MindSpeaker

MindSpeaker / Data & privacy

Privacy policy

How MindSpeller BCI describes the collection, use and protection of personal data.

Effective Date: 11/03/2026
Last Updated: 10 September 2026

MindSpeller BCI BV (“we”, “our”, “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, interact with our services, or use the software and research services described below.

We comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable privacy laws.

 

Product status: The MindSpeaker/MindClick configuration presented here is under development. Clinical and usability evaluation is not yet complete, and it is not CE-marked under the EU Medical Device Regulation for the proposed communication use. It is not available for routine patient use. Participant testing requires the applicable research arrangements and permissions.

MindSpeller BCI

Company Number: BE 0749.699.835

Address: Duigemhofstraat 101, 3020 Herent, Belgium

Email: contact@mindspellerbci.com

MindSpeller BCI develops neurotechnology and communication software. This website presents the MindSpeaker/MindClick communication development programme and related voice-software services. It does not offer dementia diagnostics.

Research participation: A website enquiry or prototype-demonstration booking is not study enrolment or consent to collect health information, EEG or other participant recordings. Any participant testing requires separate information, eligibility review and the applicable research, regulatory, ethics and consent arrangements.

We collect information to operate and improve our Services, personalize experiences, and ensure security.

a. Information You Provide

Category

Example Fields

Purpose

Lawful Basis

Account Data

Name, email address, password

Account creation, authentication

Contract

Payment & Profile Data

Payment details, phone number, optional profile info

Billing and identity verification

Contract

Content Data

Emails, uploaded files.

Enable analytics, communication, and insights

Consent / Contract

Special-Category Data 

EEG-derived features

Interpret neural signals for interface control (e.g., ‘click’ commands) and to calibrate personalized classification algorithms (adaptive BCI)

Explicit Consent (Art. 6(1)(a), 9(2)(a))

Special-Category Data 

User Voice Data

Generate a personalized Text-to-Speech (TTS) model that replicates the User’s unique vocal timbre (‘Voice Cloning’)

Explicit Consent (Art. 6(1)(a), 9(2)(a))

Special-Category Data 

Eye-tracking (Gaze) data

Enable real-time cursor control (navigation)

Explicit Consent (Art. 6(1)(a), 9(2)(a))

b. Information Collected Automatically

  • Device & Browser Data: IP address, device type, operating system, and browser version.

  • Usage Data: Interactions, timestamps, and feature engagement metrics.

  • Location Data: Approximate geographic region inferred from IP.

  • Cookies & Local Storage: Used for session continuity, progress tracking, and consent preferences.

We process personal data to deliver, improve, and secure our Services.

Purpose

Description

Lawful Basis

Website Service Delivery

Authenticate accounts, process searches, display results.

Contract

System Analytics & Performance Monitoring

Identifying bugs, monitoring server health, and analyzing website/app usage.

Legitimate Interest

Personalized Content & Ads

Adapt experience and recommendations.

Consent

Security & Fraud Prevention

Detect and respond to suspicious activity.

Legitimate Interest

Application Service Delivery

Enable cursor control (gaze data), click detection (EEG processing), personalized Text-to-Speech (voice cloning) and Biometric Data storage (“MindBank”).

Explicit Consent

Research & Model Improvement

Aggregate pseudonymized metrics for calibration of tailored ML models.

Explicit Consent

Legal Compliance & Law Enforcement

Comply with valid court orders, subpoenas, regulatory requests, and maintain financial records for tax and accounting purposes.

Legal Obligation

We process your biometric data (EEG, Voice, and Eye-tracking) to facilitate device control and communication. Our system uses automated algorithms—including machine learning for our EEG features, software processing for eye-tracking, and a secure third-party provider for voice cloning.

  • Logic Involved:  

    • MindClick (EEG): Algorithmic classification of your neural signals to distinguish between ‘Rest’ and ‘Action’ states.

    • Eye-Tracking (Gaze): Software processing of your eye movements to calculate and stabilize real-time cursor coordinates on your screen.

    • Voice Cloning: Processing of your voice recordings through a secure third-party provider to generate a personalized Text-to-Speech (TTS) model.

  • Purpose: To translate your physical and neural signals into direct digital commands (such as moving a cursor or triggering a click) and to provide a personalized vocal output for assistive communication.

  • Impact: Outputs are strictly functional and assistive. The algorithms operate solely as a User Interface. The system does not profile your personality, diagnose medical conditions, or make autonomous decisions that produce legal or similarly significant effects concerning you (Art. 22 GDPR).

Human oversight and control: Control signals may be missed or activated unintentionally. The available correction, calibration and supervision arrangements depend on the configuration and must be explained before any permitted participant use. The prototype is not available for routine patient use.

MindSpeller BCI BV does not sell or share personal data in an identifiable form.

Use of research data for model improvement, secondary research or commercial purposes requires the applicable lawful basis and participant information. This policy does not treat a website visit, enquiry or demonstration booking as permission for those purposes.

a. EEG Hardware and Processing Partners

  • EEG Hardware Provider: used solely for EEG signal acquisition. The headset transmits encrypted data directly to MindSpeller BCI BV’s platform. EEG Hardware Provider does not access, store, or retain any EEG or personal data.

  • Text-to-Speech Model Provider: We engage a specialized third-party AI provider to generate your personalized Text-to-Speech (TTS) model (Voice Cloning). We securely transmit a temporary voice recording and text prompts to this provider. The provider acts strictly as a Data Processor. Under our commercial agreement, the provider does not use your biometric voice data, recordings, or text inputs to train their foundational AI models or for any independent purpose.

b. Other Service Providers

We use additional subprocessors, such as:

  • AWS (EU Region) – encrypted data hosting and infrastructure.

  • Stripe – secure payment processing.

  • Analytics and security vendors – system monitoring, fraud prevention, and operational support.

All subprocessors act solely under MindSpeller BCI BV’s instructions and are contractually prohibited from using data for their own benefit.

Data may be transferred outside the European Economic Area (EEA) only where adequate safeguards are in place (e.g., EU Standard Contractual Clauses).

c. Aggregation and Anonymization

Aggregation or removal of direct identifiers does not automatically make data anonymous. Pseudonymised and otherwise identifiable data remain subject to data-protection requirements. Any proposed further use, including the following, must have the applicable lawful basis and information:

  • internal research and product improvement,

  • algorithmic calibration and bias analysis, or

  • creation of commercial or academic insight reports based on anonymized trends.

Whether a dataset is genuinely anonymous requires an assessment of reasonably likely identification methods. Salted hashes, removal of account links or retention of EEG-derived features alone do not establish irreversible anonymisation.

d. Legal Disclosures

We may disclose information if required by law or to protect the rights, safety, or property of MindSpeller BCI BV, our users, or others.

You have full control over your data and consents:

  • Review & Update: Edit or correct your data.

  • Consent Management: You can view or withdraw consent for biometric data processing. Withdrawal stops processing immediately.

  • Data Deletion: Request permanent deletion of your data, including EEG-features, voice files and trained weights of any personalized neural model (Adaptive BCI), by emailing us.

  • Export & Portability: Request a structured JSON export of your profile data.

  • Profiling Objection: You may opt out of further data storage without deleting your entire account.

 

To exercise your rights, contact us at: contact@mindspellerbci.com

  • Retention of Voice Data: Voice recordings and voice-derived data are stored only as long as necessary to provide the relevant services and are deleted upon account deletion.

  • Retention of EEG data: The applicable participant information must specify what EEG recordings or derived features are retained, for which purposes, for how long and by whom. Pseudonymised EEG-derived data remain personal data; account deletion or hashing alone does not make them anonymous. Deletion and any necessary retention must follow the applicable rights, lawful basis and study-record requirements.

  • Minimization: Raw EEG windows are not retained beyond transient processing. Only EEG-derived features are stored in a pseudonymized, encrypted matter.

  • Encryption: Data is encrypted at rest and in transit.

  • Pseudonymization: User identifiers are replaced by salted hashes. Direct identifiers are kept entirely separate from your biometric feature files.

  • Access Controls: Role-based access and logging of all profile retrievals.

Our website uses cookies and related technologies for functionality, analytics and security. Video and booking features use third-party services, including YouTube and Google Calendar, which may process data when loaded or opened. You can control cookies through your browser settings and review the relevant providers’ privacy information. Contact us with questions about a particular feature.

Our services are not intended for children under 16 except where the relevant service or approved research arrangements expressly permit participation with the required safeguards and consent. A caregiver’s or professional’s presence alone does not authorise collection of another person’s data or enrolment in a study.

We may update this policy from time to time. Changes will be posted on this page with an updated “Last Updated” date.

If you have questions or concerns about this Privacy Policy or our data practices, please contact:

Data Protection Officer
MindSpeller BCI
Duigemhofstraat 101, 3020 Herent, Belgium
Email: contact@mindspellerbci.com

You also have the right to lodge a complaint with the Belgian Data Protection Authority: https://www.gegevensbeschermingsautoriteit.be/

Scroll to Top