Consent for Personal Data Processing

Effective date: June 24, 2026 Last updated: June 24, 2026 Drawn up in accordance with Article 9 of the Federal Law of July 27, 2006 No. 152-FZ “On Personal Data” of the Russian Federation (current edition), including amendments effective from September 1, 2025.

This Consent for Personal Data Processing (the “Consent”) is provided by the personal data subject (the “User”) at the moment of creating an account in the Neiry Pulse mobile application by checking the corresponding checkbox during registration, which is equivalent to a handwritten signature in accordance with the current legislation of the Russian Federation.

1. Personal Data Operator

The personal data operator depends on the channel through which the User obtained the Neiry Pulse application:

For Apple App Store users: - Konstantin Valeryevich Dvugroshev — a private individual using a personal Apple Developer account - Address: Moscow, Vysokaya str., bldg. 20, apt. 41, Russian Federation - Contact email: hello.solomono@gmail.com

For Google Play users: - LLC NMF “Neirotech” (ООО НМФ «Нейротех») — legal entity - OGRN 1026102573419, INN 6154082572 - Registered address: 347905, Rostov Region, Taganrog, Dzerzhinskogo str., 119-a, Russian Federation - Contact email: privacy@neiry-bci.com

(jointly — the “Operator”)

2. Personal Data Subject

The User who checks the box “I agree with the terms of personal data processing” when registering in the Neiry Pulse application.

The User is identified by the information provided during registration (email and other profile data).

3. List of Personal Data Processed

The User gives the Operator consent to process the following categories of personal data:

3.1. Identification and contact data

Full name (if voluntarily provided);
Email address;
Unique user identifier in the system.

3.2. Profile data

Date of birth or age group;
Sex/gender;
Height, weight;
Goals of using the application (recovery, fitness, wellbeing management, etc.);
Preferred interface language;
Country or region (if provided by the User).

The User confirms that they understand and explicitly consent to the processing of the following wellness-related data, which belongs to the special category of personal data in accordance with Part 1 of Article 10 of Federal Law No. 152-FZ:

Heart rate and resting heart rate;
Heart rate variability (HRV), including derived metrics;
Raw R-R intervals (intervals between heartbeats);
Inertial measurement unit (IMU) data: accelerometer, gyroscope, magnetometer;
Step count and physical activity summaries;
Sleep phases (light, deep, REM, awake) and sleep duration;
Blood oxygen saturation (SpO2);
Personal HRV baseline;
Training session records, including duration, average and maximum heart rate, heart-rate zones, distance, route (GPS, where available).

Clarification: the listed data are used by the Operator exclusively for wellness and fitness purposes. They are not used for medical diagnosis, treatment, monitoring of diseases, or clinical decision-making. The application is published in the “Health & Fitness” category, does not belong to the “Medical” category, and is not a medical device.

3.4. Technical data

Information about the User’s mobile device and operating system;
Bluetooth device identifiers (Neiry wearable device);
Serial number and firmware version of the wristband;
Application crash logs, diagnostic data, application interface interaction events.

3.5. Location data (only in training mode)

GPS coordinates are collected exclusively at the moment when the User explicitly starts a training session with route tracking. Outside of training mode, the application does not collect geolocation.

4. List of Actions with Personal Data

The User consents to the following actions with the personal data specified in Section 3:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, changing);
extraction;
use;
transfer (provision, access) to the persons listed in Section 7 of this Consent;
depersonalization;
blocking;
deletion;
destruction.

5. Method of Processing

Personal data is processed by a mixed method — using automated means and without using automated means, depending on the category of data and the purpose of processing.

6. Purposes of Processing Personal Data

The User consents to the processing of personal data for the following purposes:

Creation and maintenance of the User’s account in the Neiry Pulse application;
Authentication and authorization of the User when logging into the application;
Connection of the mobile application to the Neiry wearable device via Bluetooth;
Collection of biometric indicators from the device and their processing to calculate the User’s personal baseline;
Calculation of wellness and fitness metrics (HRV, deltas from the personal baseline, sleep and activity trends);
Generation and display to the User of general wellness recommendations (informational, not medical);
Storage of metric history and training sessions for viewing by the User;
Transfer of indicators to the User’s trusted contacts upon the User’s explicit request (Sharing feature);
Sending service push notifications (e.g., “Your personal baseline is ready”);
Ensuring the security of the account and protection against fraudulent actions;
Diagnosing and resolving software and technical errors of the application;
Analytics of application usage in depersonalized form to improve functionality.

7. Transfer of Personal Data to Third Parties

The Operator engages the following data processors who act on behalf of the Operator in accordance with Article 6 of Federal Law No. 152-FZ:

LLC “Yandex.Cloud” (Yandex Cloud) — storage of account data, biometric indicators, and server infrastructure. Servers are located in the Russian Federation;
Google LLC (Firebase Cloud Messaging) — sending push notifications to the User’s mobile devices. Transfer of device identifiers and push notification tokens;
Google LLC (Firebase Crashlytics, if used) or Sentry — processing application crash logs to resolve software errors;
Veepoo (via SDK on the User’s device) — data exchange with the wearable device via Bluetooth locally on the User’s device.

The Operator does not sell personal data to third parties and does not transfer them to advertising networks, data brokers, or other organizations for their own commercial purposes.

Cross-border transfer: some of the engaged persons (Google LLC) are located outside the Russian Federation. The User consents to the cross-border transfer of depersonalized device identifiers and push notification tokens to countries that provide an adequate level of protection of the rights of personal data subjects in accordance with the list of the Roskomnadzor.

This Consent is valid from the moment it is provided by the User (checking the box at registration) until it is revoked by the User or until the purposes of processing personal data specified in Section 6 are achieved, whichever occurs earlier.

After the termination of the Consent, the Operator is obliged to stop processing the relevant personal data and ensure their deletion within the timeframes established by the current legislation of the Russian Federation (as a rule, within 30 days).

The User has the right to revoke this Consent at any time in one of the following ways:

Through the application: Settings → Privacy → Delete Account Permanently.
By email: send a request to privacy@neiry-bci.com with the subject “Revocation of Consent for Personal Data Processing — Neiry Pulse”.
By postal mail: a written revocation to the address of the relevant Operator (see Section 1).

The request to revoke consent must contain the User’s full name, email of the account, and confirmation of the intention to revoke consent.

Upon receipt of the revocation, the Operator stops processing the User’s personal data within 30 days and ensures their deletion from its servers, except for data, the processing of which is required in accordance with the current legislation of the Russian Federation (accounting, fulfilling Roskomnadzor requirements, etc.).

Some data may be retained in depersonalized form for the purposes of internal analytics and service improvement, which does not impede the revocation of consent.

10. Rights of the User

In accordance with Article 14 of Federal Law No. 152-FZ, the User has the right to:

receive information about the processing of their personal data by the Operator;
require clarification, blocking, or destruction of personal data if they are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the purposes of processing;
revoke this Consent;
appeal against the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.

By checking the box “I agree with the terms of personal data processing” in the Neiry Pulse application when registering, the User confirms that:

they have read this Consent in full;
they understand the nature of the personal data processed, including the special category of wellness data;
they provide their consent voluntarily, consciously, and informedly;
they understand their rights, including the right to revoke consent at any time.

Related documents:

Privacy Policy — describes the Operator’s personal data processing practices
User Agreement — general terms of use of the application

Consent for Personal Data Processing — Neiry Pulse