GDPR and HIPAA
Where we stand under each, and where we do not. Written to be checkable rather than reassuring.
Written by engineers, not counsel
This describes what the system does and how we understand our obligations. It has not been reviewed by a lawyer and is not legal advice to you. Your institution must make its own assessment; we will answer any question that helps it do so.
GDPR
Who is what
| Role | Who | For what |
|---|---|---|
| Controller | NeuraCrypt | Account and website data |
| Processor | Cloudflare | Hosting, database, file storage |
| Processor | Clerk | Authentication and sessions |
| Not involved | Anyone | Your recordings. They never reach us, so no role arises |
That last row is the important one. When you analyse patient recordings in Signal Studio, we are not a processor of that data, because we never receive it. Your institution remains its sole controller, and no agreement with us is needed for it.
Lawful basis, per item
| Data | Basis | Article |
|---|---|---|
| Account, email, session | Contract: you cannot have an account without one | 6(1)(b) |
| What you publish or post | Contract, and your own act of publishing | 6(1)(b) |
| Install and vote records | Legitimate interest: ranking, and the "installed it" marker on reviews | 6(1)(f) |
| Notification emails | Consent, per switch, off unless you turn it on | 6(1)(a) |
| Moderation log | Legitimate interest: accountability of moderation | 6(1)(f) |
| Update check | Legitimate interest: telling you a fix exists. No identifier is sent | 6(1)(f) |
No special category data under Article 9 is processed by us. Recordings would be, which is why the software has no path to send them.
Your rights, and how to use them
| Right | Article | How |
|---|---|---|
| Access | 15 | Export as JSON, immediately |
| Rectification | 16 | Edit your profile, or ask us |
| Erasure | 17 | Delete the account |
| Portability | 20 | The same export: structured, machine-readable JSON |
| Object | 21 | Ask. In practice this means deleting the account, since we hold nothing else |
| Complain | 77 | To your national supervisory authority |
Access and erasure are buttons rather than a form to fill in, because a right you have to request politely is a right in name only.
Transfers outside the EU
Account data is stored in the United States by Cloudflare and Clerk. Both operate under the standard contractual clauses and participate in the EU-US Data Privacy Framework. Our infrastructure region is documented on the data location page.
If your institution cannot accept that transfer, use the software without an account. Everything except publishing and posting works, and then nothing personal reaches us at all.
Breach notification
A breach affecting personal data would be reported to the relevant supervisory authority within 72 hours and to affected people without undue delay, and would appear on the status page with a written account of what happened.
HIPAA
The honest position, because a vague answer here would be worse than none:
Why no BAA is needed for the software
A business associate agreement is required when a vendor creates, receives, maintains or transmits protected health information on a covered entity's behalf. Signal Studio does none of those. Recordings are opened from your disk, processed locally, and written back to your disk. We never receive them, so the relationship a BAA would govern does not exist.
Installing it is closer to installing MATLAB or Python than to using a cloud service. Your institution's assessment should reflect that, and we will say so in writing if that helps.
Where you must be careful
- Never post patient data to the forum or the marketplace. Not a trace, not a screenshot with channel labels. Those are our servers and PHI does not belong there. The code of conduct treats it as immediate removal.
- A published workflow file can carry identifiers in file paths or channel names. Check before publishing.
- Extensions run with your permissions and can read any file you can. On a machine holding PHI, install only what you have reason to trust.
- The update check leaves your network. It carries no identifier, but
if your policy forbids outbound connections from a clinical machine, block
eeg.studio: the software keeps working.
What we can provide
A written statement that the software transmits no data, a description of
every network call it makes, a completed security questionnaire, and access to
the network-handling source for review. Ask at privacy@eeg.studio.
What we cannot provide is a BAA or a certification. Anyone offering you either for locally-run analysis software is selling reassurance rather than protection.