the transaction to the subsequent owner(s).

Other. We may disclose Personal Information to third parties when explicitly requested by or consented to by you, or for the purposes for which you disclosed the Personal Information to us as indicated at the time and point of the disclosure (or as was obvious at the time and point of disclosure).

The Services is not directed at children under 18 years of age. We do not knowingly collect, sell, use, or disclose Personal Information directly from children under 18. If we obtain actual knowledge that any Personal Information has been provided by a child under the age of 18, we will promptly delete that information. If a parent or legal guardian learns that their child provided us with Personal Information without his or her consent, please contact us and we will make commercially reasonable attempts to delete such Personal Information. To the extent we collect any health information relating to children, such information shall be governed by our agreements with health care provider as described above.

We use appropriate commercially reasonable technical and organizational measures to help secure Personal Information against loss, misuse, and alteration appropriate to the type of Personal Information processed. If a breach of your Personal Information occurs, we will notify you of the breach consistent with applicable law.

You understand that no data transmission over the internet or device can be guaranteed to be 100% secure. While we strive to protect Personal Information, we do not guarantee the security of Personal Information and you provide Personal Information at your own risk.

We are active on social media, including Facebook, X (formerly Twitter), LinkedIn, and YouTube (“Social Media”). Anything you post on Social Media is public information and will not be treated confidentially. We may post (or re-post) on the Services and our Social Media pages any comments or content that you post on Social Media platforms. Your use of Social Media is governed by the privacy policies and terms of the providers that own and operate those platforms and not by this Policy. We encourage you to review those policies and terms.

If you access the Services from outside of the United States, please be aware that Personal Information may be transferred to, stored in, and processed in the United States where it may be disclosed in response to valid demands or requests from government authorities, courts, or law enforcement officials in the United States. Certain governmental authorities may not consider the level of protection of Personal Information in the United States to be equivalent to that required in other jurisdictions. 

The Services may link to websites not controlled by us. We are not responsible for third parties’ privacy policies or practices. This Policy does not apply to any third-party websites or to any data that you provide to third parties. You should read the privacy policy for each website that you visit.

This Section provides additional terms and conditions that apply to residents of Canada that access our Sites from Canada. The term “Personal Information” as used below has the meaning given in applicable legislation.

Right of Access. Under Canadian privacy laws you have the right:

• To be informed of the existence, use and disclosures of your Personal Information.
• To receive an account of the uses that have been made of your Personal Information by us and any third parties to whom it has been disclosed.
• To be given access to your Personal Information; and
• To challenge the accuracy and completeness of the Personal Information and have it amended as appropriate.

Right to Withdraw consent. You have the right to fully or partly withdraw your consent to the processing of your Personal Information. Once we have received notification that you have withdrawn your consent, we will no longer process the Personal Information in question unless there is another legal ground for the processing. 

Right to Lodge a Complaint. Although we would rather that you speak to us first, if you believe that your Personal Information protection rights may have been violated, you always have the right to lodge a complaint with the applicable supervisory authority, or to seek a remedy through the courts.

Quebec Data Subject Rights. In addition to the above, in certain circumstances, Quebec residents may also have: i) the right to request that we cease disseminating their Personal Information, ii) the right to request that we de-index any hyperlink attached to their name that provides access to information by a technological means; iii) the right to request that we re-index a link providing access to information; or iv) the right to request that we communicate to you as well as to any person or body authorized by law to collect such information, any computerized Personal Information collected from you in a commonly used technological format. 

We may require that you provide information verifying your identity before we provide this requested information to you. To obtain such information, please email your request to help@creyos.com. We will generally respond to all access requests within 30 days of the receipt of all necessary information. In circumstances where we are not able to provide access, or if additional time is required to fulfill a request, we will advise you in writing.

We reserve the right not to release certain types of information based upon exemptions specified in applicable legislation. Where possible, we will sever the information that will not be disclosed and provide you with access to the remaining information. Should we be unable to provide access to or disclose Personal Information to you, we will provide you with an explanation, subject to restrictions.

In certain circumstances, such as where the request is excessive or unfounded, we may charge an administration fee for access to Personal Information

Legal Disclosures and Lawful Requests. We and our Canadian and U.S. service providers and affiliates may disclose your Personal Information in response to a search warrant or other legally valid inquiry or order, or to another organization for the purposes of investigating a breach of an agreement or contravention of law or detecting, suppressing, or preventing fraud, or as otherwise may be required or permitted by applicable Canadian or U.S. law or legal process, which may include lawful access by U.S. courts, law enforcement or other government authorities. Your Personal Information may also be disclosed where necessary for the establishment, exercise, or defense of legal claims and to investigate or prevent actual or suspected loss or harm to persons or property.

Contact Us

If you have questions or concerns regarding this Policy, contact us at:

Cambridge Brain Sciences Inc., also operating as Creyos

Attn: Privacy Officer
help@creyos.com
220 King Street West,
Suite 300, Toronto, 
ON M5H 1K4, 
Canada