Last updated: 18.08.2026
This Privacy Policy explains how personal data is processed when using the M High P iOS application by neuro11 (the “App”).
1. Roles and responsibilities
The M High P App by neuro11 is used in professional sports environments and is provided by neuro11 GmbH (“neuro11”, “we”, “us”).
For data protection purposes:
- The partner or organization—for example, a sports club, academy, federation, or other organization—that uses the App (the “Customer”) is generally the data controller.
- For athlete and training-related data processed through the App on behalf of the Customer, neuro11 generally acts as a data processor and processes personal data only on behalf of and under the documented instructions of the Customer.
- Users of the App, referred to as “neuro11 brain coaches”, act as authorized users under the Customer’s authority.
- Athletes and other training participants are the data subjects.
- The App and related services are intended solely for training and performance-support purposes. They are not intended for medical diagnosis, medical treatment, healthcare use, or clinical decision-making.
neuro11 does not determine the purposes of processing athlete or participant data and does not act as controller for such data, except where explicitly described in Sections 10 and 11.
Processor
neuro11 GmbH
Heinrich-Mann-Allee 19a
14473 Potsdam
Germany
Email: legal@mhighp.com
For questions about how personal data is used, or to exercise data protection rights regarding athlete or training data, data subjects should generally contact the Customer directly.
2. What data is processed in the App
The App processes the following categories of data on behalf of the Customer.
2.1 Account and user data
For authorized users, including neuro11 brain coaches, the App may process:
- Name
- Email address
- Role and account status
- Organization or team association
- Authentication and account identifiers
This data is used to create accounts, authenticate users, manage permissions, and provide access to the App.
2.2 Athlete and training-related data
Depending on how the Customer configures and uses the App, the following data may be processed:
Athlete identifiers, such as name or internal athlete ID
Training tasks and exercise assignments
Session markers
Exercise, protocol, and sound selections
Session timestamps and related training information
Training notes (only locally on the user’s iPhone or iPad)
2.3 Session data and EEG data
When electroencephalographic recording features are used, the App may process:
- EEG or brain-signal recordings
- Derived analysis outputs generated from EEG signals
- Session markers
- Session configuration data
- Protocol settings
- Recording timestamps and duration
- Information concerning the quality or technical status of a recording
Depending on the circumstances and the information that can be inferred from it, EEG data may constitute health data or another special category of personal data under Article 9 GDPR.
EEG data is processed exclusively for the sports-performance and training purposes determined by the Customer. The App is not intended to diagnose medical or psychological conditions.
2.4 Device and technical data
To operate the App, connect supported hardware, maintain security, and diagnose technical issues, the App may process:
- Bluetooth connection information for supported EEG hardware
- Device model
- iOS version
- App version
- Technical configuration information
- Connection status
- Error messages
- App events and technical activity records
2.5 Support request information
When an authorized user contacts support through the App, the following information may be processed:
- The title of the support request
- The description entered by the user
- The user’s email address or account information
- Organization or account association
- Date and time of the request
- Communication and correspondence relating to the request
- Diagnostic logs, where the user chooses to attach them
Users should not include unnecessary athlete data, special category data, passwords, access credentials, or other confidential information in the free-text title or description fields.
2.6 Diagnostic logs
The App allows an authorized user to voluntarily attach recent diagnostic logs to a support request.
Diagnostic logs are technical records of events that occurred in the App. They are used to help neuro11 identify and resolve reported technical issues.
The diagnostic logs may contain:
- App activity and technical events, such as whether a recording was started
- Error messages, such as whether an upload failed
- Dates and timestamps
- Exercise names
- Sound names
- Device model
- iOS version
- App version and technical configuration information
- Pseudonymous account, session, device, or technical identifiers
Only diagnostic logs from the preceding three days are included.
The diagnostic logs are designed not to contain:
- Athletes’ EEG or brain-signal recordings
- Athletes’ session results or substantive training-session data
- User passwords
- Login tokens or authentication credentials
- Athlete names
- Athlete email addresses
Although the diagnostic logs are designed to exclude direct athlete information, they may still constitute personal data where they can be associated with a user, device, account, or support request.
3. Where data is stored and processed
3.1 On-device processing and storage
- EEG recordings, markers, and session files may be stored locally on the iPhone or iPad during recording and until synchronization with the cloud service has been completed.
- These files are intended to remain under the Customer’s control through the authorized user’s device and the Customer’s account.
Primary EEG signal processing during active recording occurs on the device.
Training notes remain on the authorized user’s device unless the user independently exports or otherwise shares them outside the App. neuro11 does not receive or store these notes through the App.
- Recent diagnostic-log records may also be stored temporarily on the device so that the authorized user can choose whether to attach them to a support request.
3.2 Cloud storage and service providers
neuro11 uses Supabase to provide functions including authentication, database services, and cloud storage.
The following categories of data may be stored or processed through Supabase:
- User account data
- Athlete and player identifiers
- Training configuration data
- Tasks, exercises, protocols, and sound selections
- EEG recordings
- Session markers and session files
- Derived analysis outputs
- Technical and synchronization information
Training notes are not uploaded to or stored in Supabase. They are processed and stored locally on the authorized user’s device as described in Section 3.1.
Supabase acts as a sub-processor. Its processing is governed by a data processing agreement and applicable data-transfer safeguards.
3.3 Support communications
Support requests submitted through the App, including any diagnostic logs voluntarily attached by the user, are transmitted to:
The request and attached logs may be processed through neuro11’s email, communication, hosting, or support systems and by the relevant service providers used to operate those systems.
Access is limited to personnel and service providers who require the information to investigate, manage, or resolve the support request.
4. Security measures
neuro11 applies technical and organizational measures appropriate to the nature and sensitivity of the personal data processed, including, where applicable:
- Encryption in transit
- Encryption at rest
- Platform-native secure storage
- Authentication and access controls
- Role-based authorization
- Restricted administrative access
- Technical logging and monitoring
- Data-minimization measures
- Pseudonymization where appropriate
- Procedures for managing security incidents
No technical system can be guaranteed to be completely secure. These measures are intended to reduce the risk of accidental loss, unauthorized access, alteration, disclosure, or misuse.
5. Purposes of processing
Personal data processed on behalf of the Customer is used to:
- Create and manage user accounts
- Authenticate authorized users
- Operate the App and supported EEG hardware
- Record and analyze training sessions
- Store and display training configurations
- Synchronize data between authorized devices and cloud services
- Generate and display session analysis
- Enable exports initiated by authorized users
- Maintain the security and technical stability of the App
- Identify and resolve errors
- Provide technical support requested by the Customer or its authorized users
Diagnostic logs attached to a support request are used solely to:
- Understand the reported technical problem
- Reproduce or identify the cause of the problem
- Resolve the support request
- Confirm whether a technical correction has been successful
- Protect the security and proper operation of the App
neuro11 does not use EEG data or diagnostic-log data for advertising, commercial profiling, or unrelated marketing purposes.
6. Legal basis
6.1 Processing carried out on behalf of the Customer
The Customer determines the applicable legal basis for processing athlete and participant data.
Depending on the circumstances, this may include:
- The informed and explicit consent of the athlete or, where applicable, their parent or legal guardian
- Performance of a contract
- Legitimate interests, where legally permissible
- Another applicable legal basis under Articles 6 and 9 GDPR
neuro11 processes such data solely on the Customer’s documented instructions and under the applicable data processing agreement.
6.2 Diagnostic logs and technical support
Where diagnostic logs are attached to a support request concerning the Customer’s use of the App, neuro11 generally processes those logs as a processor in order to provide contracted technical support to the Customer.
The authorized user decides whether diagnostic logs are attached. Attaching the logs is optional and is not required to submit a support request.
Where neuro11 processes support correspondence or related administrative information for its own purposes—for example, to manage its support operations, ensure system security, document compliance, or establish, exercise, or defend legal claims—neuro11 may act as an independent controller. The applicable legal basis may include:
- Performance of a contract or steps taken in connection with a contract
- Compliance with legal obligations
- neuro11’s legitimate interests in operating secure services, administering support requests, documenting its services, and protecting its legal rights
GDPR transparency information should identify the purposes, legal bases, recipients, retention arrangements and, where applicable, international transfers for controller processing.
7. Data sharing
neuro11 does not sell personal data.
Personal data may be disclosed only to:
- Sub-processors providing infrastructure, authentication, hosting, storage, communication, email, or technical-support services
- Authorized employees, contractors, or professional advisers
- The Customer and its authorized representatives
- Public authorities, courts, or regulatory bodies where disclosure is legally required
- Other recipients where the Customer has instructed or authorized the disclosure
All processing by sub-processors is subject to appropriate contractual, confidentiality, security, and data-protection requirements.
Training notes stored locally on the authorized user’s device are not disclosed by the App to neuro11’s cloud service providers.
Diagnostic logs are not shared with unrelated third parties for advertising or marketing purposes.
8. Exports and temporary files
When authorized users export session data:
- Exported files are intended to remain protected or encrypted where supported by the applicable export method.
- Temporary export files may be stored briefly within the App.
- Temporary files may be deleted automatically after successful export or synchronization.
- The authorized user and Customer are responsible for choosing an appropriate and secure export destination.
Once data has been exported from the App into a system controlled by the Customer or another recipient, further processing and protection of that exported data is the responsibility of the Customer or the relevant recipient.
9. Diagnostic-log sharing controls
Sharing diagnostic logs is optional.
Before submitting a support request, the authorized user can enable or disable the diagnostic-log attachment option.
If the option is disabled:
- No diagnostic logs are attached to the support request.
- The title, description, and other information necessary to submit and manage the request may still be transmitted.
If the option is enabled:
- Diagnostic logs from the preceding three days are attached to the support request.
- The logs are sent together with the request information to neuro11 support.
- The logs are used solely to investigate and resolve the reported issue and for closely related security or compliance purposes.
The setting applies to the relevant support request and does not constitute general authorization for neuro11 to collect or transmit future diagnostic logs independently of a support request.
10. Retention and deletion
Personal data is retained only for as long as required for the relevant purpose, the Customer’s instructions, contractual requirements, and applicable legal obligations.
In particular:
- App, athlete, EEG, and session data is retained in accordance with the Customer’s instructions and the applicable contract or data processing agreement.
- Local temporary files may be deleted after successful synchronization or export.
- Diagnostic logs available for attachment through the App are limited to the preceding three days.
- Diagnostic logs submitted with a support request are retained only for as long as reasonably necessary to investigate, document, and resolve the request.
- Support correspondence may be retained for an appropriate period to manage follow-up questions, demonstrate contractual performance, maintain security, and establish, exercise, or defend legal claims.
- Data may be retained for longer where required by applicable law or where necessary in connection with an unresolved dispute or security incident.
Training notes stored locally on the authorized user’s device are not subject to neuro11’s cloud retention periods because they are not uploaded to neuro11’s cloud infrastructure. Their retention depends on the App’s local storage functionality, the Customer’s instructions, and actions taken on the device, such as deletion of the relevant data, App, or device.
Where neuro11 acts as a processor, data will be deleted or returned in accordance with the Customer’s instructions and the applicable data processing agreement.
The GDPR requires retention to be limited to what is necessary and requires controllers to establish appropriate deletion or review periods.
11. neuro11 as independent controller
Where neuro11 processes athlete, EEG, session, and related training data in connection with the Customer’s independent use of the App and related training system, neuro11 generally processes such data solely on behalf of the Customer.
In those circumstances, the Customer remains the controller and neuro11 acts as processor.
However, neuro11 may act as an independent controller in the following circumstances.
11.1 Professional Services
neuro11 may provide its own professional services directly to athletes, teams, organizations, or other customers, including:
- Brain training
- Performance analysis
- Consulting
- Onboarding
- Evaluation
- Technical or professional support
- Training-system implementation
- Other service engagements
Where neuro11 determines the purposes and essential means of processing personal data in connection with these Professional Services, neuro11 acts as an independent data controller for that processing.
This independent controller role applies only to data processed in connection with neuro11’s own Professional Services. It does not arise merely because a Customer uses the App, EEG hardware, or the M High P training system.
11.2 Support administration, security, and legal compliance
neuro11 may also act as an independent controller for limited processing necessary to:
- Receive and administer support communications
- Manage relationships with Customer representatives and authorized users
- Maintain the security and integrity of its services
- Detect abuse, fraud, or security incidents
- Document compliance and service performance
- Meet legal and regulatory obligations
- Establish, exercise, or defend legal claims
Where neuro11 acts as an independent controller, data subjects may contact neuro11 at:
12. Data subject rights
Depending on the applicable law, data subjects may have rights including:
- Access to their personal data
- Rectification of inaccurate or incomplete personal data
- Erasure of personal data
- Restriction of processing
- Objection to processing
- Data portability
- Withdrawal of consent, where processing is based on consent
- The right to lodge a complaint with a competent supervisory authority
Where the Customer is the controller, requests concerning athlete, EEG, session, or training data should generally be directed to the Customer.
neuro11 will assist the Customer in responding to such requests as required under the applicable data processing agreement and data protection law.
Where neuro11 acts as an independent controller, requests may be sent directly to:
13. Children and minors
The App is intended to be operated by adult professional users.
Where minors participate in training programs, the Customer is responsible for:
- Determining an appropriate legal basis
- Providing the required privacy information
- Obtaining valid parental or guardian consent where required
- Ensuring that the processing is appropriate for the age and circumstances of the participant
- Implementing appropriate safeguards for the minor’s data
Authorized users should avoid entering unnecessary information about minors into support-request descriptions.
14. International data transfers
Where personal data is processed outside the European Union or European Economic Area, neuro11 and its service providers use appropriate safeguards where required.
These safeguards may include:
- An adequacy decision adopted by the European Commission
- Standard Contractual Clauses approved by the European Commission
- Additional technical, contractual, or organizational safeguards
- Another legally recognized transfer mechanism
Information about applicable safeguards may be requested by contacting legal@mhighp.com.
15. Complaints and supervisory authority
Data subjects have the right to lodge a complaint with a competent data protection supervisory authority.
Where the Customer acts as controller, the competent supervisory authority may depend on the Customer’s establishment and the relevant processing activity.
For processing for which neuro11 acts as an independent controller, the supervisory authority responsible for neuro11’s establishment is generally:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Data subjects may also contact the supervisory authority in the EU or EEA Member State of their habitual residence, place of work, or the place of the alleged infringement, where applicable.
16. Changes to this policy
We may update this Privacy Policy from time to time, including where:
- App functionality changes
- New service providers are introduced
- Processing activities change
- Legal or regulatory requirements change
Material changes will be communicated through reasonable means, such as an in-app notice or communication to the Customer.
The “Last updated” date indicates the most recent revision.
17. Contact
For questions about this Privacy Policy or neuro11’s role as processor or independent controller:
neuro11 GmbH
Heinrich-Mann-Allee 19a
14473 Potsdam
Germany
Email: legal@mhighp.com
For technical support:
Email: support@mhighp.com
For questions concerning the Customer’s use of athlete, EEG, session, or training data—or to exercise rights concerning such data—data subjects should generally contact the Customer directly.