Privacy Policy

NeuRafiki collects account information (name, email), profile information for each person you assess (which may include a child or other dependant you are the parent or guardian of), and your responses to self-assessment screening questions across domains such as autism spectrum, ADHD, dyslexia, dyspraxia, sensory processing, and executive function.

Because this platform is used to screen for neurodivergence in both adults and children, some of the data we store is about minors and is inherently sensitive. We only collect a child's assessment data with the explicit, revocable consent of their parent or legal guardian, captured immediately before the assessment begins.

Assessment responses and results are encrypted at rest using PostgreSQL's pgcrypto extension. Only our server-side API, using a service-role database connection, can request decrypted values through a restricted database function -- your browser and any client-side code never has direct access to the encryption key or to plaintext responses.

Row-level security policies restrict every account to its own data. Score computation happens server-side so that assessment results cannot be tampered with by modifying requests from the browser.

We retain assessment data for as long as your account is active, or until you request deletion. You (or, for a child profile, their parent/guardian) may revoke consent at any time, which stops further use of that data for active screening purposes. Revoking consent does not by itself delete historical records needed for legal or safety obligations, but you may separately request full deletion.

You may request access to, correction of, or deletion of any data associated with your account or a profile you manage, including a child's profile, at any time.

To exercise these rights or ask a question about this policy, contact us at privacy@neurafiki.org.