Iberbrain Platform
Privacy Policy
Privacy Policy — Iberbrain Platform
Version 1.0
Effective Date: August 2026
Last Updated: August 15, 2026
The use of the Iberbrain Platform is subject to the reading and acceptance of this Privacy Policy.
This Privacy Policy should be read together with the Terms and Conditions and the Cookie Policy of the Iberbrain Platform. Further information regarding Cookies and Similar Technologies is available in the Iberbrain Platform Cookie Policy.
1. Introduction
Protecting the privacy and personal data of users is a fundamental commitment of the Iberbrain Platform.
This Privacy Policy explains how personal data is collected, used, stored, shared, protected and otherwise processed when users access and use the Iberbrain Platform, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and all other applicable data protection legislation.
The Iberbrain Platform is an independent digital platform designed to provide cognitive stimulation exercises, movement-based learning, rhythmic coordination, creativity, educational activities and wellbeing programmes through interactive exercises.
The Platform incorporates exercises and activities inspired by the Ronnie Gardiner Method® (RGM) together with proprietary programmes, complementary methodologies and other cognitive training approaches developed for educational, recreational and wellbeing purposes.
The Iberbrain Platform is intended exclusively for educational, cognitive training and wellbeing purposes.
The Iberbrain Platform is not a medical device, does not provide medical advice and does not replace professional medical assessment, diagnosis, treatment, rehabilitation, psychological evaluation or any healthcare service provided by qualified professionals. The Platform does not perform clinical assessments, diagnose diseases, monitor users' health conditions or provide therapeutic recommendations.
By creating an account, accessing or using the Iberbrain Platform, users acknowledge that they have read, understood and accepted this Privacy Policy.
2. Data Controller
The Data Controller responsible for the processing of personal data through the Iberbrain Platform is:
Susana Coutinho - Founder, Creator and Data Controller of the Iberbrain Platform
Operational Location: Maastricht, Limburg, the Netherlands
Email Address: iberbrain@gmail.com
Website: https://iberbrain.com
The Data Controller determines the purposes and means of processing personal data collected through the Iberbrain Platform and ensures that such processing complies with the GDPR and all applicable legislation.
As the Iberbrain Platform evolves, the identity of the Data Controller may be updated to reflect future organisational or legal changes. Any such changes will be communicated through an updated version of this Privacy Policy.
3. Scope of this Privacy Policy
This Privacy Policy applies to all personal data processed through the Iberbrain Platform, including:
• the Iberbrain web application;
• future mobile applications;
• future desktop applications;
• institutional and business (B2B) versions of the Platform;
• official websites directly related to the Iberbrain Platform;
• user support services;
• authentication services;
• communications relating to the Platform;
• educational, institutional and enterprise implementations of the Platform.
This Privacy Policy also applies whenever users contact the Iberbrain Platform regarding their account, subscription, technical support or any other Platform-related service.
This Privacy Policy does not apply to third-party websites, platforms or services that may be accessible through external links or embedded content provided within the Iberbrain Platform. Users are encouraged to review the privacy policies of such third parties before using their services.
4. Personal Data We Collect
The Iberbrain Platform follows the principle of data minimisation and collects only the personal data necessary to provide its services, ensure Platform security and comply with applicable legal obligations.
Depending on how the Platform is used, the following categories of personal data may be processed.
4.1 Identification Data
The Iberbrain Platform may collect:
• full name;
• preferred name or pseudonym;
• email address.
These data are used to identify users, manage their accounts and enable secure access to the Platform.
4.2 Authentication Data
Since user accounts are created manually by the Platform administrator, the following authentication-related information may be processed:
• registered email address;
• one-time verification codes sent by email;
• authentication records;
• login history;
• successful and unsuccessful authentication attempts.
Institutional customers may choose to use pseudonymised or anonymised user identifiers and email addresses, whenever appropriate and permitted by applicable law, in order to further minimise the processing of personal data.
Authentication data are processed exclusively to ensure Platform security and protect user accounts.
4.3 Exercise and Progress Data
To ensure continuity of the user experience, the Iberbrain Platform may store information such as:
• completed exercises;
• favourite exercises;
• exercise history;
• user progress;
• last completed activity;
• duration of practice sessions;
• total usage time;
• assigned exercise modules;
• permissions and access levels.
These data allow users to continue their activities without losing their progress and enable the Platform to provide a personalised learning experience.
Anonymous or aggregated usage statistics may also be generated to improve the Platform, monitor service performance and support the ongoing development of educational content.
4.4 Technical Data
The Platform may automatically process certain technical information required for its proper operation, including:
• browser type;
• operating system;
• device type;
• preferred language;
• time zone;
• date and time of access;
• application version;
• technical information necessary to ensure compatibility, security and service availability.
These technical data are processed solely to maintain the secure and reliable operation of the Platform.
4.5 Security Logs
To protect the Iberbrain Platform against misuse, fraud and unauthorised access, the Platform may maintain security logs, including:
• authentication events;
• failed login attempts;
• technical error logs;
• security monitoring records;
• system diagnostic information.
These logs are processed exclusively for cybersecurity, fraud prevention, incident investigation, system integrity and legal compliance purposes.
5. Health Data
Although the Iberbrain Platform provides cognitive stimulation, movement coordination, rhythmic learning and creativity exercises, it does not intentionally process special categories of personal data concerning health, as defined in Article 9 of the GDPR, unless explicitly required by applicable law or voluntarily provided by the user in the context of a support request.
In particular, the Iberbrain Platform does not collect or process:
• medical diagnoses;
• clinical records;
• symptoms;
• treatment plans;
• rehabilitation reports;
• psychological assessments;
• biometric data;
• genetic data;
• health monitoring data.
The Platform does not create medical profiles, assess users' physical or mental health, predict illnesses or support clinical decision-making.
Information relating to completed exercises, usage history and user progress is processed solely to provide the requested services, improve the user experience, ensure continuity of educational activities and support the normal operation of the Iberbrain Platform.
Where the Iberbrain Platform is used by schools, healthcare organisations, care homes, companies or other institutions, those organisations remain responsible for ensuring that they have an appropriate legal basis for providing users' personal data to the Iberbrain Platform and for complying with their own legal obligations under applicable data protection legislation.
6. Purposes of Processing
The Iberbrain Platform processes personal data solely for legitimate, specific and clearly defined purposes.
Personal data may be processed for the following purposes:
• creating, managing and administering user accounts;
• providing secure authentication and controlled access to the Platform;
• assigning exercise modules, permissions and user access levels;
• delivering cognitive training, educational and wellbeing services;
• maintaining users' exercise history and learning progress;
• ensuring continuity of the user experience across sessions and devices;
• providing embedded multimedia content required for Platform exercises;
• delivering audio files and other educational resources hosted by the Platform;
• responding to user enquiries and technical support requests;
• ensuring the security, integrity and availability of the Platform;
• detecting, preventing and investigating fraud, account sharing, misuse of the Platform and other security incidents;
• maintaining business continuity and operational resilience;
• complying with legal and regulatory obligations;
• maintaining internal administrative records;
• continuously improving the quality, reliability, accessibility and performance of the Iberbrain Platform.
The Iberbrain Platform processes only the personal data that are necessary for these purposes. Personal data will never be processed for purposes that are incompatible with those described in this Privacy Policy.
7. Legal Basis for Processing
The Iberbrain Platform processes personal data in accordance with Article 6 of the General Data Protection Regulation (GDPR). Depending on the specific processing activity, one or more of the following legal bases may apply.
7.1 Performance of a Contract
Article 6(1)(b) GDPR
Processing is necessary to provide the services requested by the user, including:
• creating and managing user accounts;
• providing access to authorised Platform features;
• maintaining users' exercise history and learning progress;
• delivering educational, cognitive training and wellbeing services.
7.2 Compliance with a Legal Obligation
Article 6(1)(c) GDPR
Certain personal data may be processed where necessary to comply with applicable legal obligations, including:
• administrative and accounting obligations;
• statutory reporting requirements;
• cooperation with competent public authorities;
• cybersecurity obligations where required by law.
7.3 Legitimate Interests
Article 6(1)(f) GDPR
The Iberbrain Platform has legitimate interests in processing personal data for the purposes of:
• protecting the security of the Platform;
• preventing fraud, account sharing and misuse;
• investigating technical incidents;
• ensuring system integrity and operational resilience;
• maintaining business continuity;
• improving the quality and performance of the Platform;
• protecting the rights, property and legitimate interests of users and of the Iberbrain Platform.
Whenever processing is based on legitimate interests, an appropriate balancing assessment is performed to ensure that such interests do not override the fundamental rights and freedoms of users.
7.4 Consent
Article 6(1)(a) GDPR
Where required by law, the Iberbrain Platform will obtain the user's freely given, specific, informed and unambiguous consent before processing personal data. Consent may be requested for, among other things:
• non-essential cookies and similar technologies;
• optional analytics services that may be introduced in future versions;
• optional communications;
• future Platform functionalities requiring consent under applicable legislation.
Users may withdraw their consent at any time without affecting the lawfulness of processing carried out before such withdrawal.
8. User Accounts and Authentication
The Iberbrain Platform operates through a controlled-access authentication system. User accounts are created manually by the Platform administrator. Users cannot create accounts through a public self-registration process. Access may be granted following a request submitted by email or other communication channel, or at the discretion of the Platform administrator.
Once an account has been created, users authenticate through one-time verification codes sent to their registered email address.
Each verification code:
• is generated individually for each user;
• may only be used once;
• has a limited period of validity;
• expires automatically after a short period;
• becomes immediately invalid once authentication has been successfully completed.
The Iberbrain Platform does not require users to create or remember passwords. This passwordless authentication model reduces security risks associated with traditional passwords while improving accessibility and ease of use.
Institutional customers, including schools, care organisations, healthcare institutions, companies and other organisations, are encouraged, where appropriate, to assign pseudonymised user identities or email addresses in order to minimise the processing of directly identifiable personal data.
Authentication logs may be retained for security monitoring, fraud prevention, incident investigation and legal compliance.
9. Third-Party Integrated Services
To support cognitive training exercises and educational activities, the Iberbrain Platform integrates multimedia services provided by trusted third parties. These services may include YouTube and Vimeo.
9.1 YouTube Embedded Player
Certain exercises incorporate videos hosted exclusively on YouTube. The Iberbrain Platform displays these videos solely through the official YouTube Embedded Player.
Where synchronisation between Platform exercises and video playback is required, this is performed exclusively through the official YouTube IFrame Player API.
The Iberbrain Platform does not download, copy, modify, extract, distribute or host YouTube videos. Whenever available, users may access the original content directly on YouTube.
When users interact with embedded YouTube content, their browser may establish a direct connection with YouTube servers. By using these features, users acknowledge that the Iberbrain Platform utilizes YouTube API Services. Users further acknowledge that their interaction with the embedded YouTube player is subject to Google's Privacy Policy, Google's Cookie Policy, and the YouTube Terms of Service, and by using such features they agree to be bound by them. Any personal data processed by YouTube are governed exclusively by YouTube's own Privacy Policy, Terms of Service and Cookie Policy.
9.2 Vimeo
The Iberbrain Platform may also display educational or instructional videos hosted on Vimeo. These videos remain entirely hosted and managed by Vimeo.
Any personal data processed by Vimeo are governed exclusively by Vimeo's own Privacy Policy and applicable legal documentation.
The Iberbrain Platform neither controls nor assumes responsibility for the processing of personal data carried out independently by these third-party providers.
10. Audio Files Hosted by the Iberbrain Platform
In addition to embedded multimedia content, the Iberbrain Platform provides proprietary audio files specifically developed for educational activities, cognitive training and wellbeing exercises.
These audio resources are hosted directly within the secure infrastructure of the Iberbrain Platform.
Unlike embedded third-party video services, playback of Platform-hosted audio files does not require communication with external multimedia providers.
Where technically necessary, only the minimum technical information required to deliver the requested audio content, ensure service quality and maintain Platform security will be processed.
The Iberbrain Platform remains responsible for the processing of personal data associated with the delivery of its own hosted audio content in accordance with this Privacy Policy.
11. Data Storage and Security
The Iberbrain Platform is committed to protecting the confidentiality, integrity and availability of the personal data entrusted to it.
Appropriate technical and organisational measures are implemented to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
These measures include, among others:
• encrypted communications using HTTPS/TLS;
• hosting on secure technological infrastructures;
• role-based access controls;
• application of the principle of least privilege for authorised personnel;
• authentication through one-time verification codes sent by email;
• continuous monitoring of security-related events;
• regular updating of systems, applications and security components;
• vulnerability management and ongoing security hardening;
• secure backup and recovery procedures;
• audit and diagnostic logging where necessary;
• documented procedures for detecting, managing and responding to security incidents;
• measures designed to maintain business continuity and operational resilience.
Access to personal data is granted only to authorised individuals who require such access for the performance of their duties. Where third-party service providers process personal data on behalf of the Iberbrain Platform, they are contractually required to implement appropriate technical and organisational security measures consistent with the GDPR.
Security measures are periodically reviewed and updated to reflect technological developments, evolving cybersecurity risks and applicable legal requirements.
Although reasonable efforts are made to safeguard personal data, no electronic system or Internet-based service can guarantee absolute security. Users acknowledge that a limited residual level of risk is inherent in all digital services.
12. Data Retention
The Iberbrain Platform retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy or to comply with applicable legal obligations.
As a general rule:
• account information is retained while the user's account remains active;
• exercise history and learning progress are retained while necessary to ensure continuity of the user experience;
• authentication and security logs are retained only for as long as reasonably necessary for security monitoring, fraud prevention, incident investigation and legal compliance;
• technical diagnostic logs are retained only for operational and security purposes.
Where a user requests deletion of an account:
• the account will be marked for deletion;
• personal data will be removed from active operational systems within a reasonable period;
• a limited grace period may be provided, where technically feasible, to allow recovery of accounts deleted by mistake;
• backup copies containing personal data will be securely overwritten or deleted during the Platform's normal backup retention cycle.
• backup data are protected by the same security standards applied to production systems.
Certain information may be retained for longer periods where required to comply with legal obligations, resolve disputes, enforce legal rights or protect the security and integrity of the Iberbrain Platform.
13. Sharing of Personal Data
The Iberbrain Platform does not sell, rent or commercially exploit users' personal data.
Personal data are shared only where necessary for the operation of the Platform, the provision of requested services or compliance with legal obligations.
Depending on the services provided, personal data may be shared with carefully selected service providers, including:
• hosting and cloud infrastructure providers;
• email delivery service providers;
• technical maintenance and support providers;
• cybersecurity service providers;
• backup and disaster recovery providers;
• competent public authorities where disclosure is required by law.
Where service providers process personal data on behalf of the Iberbrain Platform, such processing is carried out under written Data Processing Agreements (DPAs) or equivalent contractual arrangements, as required by Article 28 of the GDPR.
All processors are contractually bound by confidentiality obligations and are required to implement appropriate technical and organisational measures to protect personal data. The Iberbrain Platform remains responsible for ensuring that processors provide sufficient guarantees regarding GDPR compliance.
Where the Iberbrain Platform is used by educational institutions, healthcare organisations, care homes, companies or other institutional customers, those organisations remain independently responsible for ensuring that they have an appropriate legal basis for providing personal data relating to their own users, students, residents, employees or other authorised individuals.
14. International Data Transfers
Personal data are primarily stored within the European Economic Area (EEA).
Where a service provider transfers or processes personal data outside the EEA, such transfers shall occur only where appropriate safeguards exist under the GDPR.
These safeguards may include:
• an adequacy decision adopted by the European Commission;
• the Standard Contractual Clauses (SCCs) approved by the European Commission;
• another lawful transfer mechanism recognised under applicable data protection legislation.
The Iberbrain Platform takes reasonable measures to ensure that international transfers provide a level of protection that is essentially equivalent to that guaranteed within the European Union.
15. User Rights and How to Exercise Them
Subject to applicable legislation, users of the Iberbrain Platform may exercise the following rights regarding their personal data:
• the right of access;
• the right to rectification;
• the right to erasure (“right to be forgotten”);
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent at any time where processing is based on consent;
• the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
Users may exercise these rights at any time by contacting the Iberbrain Platform using the contact details provided in this Privacy Policy.
Requests may relate to, among other matters: access to personal data; correction of inaccurate or incomplete personal data; deletion of personal data; restriction of processing; objection to processing; data portability; and withdrawal of consent where processing is based on consent.
The exercise of these rights may be subject to limitations or exceptions provided by applicable legislation.
To protect users’ personal data, the Iberbrain Platform may request additional information necessary to verify the identity of the person submitting the request before processing it, where there are reasonable doubts regarding that person's identity.
Requests will be handled without undue delay and within the time limits established by the GDPR, unless an extension is permitted due to the complexity or number of requests. Where a request cannot be fully satisfied because of legal obligations, overriding legitimate interests or other legal restrictions, the user will be informed accordingly unless prohibited by applicable law.
Users also have the right to lodge a complaint with the competent supervisory authority if they believe that the processing of their personal data infringes applicable data protection legislation.
16. Personal Data Breaches
The Iberbrain Platform maintains procedures to identify, assess, manage and respond to personal data breaches.
Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the Iberbrain Platform will comply with the obligations established by Articles 33 and 34 of the GDPR, including, where applicable:
• recording and documenting the incident;
• containing and mitigating its effects;
• notifying the competent supervisory authority without undue delay and, where required, within 72 hours of becoming aware of the breach;
• notifying affected users where the breach is likely to result in a high risk to their rights and freedoms;
• implementing corrective measures designed to reduce the likelihood of similar incidents occurring in the future.
The Iberbrain Platform continuously reviews and improves its security measures based on operational experience, evolving cybersecurity threats and recognised best practices.
17. Automated Decision-Making
The Iberbrain Platform does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning users or similarly significantly affect them within the meaning of Article 22 of the GDPR.
Information relating to exercise history, user progress, learning activities and Platform usage is processed solely to:
• maintain continuity of the user experience;
• provide the requested services;
• improve Platform performance;
• manage authorised access;
• ensure the normal operation and security of the Iberbrain Platform.
Should the Iberbrain Platform introduce future functionalities involving automated decision-making or profiling, this Privacy Policy will be updated accordingly, and all applicable legal requirements, including prior user consent where required, will be fully respected.
18. Artificial Intelligence and Future Technologies
The Iberbrain Platform may incorporate future functionalities based on Artificial Intelligence (AI) or other advanced digital technologies to improve cognitive training, educational content, user assistance, accessibility and other Platform services.
Any processing of personal data through AI-based functionalities will be carried out in accordance with:
• the General Data Protection Regulation (GDPR);
• applicable national legislation;
• the European Artificial Intelligence Act (AI Act), where applicable.
The Iberbrain Platform is committed to ensuring that future AI systems are developed and deployed in accordance with the principles of:
• lawfulness;
• fairness;
• transparency;
• human oversight;
• privacy by design;
• privacy by default;
• data minimisation;
• security;
• accountability.
Where future AI functionalities require additional processing of personal data or materially affect users, this Privacy Policy will be updated before such functionalities become available, and users’ consent will be obtained whenever required by law.
19. Children's Privacy
The Iberbrain Platform may be used within educational institutions, schools, care organisations or other supervised learning environments. Where minors are authorised to use the Platform, access shall occur under the responsibility and supervision of parents, legal guardians, educational institutions or other legally authorised organisations, as required by applicable legislation.
The Iberbrain Platform does not knowingly collect personal data from children where parental or legal guardian consent is required and has not been validly obtained.
If the Iberbrain Platform becomes aware that personal data relating to a child have been collected in violation of applicable legislation, reasonable steps will be taken to delete such information as soon as reasonably practicable.
20. Changes to this Privacy Policy
The Iberbrain Platform may update this Privacy Policy whenever necessary to reflect:
• changes in applicable legislation;
• technological developments;
• new Platform functionalities;
• modifications to data processing activities;
• improvements to security measures;
• organisational changes affecting the operation of the Platform.
Where changes materially affect users’ rights or the processing of personal data, users will be informed through appropriate communication channels, including the Platform itself or by email where appropriate.
The date of the latest update will always appear at the beginning of this Privacy Policy.
Continued use of the Iberbrain Platform following the entry into force of an updated version of this Privacy Policy constitutes acknowledgement of the revised Policy, except where applicable law requires renewed consent.
21. Contact
For any questions regarding this Privacy Policy or the processing of personal data carried out by the Iberbrain Platform, please contact:
Susana Coutinho - Founder, Creator and Data Controller of the Iberbrain project
Operational Location: Maastricht, Limburg, the Netherlands
Email address: iberbrain@gmail.com
Website: https://www.iberbrain.com
The Iberbrain Platform will make every reasonable effort to respond promptly to enquiries relating to privacy and personal data protection.
Users also have the right to lodge a complaint with the competent data protection supervisory authority in their country of residence or in the country where they believe an infringement of applicable data protection legislation has occurred.
© 2026 Iberbrain. All rights reserved.
Legal Notice
This Privacy Policy – Version 1.0 - has been prepared in accordance with the General Data Protection Regulation (GDPR) and reflects current best practices in privacy governance, information security and digital service management.
The Policy has been specifically adapted to the operational model of the Iberbrain Platform, including passwordless authentication through one-time email verification codes, embedded multimedia services (YouTube and Vimeo), Platform-hosted audio resources, institutional (B2B) implementations, and future Artificial Intelligence functionalities.
This English version serves as the master reference version for the corresponding official translations into Portuguese, Spanish, Dutch, French and German. In the event of linguistic inconsistencies, each translated version shall be interpreted consistently with the applicable legislation of the jurisdiction in which it is published.