Privacy Policy

The short version: this is an informational website with a waitlist. We don’t ask you to create an account, we don’t track you around the web, we don’t run advertising, and we never sell your data. We use our hosting provider’s cookieless, privacy-preserving analytics to count visits and measure page speed: no cookies, no cross-site tracking, no personal profiles. The only personal information we hold is what you choose to give us: what you send in an email, or what you enter if you join the waitlist. You can leave the waitlist in one click, and doing so deletes your details outright. The detail below is the full legal version.

1. Who we are

Nomad Neuroscience Ltd is the data controller for the personal information described in this policy. We are registered in England and Wales (Company № 16558472), registered office 10 Stevens Lane, Claygate, Esher, England, KT10 0TE, and registered as a data controller with the Information Commissioner’s Office (registration reference ZC142591). For anything privacy-related, email hello@nomadneuro.com.

2. What we collect

• Waitlist details: if you join the waitlist, we ask for your name, email address and country of residence. That is everything: we don’t ask for a phone number to join. We record the wording of the consent you agreed to and when you gave it. We also store, from the request itself: a coarsened version of your IP address (the last part removed, so it points at a network rather than a household), your approximate location as your country, region and nearest city, the browser and device string your browser sends, its language setting, the page you arrived from and the page you signed up on, and the campaign tags in the link you followed. We keep this to stop the form being abused, to know which of our posts people find us through, and to see roughly where interest is coming from. None of it is used to track you across other websites, to build a profile, or to advertise to you. We hold all of this from the moment you submit the form, marked unconfirmed until you click the link in the email we send you. If you never click it, the whole entry is deleted automatically after 30 days.
• Optional waitlist answers: after you confirm, we invite you to tell us more: whether you’re an athlete, coach, clinician or researcher, your sport, your age range, your gender, a phone number, anything you’d like us to know, and whether we may contact you about research studies. Every one of these is optional, blank by default, and you can change or clear them whenever you like from the link in your confirmation email. We ask for a phone number for one purpose only: so we can call you about the beta programme if you are invited into it. We don’t use it for marketing, we don’t pass it to anyone else, and leaving it blank costs you nothing.
• Correspondence: if you email us, we receive your email address and whatever you include in your message, so we can reply and keep a record of what was agreed.
• Technical and security logs: our hosting provider processes IP addresses and request data transiently to serve the site and protect it from abuse. Our error-monitoring tool may record technical details of a failure; reports are stripped of emails and tokens before they leave our systems.
• Aggregate visit and performance statistics: we use Vercel Web Analytics and Speed Insights, which are cookieless. They count page views, visits, and page-speed metrics in aggregate. Visitors are counted using a temporary hash that cannot identify you, is never stored in your browser, and expires within a day; no advertising identifiers, no fingerprinting, no cross-site tracking, and no personal profiles.

We don’t ask for special-category data and we don’t buy data about you from anyone. If you choose to include health information in a message to us (for example, about your own condition), we treat it as shared with your explicit consent, use it only to respond to you, and delete it if you ask. This site sets no cookies; see our Cookie Policy.

3. Why we use it, and our legal bases

Under UK, EU, and Swiss data protection law we need a legal basis for each use. Ours are:

• To run the waitlist: holding your place, sending you the confirmation email, and writing to you about the beta and about nomad becoming available. Those updates sometimes go to part of the list rather than all of it, for example only to people in one country or only to people who told us they are clinicians, so that we send you fewer emails rather than more. Every one carries a one-click unsubscribe, which stops the emails and keeps your place. Legal basis: your consent (Article 6(1)(a)), given by ticking the box and confirming by email. You can withdraw it at any time, either by unsubscribing or by leaving the list, which deletes your details.
• To confirm it was really you: we email a confirmation link and store nothing about you as a list member until you click it, so nobody can put someone else on the list. Legal basis: legitimate interests (Article 6(1)(f)) in keeping our list honest and not emailing people who never asked.
• To decide who to invite first: the optional answers help us pick a first cohort that covers the range of people we build for. Legal basis: your consent, given by choosing to answer. Leaving them blank costs you nothing.
• To respond to you: replying to your messages and keeping a record of our correspondence. Legal basis: legitimate interests (Article 6(1)(f)) in communicating with people who contact us.
• To keep the site secure: rate limiting, abuse prevention, and error monitoring. Legal basis: legitimate interests in protecting our service and users.
• To understand how the site is used: aggregate, cookieless page-view and performance statistics that cannot identify you. Legal basis: legitimate interests (Article 6(1)(f)) in understanding and improving our site; the measurement is anonymous and involves no tracking.
• Health information you volunteer: if a message you send us includes health information, we use it only to respond to you. Legal basis: your explicit consent (Article 9(2)(a)), given by choosing to share it. You can withdraw it, and have the information deleted, at any time.

We do not use your information for advertising or profiling, we don’t make automated decisions with legal effects about you, and we don’t use any tracking or advertising technologies.

4. Who we share it with

We never sell or rent your data, and we don’t share it with anyone for their own marketing. We use a small number of service providers who process data only on our instructions, under contracts that protect it:

• Vercel: hosting this website, and providing its cookieless visit and performance statistics (Vercel Web Analytics and Speed Insights).
• Sentry: error monitoring. Before an error report leaves our systems we automatically strip emails and tokens from it.
• Adobe Fonts: serving this site’s typefaces. When a page loads, your browser requests the fonts from Adobe’s servers, which receive standard request data (such as your IP address) to deliver them and to count page views for font licensing. Adobe sets no cookies for this.
• Supabase: the database that holds the waitlist. Access is restricted to our servers and to named members of our team.
• Resend: sending the waitlist confirmation and welcome emails. Our messages carry no tracking pixels and no per-recipient links to images, so we don’t measure or record who opened what. The only image in them is our logo, the same file for everybody, which your email app fetches once and then caches.
• Our email provider: receiving and sending the emails you exchange with us.

We may also share information if the law requires it (for example under a court order), with our professional advisers under confidentiality, or, if our business is sold or reorganised, with the new owner, who must honour this policy. We’d tell you if that happened.

5. International transfers

Some of our providers store data in the United States or other countries outside the UK, the EEA, and Switzerland. When they do, we rely on recognised safeguards: the UK–US, EU–US, and Swiss–US Data Privacy Frameworks where the provider is certified, and otherwise Standard Contractual Clauses with the UK Addendum or International Data Transfer Agreement. You can ask us for details of the safeguard applying to any transfer.

6. How long we keep it

• Waitlist entries: until you leave the list, or until the waitlist has served its purpose and we close it, whichever comes first. Leaving deletes your row outright: we don’t keep a record that you were once on it.
• Unconfirmed waitlist entries: deleted automatically after 30 days. If you never click the confirmation link, your details disappear on their own.
• Correspondence: up to 2 years after our last exchange, unless it relates to a legal matter.
• Security and error logs: transiently; they expire on our providers’ standard short retention schedules.
• Our internal record of staff access: we log which member of our team signed in to the waitlist, exported it, or deleted an entry, and keep that log for 2 years.

7. Your rights

Wherever you live, you can email hello@nomadneuro.com and we’ll help, for free, normally within a month. If you’re in the UK, EU, EEA, or Switzerland you have the right to:

• access a copy of the personal data we hold about you;
• correct it, delete it, or restrict how we use it;
• object to processing based on legitimate interests;
• receive the data you gave us in a portable format;
• withdraw consent at any time, where consent is the basis: for the waitlist, the link in your confirmation email lets you do it yourself in one click, and for health information you’ve chosen to share with us, email us; and
• complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk, 0303 123 1113); in the EU/EEA, your national data protection authority; in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC). We’d appreciate the chance to sort it out with you first.

If you live in a US state with a consumer privacy law (such as California, Colorado, Virginia, or Texas): we do not sell your personal information or share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling. You have rights to know, access, correct, and delete the personal information we hold about you, and to non-discrimination for exercising them. Email us and we’ll handle it. If we decline a request you may appeal by replying to our decision, and we’ll review it.

8. Children

This site is not directed at children under 13, the waitlist is not intended for them, and we don’t knowingly collect data from them. If you believe we have, email us and we’ll delete it.

9. How we protect it

Data is encrypted in transit, access is restricted to those who need it, and we collect the minimum we can. The waitlist database is not reachable from the public internet with any key the website hands out: it can only be read by our own servers and by named members of our team, who sign in with a single-use link sent to an address on a fixed list rather than with a shared password. The links we email you are long random values of which we store only a one-way hash, so a copy of our database would not let anyone use them. Sign-ins, exports, and deletions are logged. No system is perfectly secure, but if a breach ever put your rights at risk we would notify you and the regulator as the law requires.

10. Changes to this policy

If we change this policy we’ll update the date at the top. If we start collecting new kinds of data, for example if we open a shop, we’ll update this policy first.

11. Contact

Questions, requests, or complaints: email hello@nomadneuro.com or write to Nomad Neuroscience Ltd, 10 Stevens Lane, Claygate, Esher, England, KT10 0TE, and a human will answer.