NuroLux™ Privacy Policy

Effective: 09.2026

This Privacy Policy (“Policy”) describes how NuroLux™, Inc. (“NuroLux™,” “we,” “our,” or “us”) collects, uses, retains, and discloses personal information obtained through our website at https://www.NuroLux.com/ (the “Site”) and features and services made available through the Site or NuroLux platform, including NeuroNavigator™ assessments, educational resources, coaching or care-navigation services, and AI-enabled support features (collectively, the “Services”).

This Policy applies to personal information collected through the Services unless a different notice applies. Certain information may also be subject to additional federal or state health-information privacy laws, contractual restrictions, or a health care provider’s Notice of Privacy Practices.

Email: info@nurolux.com

What information we collect and maintain about you

We may collect information directly from you, from an organization or person authorized to provide information to us, and automatically when you use or interact with the Services.

User Accounts

  • Identifiers and contact information, such as name, email address, telephone number, account credentials, and general location.
  • Family and household information you choose to provide, including a child’s or family member’s date of birth or age.
  • Health, developmental, disability, diagnostic, assessment, care-planning, service, or support information you choose to provide, including information relating to autism or other developmental needs.
  • Responses to screening questionnaires, assessments, surveys, or care-navigation tools.
  • Billing and transaction information if you purchase a membership or service. NuroLux does not intend to store complete payment-card numbers; payment information may be processed by a payment processor.
  • Communications and other information you choose to provide through support, coaching, forms, email, chat, or other platform features.

Health and Medical Information

Some information submitted through the Services may constitute health or medical information and may be considered sensitive personal information under applicable privacy law. Whether particular information is “protected health information” (“PHI”) under HIPAA depends on the context in which NuroLux receives and maintains the information and NuroLux’s relationship with a HIPAA covered entity or business associate.

California’s Confidentiality of Medical Information Act (“CMIA”) may apply to certain digital services that maintain medical information for an individual or health care provider. To the extent CMIA applies to NuroLux or to particular information maintained through the Services, NuroLux will protect medical information and limit its use and disclosure in accordance with applicable California law.

Information that has been lawfully deidentified or aggregated so that it is not reasonably linkable to an individual may be used as permitted by applicable law.

Chat, AI-Enabled Support, and Automated Features

NuroLux may provide chat, conversational support, recommendations, summaries, navigation assistance, document processing, search and retrieval, or other features that use artificial intelligence (“AI”), machine learning, natural-language processing, predictive analytics, or automated systems. Information you submit to an AI-enabled feature may be processed to provide the requested response or functionality, subject to applicable contractual, privacy, and security requirements.

NuroLux uses AWS Bedrock as its managed AI hosting platform and uses Anthropic Claude models for text-generation and document-processing functions. Anthropic’s commercial API does not use customer inputs or outputs to train its models by default. Search and retrieval features use Cohere embedding models through AWS Bedrock together with Pinecone vector-search technology. NuroLux uses LiteLLM as an orchestration layer for supported AI services.

AI-GENERATED CONTENT MAY BE INCOMPLETE, INACCURATE, OR INAPPROPRIATE FOR A PARTICULAR INDIVIDUAL. UNLESS EXPRESSLY STATED OTHERWISE, NUROLUX AI-ENABLED FEATURES, INCLUDING THE CARE COACH, ARE INTENDED TO SUPPORT EDUCATION, CARE NAVIGATION, ORGANIZATION, INFORMATION RETRIEVAL, AND DECISION SUPPORT. THEY ARE NOT A SUBSTITUTE FOR DIAGNOSIS, MEDICAL ADVICE, EMERGENCY SERVICES, OR THE INDEPENDENT PROFESSIONAL JUDGMENT OF A QUALIFIED HEALTH CARE PROVIDER.

Where required by California law, patient-facing communications generated by generative AI that concern patient clinical information will include an AI disclosure and instructions for contacting an appropriate human, unless an applicable statutory exception applies, such as review by a licensed or certified health care provider.

NuroLux also maintains a proprietary model designed to help families navigate their journey and support prediction of outcomes. This proprietary model is trained using responses to NuroLux survey and assessment questions. It is not trained directly on users’ medical records, uploaded medical documents, or other medical information. NuroLux may also use deidentified and/or aggregated information to evaluate and improve its Services, subject to applicable law and contractual requirements.

If NuroLux develops and publicly makes available a generative AI system or service to Californians in a manner that makes California training-data transparency requirements applicable to NuroLux, NuroLux will comply with those requirements. If NuroLux becomes subject to applicable California requirements governing provenance or disclosure of AI-generated image, audio, or video content, NuroLux will comply with those requirements.

Phone and Video Recording

From time to time, interactions with NuroLux may occur by telephone or video conference, including coaching or support sessions. If a call or video session will be recorded, NuroLux will provide notice and obtain consent when required by applicable law.

Text Messaging

If you opt in to text messaging, we may use your mobile number to send service-related messages such as assessment reminders, account notifications, or appointment reminders. You may separately choose to receive promotional text messages. Participation in marketing text messaging is optional and is not a condition of purchase. Message and data rates may apply. You may opt out of marketing messages by replying STOP and request assistance by replying HELP.

Information Collected Automatically

  • Server and device information, such as IP address, device identifiers, browser type, operating system, date/time of access, and security or diagnostic logs.
  • Cookies and similar technologies used for authentication, preferences, security, analytics, and, where enabled, advertising or measurement.
  • Usage information about pages, features, interactions, and downloads.
  • Approximate or general location inferred from an IP address or device settings, where applicable.

Analytics, Cookies, Pixels, SDKs, and Online Tracking

NuroLux currently uses Google Analytics for website and product usage analytics. NuroLux may also use cookies or similar technologies necessary for authentication, preferences, security, performance, and operation of the Services. NuroLux periodically reviews analytics and tracking technologies, particularly on authenticated pages or pages involving health or other sensitive information.

Where required by the CCPA, NuroLux will recognize valid opt-out preference signals, including Global Privacy Control (“GPC”), as a request to opt out of sale or sharing for the browser or device through which the signal is communicated.

NuroLux will periodically review analytics and advertising technologies to determine whether their use is appropriate for pages or features that may involve health, medical, or other sensitive information.

Technology and Service Providers

NuroLux uses third-party infrastructure and technology providers to operate and secure the Services. Current core technologies include:

  • PostgreSQL 16 for the primary application database.
  • Redis for background task and job management. Redis is used as a task queue and is not intended to serve as the primary repository for user data.
  • Amazon Web Services (AWS) S3 for file and document storage.
  • AWS Bedrock for managed AI processing within AWS infrastructure.
  • Anthropic Claude models through AWS Bedrock for text generation and document-processing functions.
  • Cohere embedding models through AWS Bedrock for AI search and retrieval.
  • Pinecone for vector search and retrieval features.
  • LiteLLM as the orchestration layer used to route supported AI requests within NuroLux’s AI stack.
  • Google Analytics for website and product usage analytics.
  • Stripe for payment processing. NuroLux does not intend to store complete payment-card numbers.

These providers may process information as needed to provide their respective services to NuroLux, subject to applicable contractual, privacy, and security requirements. NuroLux periodically reviews its service-provider relationships and may update this Policy when material changes affect how personal information is processed.

Aggregated and Deidentified Information

NuroLux may create and use aggregated or deidentified information for analytics, research, product improvement, reporting, and other lawful purposes. When information is treated as deidentified under applicable law, NuroLux will take reasonable measures to prevent reidentification and will not attempt to reidentify it except as permitted by law.

How we use and process your information

  • Provide, operate, personalize, support, and secure the Services.
  • Administer accounts, assessments, education, care navigation, coaching, and user-requested features.
  • Respond to questions, requests, complaints, or support needs.
  • Complete transactions and administer subscriptions or memberships.
  • Send account, security, assessment, appointment, and other operational communications.
  • Send marketing communications where permitted and honor opt-out choices.
  • Improve user experience, AI-enabled features, algorithms, and Services, including through deidentified or aggregated information.
  • Conduct analytics, quality assurance, security monitoring, fraud prevention, testing, and troubleshooting.
  • Develop new products and features in a manner consistent with this Policy and applicable law.
  • Comply with legal, regulatory, contractual, audit, and compliance obligations.
  • Protect the rights, safety, security, and integrity of NuroLux, users, and others.

AI, profiling, and automated decision-making

NuroLux may use automated tools to assist with recommendations, prioritization, personalization, or predictive analytics. We will evaluate AI and automated systems for privacy, security, accuracy, bias, and foreseeable risks appropriate to their use.

California’s 2026 CCPA regulations establish requirements for certain businesses that conduct specified risk-producing processing and, beginning in 2027, for businesses using automated decisionmaking technology (“ADMT”) to make significant decisions concerning consumers. If these requirements apply to NuroLux, NuroLux will provide required notices, access or explanation rights, opt-out rights where required, risk assessments, and other required safeguards.

Care Coach interactions may be provided directly to users through the NuroLux platform and may also involve human review. AI and automated outputs should be interpreted together with relevant individual circumstances and, when appropriate, human review. Care Coach and other AI-enabled outputs are not a substitute for diagnosis, medical advice, emergency services, or independent professional judgment. Users should contact a qualified professional for clinical decisions or urgent health concerns.

With whom and why we share your information

  • NuroLux coaches and support personnel who need the information to provide requested Services.
  • Health care providers, ABA teams, therapists, special education advocates, care coordinators, or other professionals when you request, authorize, or otherwise permit the disclosure.
  • Third-party payers, health plans, government programs, or sponsoring organizations when they are paying for or administering Services and disclosure is permitted.
  • Service providers and contractors that perform hosting, cloud infrastructure, communications, payment processing, analytics, customer support, security, AI processing, or other functions for NuroLux.
  • Research, grant, or program partners when permitted by law and consistent with applicable consent, authorization, deidentification, or contractual requirements.
  • Parties to a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and legal requirements.
  • Government authorities, courts, law enforcement, regulators, or other parties when disclosure is required or permitted by applicable law.

NuroLux does not sell medical information in violation of HIPAA, CMIA, or other applicable health privacy laws. If NuroLux engages in activity that constitutes a “sale” or “sharing” of personal information under the CCPA, and the CCPA applies to NuroLux, California consumers will receive the disclosures and opt-out rights required by law.

Small groups, community, and mentoring

If NuroLux offers voluntary group, community, or mentoring features, information you intentionally disclose to other participants may be visible to those participants and may no longer be controlled by NuroLux after disclosure. Users should avoid sharing information they do not want other participants to know. Any separate community terms or privacy notices will also apply.

California privacy rights and disclosures

NUROLUX CURRENTLY HAS NO REVENUE AND NO CUSTOMERS AND THEREFORE DOES NOT CURRENTLY MEET THE CCPA THRESHOLDS APPLICABLE TO A COVERED “BUSINESS” BASED ON ITS PRESENT OPERATIONS. THIS SECTION DESCRIBES RIGHTS AND DISCLOSURES THAT NUROLUX WILL PROVIDE IF AND WHEN THE CCPA BECOMES APPLICABLE TO NUROLUX OR TO PARTICULAR PROCESSING ACTIVITIES.

This section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), applies to NuroLux and the information at issue. Certain medical information governed by CMIA and certain PHI governed by HIPAA may be exempt from some CCPA provisions.

  • Know/access the categories and specific pieces of personal information collected about them.
  • Request deletion of personal information.
  • Request correction of inaccurate personal information.
  • Opt out of the sale or sharing of personal information.
  • Limit certain uses or disclosures of sensitive personal information when the statutory right applies.
  • Receive information about categories of sources, purposes of collection/use, and categories of third parties to whom information is disclosed.
  • Not receive discriminatory treatment for exercising CCPA rights.
  • Use an authorized agent to submit certain requests.

Sensitive personal information may include certain health information, precise geolocation, account credentials, government identifiers, and other categories defined by California law. NuroLux will provide a Notice at Collection and any required “Do Not Sell or Share My Personal Information” or “Limit the Use of My Sensitive Personal Information” mechanism if those requirements apply to its practices.

California consumers may submit a privacy request by emailing info@nurolux.com or through any additional request method made available on the NuroLux platform. We may need to verify identity or authority before completing a request.

Shine the Light. California residents may request information regarding certain disclosures of personal information to third parties for their own direct-marketing purposes, if applicable. Requests may be sent to info@nurolux.com with “California Shine the Light Rights” in the subject line.

California medical information

NuroLux may collect and maintain health, developmental, assessment, care-planning, and other sensitive information provided by users through the Services. To the extent the California Confidentiality of Medical Information Act (“CMIA”) applies to NuroLux or particular information maintained through the Services, NuroLux will protect medical information and limit its use and disclosure in accordance with applicable California law.

Your choices

  • Update certain account information through your profile or contact info@nurolux.com.
  • Request access, correction, or deletion where applicable.
  • Opt out of marketing emails using the unsubscribe link or by contacting us.
  • Opt out of marketing texts by replying STOP.
  • Manage cookies through browser/device settings and any cookie-preference tool we provide.
  • Use applicable California opt-out mechanisms, including GPC where required.
  • Use the “Delete My Data” capability to request deletion of personal information, subject to applicable legal and retention exceptions.

Children and family information

The Site and Services are generally intended for adults, including parents, caregivers, and professionals. NuroLux may process information about children when an adult user, parent, legal guardian, provider, or other authorized person provides that information in connection with the Services. NuroLux does not knowingly permit children under 13 to create independent accounts unless the particular service is specifically designed and lawfully configured for children.

Where child-directed functionality is offered, NuroLux will evaluate and comply with applicable parental-consent, notice, data-minimization, and youth-privacy requirements. NuroLux does not knowingly sell or share personal information of consumers under 16 without the affirmative authorization required by California law, if such sale or sharing occurs.

Data security and retention

NuroLux uses administrative, technical, and physical safeguards designed to protect personal information, including health information, against unauthorized access, use, alteration, loss, or disclosure. Safeguards may include access controls, authentication, encryption, logging, workforce training, risk assessments, incident response, vendor oversight, backup and recovery procedures, and security monitoring appropriate to risk.

No system can guarantee absolute security. NuroLux retains account information, child information, assessment data, Care Plans, uploaded documents, Care Coach interactions, and related platform data while an account is active. Users have a “Delete My Data” capability. When a user requests deletion or closes an account, personal data will be deleted or deidentified, subject to information NuroLux is legally required or permitted to retain. Backup, security, audit, payment or transaction, and legally required records may have separate retention requirements. NuroLux is developing a formal retention schedule by data category and will update its practices and this Policy as appropriate.

International transfers

Information collected through the Services may be processed in the United States and, where service providers are used, potentially in other jurisdictions. Where required, NuroLux will use appropriate contractual or legal safeguards for cross-border processing. Privacy laws in other jurisdictions may differ from those in your place of residence.

The Services may contain links to third-party websites or services. NuroLux does not control the privacy or security practices of third parties, and their privacy notices and terms apply when you leave the NuroLux Services.

Changes to this policy

NuroLux may update this Policy to reflect changes in our Services, technology, AI practices, legal obligations, or privacy practices. We will post the updated Policy and effective date. If changes are material, we will provide additional notice when required by law.

How to contact us

If you have questions, concerns, or privacy requests, contact NuroLux at info@nurolux.com. Jessica Taverniti is NuroLux’s designated Privacy and HIPAA Compliance Officer.

NuroLux will maintain internal documentation designating its Privacy and HIPAA Compliance Officer and defining responsibility for NuroLux privacy and applicable HIPAA compliance policies and procedures.

Ask Care Coach