Privacy Policy
Effective Date: August 24, 2026
This is a plain-language version of the Creyos Privacy Policy, that explains how Creyos handles your personal information. It does not replace the full Privacy Policy. Please read the full policy for all legal details.
Introduction
Creyos is the trade name for Cambridge Brain Sciences Inc. This includes our related companies. In this Policy, "Creyos," "we," "us," and "our" all mean the same thing.
Creyos may collect personal information about you. This can happen when you use our websites. It can also happen when you use our web-based platform. We call the websites our "Sites." We call the platform our "Platform." Together, we call them our "Services."
This Privacy Policy explains what personal information we collect. It explains how we use that information. It also explains how we share it.
Do you have questions about this Policy? Please contact us. Our contact details are at the end of this Policy.
This Policy covers situations where Creyos decides how and why your data is used. For example, this includes visits to our Sites. This Policy does not cover data we handle for our customers, like health care providers. Your provider's own privacy notice covers that data instead. Our contract with your provider also governs that data.
You may be using Creyos because your health care provider asked you to. You may give us health information as part of that. This may count as "Protected Health Information," or PHI, under a law called HIPAA. Your provider's own HIPAA notice covers your PHI. Our contract with your provider also governs your PHI. This Policy does not cover PHI. If you have questions, contact us. Or ask your health care provider.
We may change this Policy at any time. Changes take effect as soon as we post them. We will clearly post any major changes. We may also tell you about them another way.
If you live in Canada, see the Canadian section below. It has extra information for you.
1. Information We Collect
We may collect information that identifies you. We call this "Personal Information." We collect it when you use our Services. We collect it three ways: information you give us, information we collect automatically, and information we get from other sources.
You can visit our Services without giving us Personal Information. But some features need it. For example, we need it if you want to request data from us. Without it, we may not be able to help you.
Information You Provide to Us
Accounts. To use the Platform, you may need to make a Creyos account. During sign-up, we may ask for your name, email, gender, city, education level, and job. We may also ask you to pick a username, password, and security questions. Sometimes your health care provider sets up your account for you. They may give us your email or a unique Account ID to do this.
Contact Us. Do you reach out to us? We may collect your name, email, phone number, and anything else you share with us.
Mailing Lists. You can sign up for our email lists. You need to give us your email address to do this.
Applying to Work with Creyos. Do you apply for a job with us? We collect your resume and everything else you send us. This may include your photo, education history, and salary expectations. We send this to a company that helps us review applications. We may use it to review your qualifications. Applying does not mean we have to consider you for the job.
Marketing Communications. With your permission, we may send you marketing emails or messages. We may use other companies to help send these. You can opt out anytime. Click "unsubscribe" in the email. Or email us at help@creyos.com with "Unsubscribe" in the subject line. Opting out of marketing does not opt you out of other important messages.
Business Contracts with Us. Sometimes a business signs a contract with us directly. If so, we may collect contact information for people at that business. Our contract with that business governs how we use that information.
Feedback. Do you give us comments or feedback? We may use it for any reason. We will not include your name unless we ask you first. We do not pay you for feedback.
Data Automatically Collected
We may use automatic tools to collect data from your device. This happens when you use parts of our Services. We may combine this with other data we have about you.
Tracking Technologies. Our Services may use cookies and similar tools. A cookie is a small file saved on your device. It helps us remember your actions and preferences. It also helps us recognize you or your browser. We may also use web beacons or pixel tags. These are small graphics that track activity on a webpage.
Most browsers accept these tools by default. You can turn them off in your browser settings. This may affect how well the Services work. You cannot turn off every tracking tool. Some are needed for the Services to work at all.
These tools may collect: your IP address, your internet provider, your device ID, your rough location, your browser type, which pages you visit, sites you visit before and after ours, and how and when you use our Services.
California's "Do-Not-Track" Requirement. We do not currently respond to "do not track" browser signals.
2. How We Use Your Information
We use Personal Information for these reasons:
As Stated or Agreed to at the Point of Collection. We use it for the reasons we told you about when we collected it. For example, we use it to answer your questions or complaints. We also use it if you ask or agree to something specific.
Administration. We use it to run our business. This includes understanding our users and planning our strategy.
Services Management. We use it to fix problems, improve our Services, run reports, and personalize your experience.
Analytics. We use it to study trends. This helps us understand if our Services and ads are working well.
Advertising and Communications. We may use it to send you ads, or tell you about new products, features, or changes to our terms.
To Protect Our Rights. We may use it to protect our legal rights. This could include taking legal action against someone causing harm. We may also use it to get legal or financial advice, or respond to legal requests.
To Create Deidentified or Aggregate Data. We may use your data to create information that does not identify you. We own this new information. We can use it however we choose, as allowed by law.
How We Use Data Collected by Tracking Technologies. We use these tools to: make our Services work properly, personalize your experience, understand how people use our Services, and improve our Services.
Google Analytics. We use a tool called Google Analytics. It helps us understand how people use our Services. Google sets cookies and sends us reports about usage. You can learn more on Google's Privacy Policy page. You can also download a browser add-on to opt out of Google Analytics.
Online Behavioral Advertising. We may work with other companies to show you ads based on your interests. These ads may be based on your visits to our Services and other websites over time. This data may be linked to your Personal Information. You may see these ads on our Services, on other websites, or by email.
Google Ads. We use Google Ads to show ads on other websites. Google uses cookies to track your visits to our Services. This helps create ads made for you on other sites. You can opt out through Google's Ad Settings page. You can also use industry opt-out tools, like the National Advertising Initiative or the Digital Advertising Alliance. Opting out with one browser or tool does not opt you out everywhere. You may still see some of our ads.
3. Retention of Personal Information
We keep Personal Information as long as we need it. This depends on why we collected it. Sometimes the law requires us to keep it longer.
4. Disclosure of Personal Information
We may share Personal Information with:
Employees and Affiliates. Our staff and related companies, if they need it for their work.
Third Parties and/or Service Providers. Companies that help us run our business. For example, this could include companies that host our Services, help with marketing, or help keep our Services secure.
Government Officials / Law Enforcement. We may share data with the government or police. This happens if the law requires it, if our lawyers advise it, or if we need to protect our rights or someone's safety.
Professional Advisors. Our lawyers, accountants, and other advisors, when they are advising us.
Change in Ownership. If Creyos is sold, merged, or goes through bankruptcy, your data may transfer to the new owner.
Other. We may share data with others if you ask us to, or for the reason you originally gave it to us.
5. Children's Information
Our Services are not made for children under 18. We do not knowingly collect data from children under 18. If we learn a child gave us data without permission, we will delete it quickly. Are you a parent who thinks this happened? Please contact us. We will do our best to delete the data. Health information about children is handled under our contracts with health care providers, as explained above.
6. Data Security
We use reasonable technical and organizational steps to protect your Personal Information. This helps prevent loss, misuse, or unwanted changes to your data. If a data breach happens, we will notify you as required by law.
No online system is ever 100% secure. We work hard to protect your data, but we cannot guarantee its safety. You share your Personal Information at your own risk.
7. Social Media
We are active on social media, including Facebook, X (formerly Twitter), LinkedIn, and YouTube. Anything you post there is public. We may repost your comments or content on our Services or our social media pages. Your use of social media is covered by that platform's own privacy policy, not this one. Please review their policies too.
8. Access from Outside the United States
Do you use our Services from outside the United States? Your Personal Information may be sent to, stored in, and processed in the United States. It may be shared if a valid legal request comes from a U.S. court, government agency, or law enforcement. Some countries may not view U.S. privacy protections as equal to their own.
9. Third-Party Websites
Our Services may link to other websites. We do not control those websites. We are not responsible for their privacy practices. This Policy does not cover those sites, or any data you give them. Please read the privacy policy on each site you visit.
10. Canadian Addendum
This section adds extra terms for people who access our Sites from Canada. "Personal Information" here has the same meaning as under Canadian law.
Right of Access. Under Canadian privacy law, you have the right to:
- Learn what Personal Information we have, and how we use and share it
- Get a summary of who we've shared your Personal Information with
- Access your Personal Information
- Challenge and correct inaccurate or incomplete information
Right to Withdraw Consent. You can fully or partly withdraw your consent for us to use your Personal Information. Once we know you've withdrawn consent, we will stop using that data. This does not apply if we have another legal reason to keep using it.
Right to Lodge a Complaint. We'd rather you talk to us first. But you always have the right to file a complaint with a privacy authority. You can also seek a solution through the courts.
Quebec Data Subject Rights. If you live in Quebec, you may also have the right to:
- Ask us to stop sharing your Personal Information
- Ask us to remove links to your name from search results
- Ask us to restore a link we removed
- Ask for a copy of your data in a common digital format, for you or someone else you choose
We may ask you to verify your identity before sharing this information. We will usually respond within 30 days of getting everything we need. If we can't share access, or need more time, we'll tell you in writing.
Sometimes we may charge a fee. This could happen if a request is excessive or has no clear reason.
We may not release some types of information. This depends on Canadian law. Where possible, we will still share the rest of your information. If we can't give you access, we will explain why.
Legal Disclosures and Lawful Requests. We, and the companies that help us, may share your Personal Information if: we get a valid search warrant or legal order, we're investigating a broken contract or a violation of law, we're trying to detect or stop fraud, or Canadian or U.S. law otherwise allows or requires it. This may include lawful requests from U.S. courts or government agencies. We may also share data to defend a legal claim, or to prevent harm to a person or property.
Contact Us
Do you have questions about this Policy? Contact us at:
Cambridge Brain Sciences Inc., also operating as Creyos
Attn: Privacy Officer help@creyos.com
214 King Street West, Suite 210 Toronto, ON
M5H 3S6, Canada