Privacy Policy

Who We Are & Regulatory Status

1.1 Corporate Identity

BrioMon is owned and operated by BrioMon Technologies LLC, a Wyoming limited liability company located at 1603 Capitol Avenue, Suite 413, Cheyenne, WY 82001, USA.

1.2 Dual Regulatory Role

1.3 Non-Clinical Standing

BrioMon is an upstream cognitive capacity management platform. It does not provide medical services, clinical diagnosis, or therapeutic treatment. Personal journal entries and pulse inputs are processed strictly for self-directed personal development and are not classified as Protected Health Information (PHI) under HIPAA.

Information We Collect

2.1 Account & Identity Data

Full name, primary email address, password hash (via secure authentication providers), company affiliation (for corporate users), role title, and chosen community display pseudonyms.

2.2 Mental Capacity Inputs (The Den)

• Daily Pulse Check: Visual slider ratings representing self-reported mental energy and subjective valence (pleasant/unpleasant).
• Mind Assessment Data: Interactive, non-clinical behavioral tap responses and reaction distributions.
• Guided Journal Entries: Freeform text reflections submitted to the Mental Capacity Assessment Engine (MCAE™) to generate contextual restorative recommendations.
• Growth Telemetry: Active habit streaks, completed practice modules, and 30-day capacity trajectory curves.

2.3 Enterprise Administration Data

Department assignments, organizational seat allocation metrics, cryptographic single-use invitation tokens, and role designations (Super Admin, Admin, Moderator).

2.4 Transactional & Financial Data

Billing address, tax jurisdiction, and payment confirmation records. Full credit card numbers and banking details are never collected or stored on BrioMon servers. Payment processing is handled externally by our Merchant of Record (MoR) partners, 2Checkout and Paddle (see Section 7).

2.5 Technical & Telemetry Data

IP address, device fingerprints, operating system type, browser user-agent, session timestamps, and diagnostic error logs.

2.6 Data We Do Not Collect

2.7 Google Sign-In & Google User Data

When you choose to sign in to BrioMon using Google Sign-In, we access basic profile information from your Google Account -- your name, email address, and profile picture -- solely to create and authenticate your BrioMon account. See Section 5 for our full Google API User Data Policy commitments.

How We Use Personal Data & Legal Bases

Under GDPR Article 6, we process personal information strictly under the following lawful bases:

3.1 Performance of a Contract (Art. 6(1)(b))

• Provisioning and maintaining your account and access to the web workspace at app.briomon.com.
• Processing subscription billings, renewals, and invoice distributions.
• Delivering the MCMP Foundation Certification course and issuing verifiable completion certificates.

3.2 Legitimate Interests (Art. 6(1)(f))

• Operating the Mental Capacity Assessment Engine (MCAE™) to analyze sentiment and match targeted performance practices to real-time cognitive friction.
• Maintaining platform stability, monitoring application performance, and preventing fraudulent access.
• Preserving verified alumni certification records so users maintain permanent access to earned credentials.

3.3 Legal Obligations (Art. 6(1)(c))

• Fulfilling statutory corporate tax reporting, accounting laws, and lawful government directives.

3.4 Consent (Art. 6(1)(a))

• Delivering non-essential product update announcements or optional communications, which can be withdrawn at any time.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects without human review.

The Corporate Anonymity Firewall

4.1 Absolute Individual Privacy

The platform enforces an architectural separation between employee workspaces and administrative dashboards. Corporate administrators, HR personnel, and leadership are strictly barred from viewing:

• Individual Daily Pulse ratings or historical scores.
• Individual Guided Journal entries or freeform text.
• Specific protocols or modules selected and practiced by a given employee.
• The true identity behind any employee post or reaction on the Community Board.

4.2 The 5-User Mathematical Floor

Workforce vitality analytics, team capacity trends, and strain indicators are aggregated and displayed only when a department or team has at least five (5) active members participating. If a team size falls below 5, data is rolled up into the general organization-wide pool to prevent reverse-engineering of individual inputs.

Google API User Data Policy Compliance

When you choose to authenticate or access BrioMon using Google Single Sign-In (OAuth), the following commitments apply:

5.1 Data Accessed

BrioMon accesses only basic Google profile information (your verified email address, full name, and avatar image) strictly to authenticate your account and provision your profile. We do not request or access any other Google data (Gmail, Drive, Calendar, or any other Google service) through this sign-in flow.

5.2 Strict Limitation of Use

• No Advertising: Google user data is never used to serve personalized, retargeted, or interest-based advertisements.
• No Data Brokering: We do not sell, rent, trade, or transfer Google user data to third parties, data brokers, or marketing networks under any circumstance.
• No Surveillance: BrioMon does not use Google user data for employee surveillance or administrative monitoring.
• Human Review Constraints: BrioMon personnel do not read or inspect user data accessed through Google APIs, except where explicitly requested by the user for technical troubleshooting, required by law, or aggregated internally for security investigations.

5.3 Retention & Google Limited Use Disclosure

Google Sign-In data is retained for as long as your BrioMon account remains active and is deleted upon account deletion (see Section 9) or on request to privacy@briomon.com. BrioMon's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies & Tracking Technologies

6.1 Strictly Necessary Cookies

BrioMon uses only strictly necessary session and authentication cookies, issued through our infrastructure provider, required to sign you in, maintain your session, and protect against cross-site request forgery (CSRF). These cannot be disabled without breaking core application functionality.

6.2 No Analytics or Marketing Trackers

BrioMon does not currently deploy analytics cookies, third-party advertising pixels, or cross-site behavioral marketing scripts (for example, Google Analytics or the Meta Pixel) on briomon.com or within the authenticated application at app.briomon.com.

6.3 Future Changes

If BrioMon introduces functional, analytics, or marketing cookies in the future, this policy will be updated in advance and, where required by law, your consent will be requested before any non-essential cookie is set. For a full list of every cookie BrioMon and its third-party providers set, see our Cookie Policy.

Data Sharing & Third-Party Processors

We do not sell personal information. We transfer data strictly to vetted service providers acting as subprocessors under formal Data Processing Agreements:

International Data Transfers

Personal data collected through BrioMon is hosted on secure cloud infrastructure located within the United States.

For data originating in the European Economic Area (EEA), United Kingdom, or Switzerland:

• Transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) under Decision (EU) 2021/914 and, for the UK, the International Data Transfer Addendum to the EU SCCs issued by the ICO.
• All data transfers incorporate mandatory technical and organizational safeguards, including end-to-end TLS 1.3 encryption and restricted role-based administrative access.

Data Retention & Erasure Schedule

9.1 Active Accounts

Personal data, pulse logs, and journal reflections remain available throughout the active duration of your subscription.

9.2 Two-Tier Post-Subscription Lifecycle

9.3 Other Retention Periods

When data is no longer required for the purposes stated in this policy, we securely delete or irreversibly anonymise it. Anonymised aggregate data, from which no individual can be identified, may be retained indefinitely for research and service improvement.

Data Security & Storage Architecture

• Encryption in Transit: TLS 1.3 for all data in transit.
• Encryption at Rest: AES-256 for all database volumes, backups, and user tables.
• Password Security: Passwords are stored using industry-standard cryptographic hashing and are never stored in plaintext.
• Access Controls: Role-based permissions restrict access to personal data on a need-to-know basis only.
• Logical Separation: Corporate client data is isolated via tenant identifier scoping, preventing cross-organization data leakage.
• Data Processing Agreements: GDPR-compliant DPAs are in place with all third-party subprocessors.
• Incident Response: In the event of a confirmed security breach involving personal data, BrioMon will notify relevant supervisory authorities and affected users within seventy-two (72) hours of verification, in accordance with GDPR Article 33.

No method of transmission or storage over the internet is 100% secure. While we use commercially reasonable measures to protect your personal data, we cannot guarantee absolute security.

Your Statutory Privacy Rights

Depending on your geographic location, you possess specific legal rights regarding your personal data. We respond to all verified requests within 30 days (EU/UK/Australia/Canada) or 45 days (US) of receipt.

11.1 Rights for All Users

11.2 GDPR & UK GDPR Rights (EEA & UK Residents)

11.3 CCPA & CPRA Rights (California Residents)

11.4 Rights — Australian & Canadian Residents

Children's Privacy

BrioMon is designed exclusively for adult professionals and working teams. The platform is not intended for individuals under 18 years of age. We do not knowingly collect, solicit, or process personal data from children. If we discover that an individual under 18 has submitted personal information, we will immediately deactivate the account and permanently delete all associated data from our servers. If you believe we have inadvertently collected data from a minor, please contact privacy@briomon.com immediately.

Contact & Supervisory Authority Details

If you have questions, feedback, or concerns regarding this Privacy Policy or our data protection practices, please contact us:

13.1 Supervisory Authorities

If you are not satisfied with our response, you have the right to complain to the supervisory authority in your jurisdiction:

13.2 How We Update This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Effective Date" and "Last Reviewed" date at the top of this policy, display a prominent notice on briomon.com for at least 30 days, and send an email notification to all registered users. Your continued use of the Services after the effective date of any updated policy constitutes your acceptance of the changes. If you do not agree with the revised policy, you may close your account by contacting privacy@briomon.com.