Privacy Policy
Last updated: August 2026
1. Who we are
ClearEEG is an educational tool for practising EEG interpretation, built and run by Vincenzo Laterza, MD, a neurologist based in Italy.
For the purposes of the GDPR, he is the data controller for the personal data described in this policy.
Contact: [privacy@cleareeg.com]
This policy explains what personal data we collect when you use cleareeg.com (the “Service”), why we collect it, who processes it on our behalf, and what rights you have. It is written to comply with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.
2. What ClearEEG is not
ClearEEG is an educational tool. It is not a medical device, it is not certified under Regulation (EU) 2017/745, and it must not be used to interpret EEGs for clinical decisions about real patients.
You must not upload EEG recordings, reports, or any other material belonging to identifiable patients. See section 6 for what this means in practice and why it matters.
3. Data we collect
3.1 Data you give us
| Data | When | Why |
|---|---|---|
| Email address | Joining the waitlist, creating an account | To contact you about the Service; to authenticate you |
| Professional role (resident, neurologist, technician, other) | Optional, at signup | To tailor case difficulty and understand our audience |
| Answers you submit during practice | Each time you answer a question | To score your answer and show your progress |
| Free-text interpretations you write | In report-writing exercises | To generate feedback comparing your text to a reference report |
| Files you upload | Only if you use the upload feature | To generate an AI interpretation for you to review |
3.2 Data collected automatically
| Data | Purpose |
|---|---|
Referral source (the src parameter in the URL) | To know which channel brought you here |
| Aggregate usage analytics (pages viewed, session duration, approximate country) | To understand how the Service is used and improve it |
| Technical logs (IP address, browser type, timestamps) | Security, abuse prevention, debugging |
We do not use advertising cookies and we do not sell or share data with advertisers.
4. Legal basis for processing
| Processing | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service to you (account, exercises, scoring) | Performance of a contract — Art. 6(1)(b) |
| Sending you the newsletter or product updates | Your consent — Art. 6(1)(a). You may withdraw it at any time |
| Analytics and product improvement | Legitimate interest — Art. 6(1)(f) |
| Security, abuse prevention, technical logs | Legitimate interest — Art. 6(1)(f) |
| Complying with legal obligations | Art. 6(1)(c) |
5. Who processes your data
We use the following providers, each acting as a data processor under Art. 28 GDPR:
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting and delivery of the website | USA / EU |
| Supabase | Database, authentication, file storage | EU region |
| Anthropic PBC | AI processing of text you submit, to generate feedback | USA |
| Resend | Sending transactional and newsletter emails | USA / EU |
| Cloudflare | DNS, security, email forwarding | Global |
| Stripe (if and when paid plans are introduced) | Payment processing | USA / EU |
Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard under Chapter V GDPR.
5.1 About AI processing
When you write a free-text interpretation or upload a tracing, that content is transmitted to Anthropic's API to generate feedback. Under Anthropic's commercial terms, content submitted via the API is not used to train their models.
Correctness in ClearEEG does not come from the AI's reading of the image. Answers to structured exercises are scored against annotations already attached to the recordings by experts, or against reference reports written by a neurologist. The AI generates the explanation, not the verdict.
6. Uploaded files — important
If you use the upload feature, you are responsible for what you upload.
Do not upload:
- EEG recordings from identifiable patients
- Reports, images, or documents containing patient names, dates of birth, medical record numbers, hospital identifiers, or any other information that could identify a person
- Any material you are not authorised to share
Patient health data is a special category of personal data under Art. 9 GDPR. ClearEEG is not designed, and is not authorised, to process it. If you upload such material you may be acting unlawfully, and you — not ClearEEG — are the controller of that data.
Uploaded files are processed to generate your feedback, retained for [30 days], and then deleted. You can delete an upload at any time from your account.
If you believe you have uploaded identifiable patient material by mistake, contact us immediately and we will delete it.
7. The EEG recordings used in exercises
The recordings you practise on come from publicly released research corpora (including the Temple University Hospital EEG Corpus). They were de-identified by the institutions that released them, and are distributed for research and commercial use. They contain no data about you and no data about our users.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and email | Until you delete your account, or after [24 months] of inactivity |
| Waitlist email (no account created) | Until you unsubscribe, or [24 months] |
| Practice answers and progress | For the life of the account; deleted with it |
| Uploaded files | [30 days], or until you delete them |
| Technical logs | [12 months] |
| Aggregate anonymous statistics | Indefinitely — these cannot be linked back to you |
9. Your rights
Under Articles 15–22 GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data (“right to be forgotten”)
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time, without affecting processing carried out before withdrawal
To exercise any of these, write to [privacy@cleareeg.com]. We will respond within one month.
You also have the right to lodge a complaint with the Italian supervisory authority:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma
garante@gpdp.it — www.garanteprivacy.it
10. Security
Data is stored in encrypted form in transit (TLS) and at rest. Access to the production database is restricted and authenticated. Row-level security is enforced so that users cannot read one another's data.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Garante within 72 hours and inform you directly where required by Art. 34 GDPR.
11. Children
ClearEEG is intended for medical professionals and students in the health sciences. It is not directed at anyone under 18, and we do not knowingly collect data from minors.
12. Cookies
We use only:
- Strictly necessary cookies — to keep you logged in and maintain your session
- Analytics cookies — aggregate, to understand usage
We do not use advertising or profiling cookies. Where analytics cookies require consent under Italian law, you will be asked before they are set.
13. Changes to this policy
We may update this policy. The date at the top reflects the most recent revision. If a change materially affects how we handle your data, we will notify registered users by email before it takes effect.
14. Contact
Questions about this policy, or about how your data is handled:
[privacy@cleareeg.com]
ClearEEG is an educational tool. It is not a medical device and is not intended for clinical use on real patients.