Privacy Policy
How RedWave collects, stores, uses, and deletes your information
RedWave Recovery LLC · 799 Concord Avenue, Cambridge, MA 02138
Effective Date: August 2026· Version 1.0
THE SHORT VERSION. We hold your booking details, what you told us at intake, your brain recording, and your report. Your recording lives in two places: the WAVi system in our room, and RedWave’s own records. We do not sell your data, we never let advertisers near your results, we never enroll you in anyone else’s research, and no physician or other clinician ever sees it— because we do not have one. We do advertise our own business and we do study our own anonymised numbers; Sections 10 and 11 explain exactly how, and how to opt out. We keep it for three years so a later session can be compared to your earlier ones, and we delete it sooner if you ask. The rest of this document is the detail.
1. Introduction
This Privacy Policy explains how RedWave Recovery LLC ("RedWave," "we," "us," or "our"), a Massachusetts limited liability company, collects, uses, stores, shares, protects, and deletes personal information in connection with the non-clinical brain performance measurement services we provide at 799 Concord Avenue, Cambridge, Massachusetts, and through our website, booking tools, and intake forms (together, the "Services").
This Policy applies together with our Terms & Conditions and is incorporated into them. Where this Policy and the Terms conflict on a privacy matter, this Policy governs. By booking or using the Services you accept this Policy.
2. Who We Are, and What We Are Not
RedWave is an independently owned and operated non-clinical wellness and performance business. RedWave is not a healthcare provider, is not a covered entity under HIPAA, and does not provide or bill for medical services. No physician, nurse practitioner, psychologist, or other licensed healthcare professional is employed by, contracted to, supervises, or has any involvement in the Services at any stage.
This matters for your privacy in a specific way: no clinician ever reviews, reads, or interprets your recording, because there is no clinician. Records we hold are business records of a measurement service. They are not medical records, not an electronic health record, and not a clinical file.
RedWave operates equipment manufactured by WAVi Co., a Colorado company. WAVi is a trademark of WAVi Co. RedWave is not affiliated with, endorsed by, or acting on behalf of WAVi Co. Section 5 explains exactly what this means for where your data is stored.
3. Key Definitions
Personal Information — information that identifies, relates to, or can reasonably be linked to you.
Measurement Data — the electrical recording taken from the surface of your scalp, the values derived from it, your responses to the two reaction tasks, and your written report.
Intake Context — what you tell us before a session, such as hours since caffeine, sleep the previous night, and the time of day, which is printed alongside your measurements.
De-Identified Data — information from which identifiers have been removed and which we do not attempt to re-associate with you.
Reference Sample — the pooled, de-identified set of measurements from RedWave clients, grouped in age bands, used to calculate the percentiles on reports.
4. Information We Collect
Identifiers. Name, email address, telephone number, date of birth or age band, and booking records — collected to schedule your session, communicate with you, and verify that you are 18 or over.
Measurement Data. Your scalp recording, the five measurements derived from it, your reaction-task responses, and your report. This is the most sensitive information we hold, and it is treated accordingly.
Intake Context. Sleep, caffeine, nicotine and alcohol timing, medication you choose to disclose, hair condition, and time of day. We collect this because a measurement without context is misleading, not because we assess it clinically. We do not ask for, and ask you not to provide, a medical history, diagnosis, or list of conditions.
Payment information. Payments are processed by a third-party payment processor. We do not collect or store your full card number or payment credentials. We retain limited transaction records — name, amount, date, and a confirmation reference — for accounting and tax purposes.
Communications. Records of your emails, text messages, calls, and support requests with us, and your marketing preferences.
Website and technical data. Device and browser type, IP address, approximate location derived from IP, pages viewed, and referring source. We do not use session-replay or keystroke-logging tools.
Premises. Check-in records. RedWave does not record audio or video of your session at any time. Where any security camera is in use in a common area, notice is posted at the premises and no audio is captured.
What we do not collect. We do not collect your Social Security number, insurance details, medical records, genetic information, or biometric identifiers used for identification such as fingerprints or facial geometry.
5. Where Your Information Is Stored
Please read this Section carefully. Your Measurement Data is held in two separate places.
(a) The WAVi system at our location. The WAVi Scan system is designed by its manufacturer for stand-alone use. Your recording, the values derived from it, and the profile created for you are stored locally, on the WAVi base station computer in our room. That computer is kept on our premises, is access-controlled, and is not made available for general use. The manufacturer’s instructions require that information stored on the system computer be safeguarded appropriately, and we treat that as a minimum rather than a ceiling.
(b) RedWave’s own records. We separately retain a copy of your report, your measurements, your Intake Context, and your booking and communication history in RedWave’s own access-controlled records, so that a later session can be compared against your earlier ones and so that we can respond to you if you ask for a copy or a deletion.
(c) The manufacturer, and the limits of what we control. WAVi Co. manufactures and supports the equipment, which RedWave operates under a licence agreement with WAVi Co. That agreement governs rights in the underlying data, and RedWave does not control WAVi Co. or its practices. We are telling you this plainly rather than promising you something we cannot verify. WAVi Co. is not given routine or standing access to your information by us. Where a fault requires manufacturer technical support, a WAVi technician may need access to the system in order to resolve it; we limit any such access to what is necessary for the specific issue and supervise it. If you want to understand WAVi Co.’s own data practices, you should contact WAVi Co. directly.
(d) Research — what we do and do not do. The WAVi software includes an optional facility by which a client’s data may be contributed to WAVi Co.’s research, which requires a separate consent form (described in the manufacturer’s manual as a "WAVi IRB Consent Form") to be signed by the client. RedWave does not use that facility. We do not present that consent form to you, we do not complete it, and we do not enrol you in any research study.
We commit to this: RedWave will not consent on your behalf to any research use of your data, ever. If we were ever asked to participate in research, we would put the request to you directly and separately, and you would be free to decline with no effect whatsoever on your Services or their price. We do not, however, represent what rights the manufacturer may hold under our licence agreement or what it may do with data under its own policies, and you should not read this Policy as a promise on WAVi Co.’s behalf.
(e) Exports. The WAVi software can export a recording in standard formats. We export only when you ask us for your own file, or where it is necessary to move your data into our own records. Where a file is shared outside RedWave at your request, we use the software’s option to omit identifying details from the standard report elements where that is appropriate. Note that this option does not remove free-text entries, so we keep free-text notes to a minimum.
Location of storage. All storage is within the United States.
6. How We Use Your Information
To schedule, deliver, and follow up on your session;
To produce your report and print your Intake Context alongside your measurements;
To compare a later session against your earlier ones, at your request;
To calculate percentile positions against our de-identified Reference Sample;
To take payment and keep accounting and tax records;
To send you service messages, and marketing messages where you have opted in;
To promote RedWave, measure whether our advertising works, and reach people who have visited our public website, within the limits set out in Section 11;
To analyse, improve, and publish findings about our own service, in de-identified and aggregated form only, as set out in Section 10;
To maintain the security of our premises, equipment, and records;
To improve our session protocol and written materials, using de-identified information;
To comply with law and to establish, exercise, or defend legal claims.
We do not use your Measurement Data to make any decision about you, we do not profile you, and we never use it for advertising. We do not use automated decision-making that produces legal or similarly significant effects.
7. How We Share Your Information
We share personal information only as follows:
With service providers who act on our instructions and are bound to confidentiality — our booking and customer-communication platform, website host, payment processor, email provider, and accountant. They may process your information only to provide their service to us.
With the equipment manufacturer, only in the limited support circumstances described in Section 5.
With people you direct us to, such as when you ask us to send your report to an address you give us.
Where required by law, including a valid subpoena, court order, or lawful request, or where necessary to protect the safety of any person.
In connection with a business transfer, such as a merger or sale of substantially all assets, in which case the recipient is bound by this Policy or gives you notice and a choice.
What we never do. We do not sell your personal information. We never disclose your Measurement Data, Intake Context, report, or results to advertisers, data brokers, insurers, or employers. We never use them to target advertising. We do not geofence you. We do not enrol you in third-party research. We have never done any of these things and this Policy commits us not to. These commitments are ours; they bind RedWave and the service providers we instruct, and they are not representations about the practices of the equipment manufacturer, whose role is described in Section 5.
8. Consumer Health Data
Your Measurement Data and Intake Context may qualify as Consumer Health Data under certain state laws even though we are not a healthcare provider. We collect it only to deliver the Services you asked for, and where applicable law requires consent, we obtain it.
We will not share or sell Consumer Health Data in a form that identifies you without your separate written authorisation. Where you reside in a state with a specific consumer-health-data statute — for example Washington’s My Health My Data Act or Nevada SB 370 — the rights under that law apply to you, and you may exercise them using the contact details in Section 22.
9. The Reference Sample
The percentiles printed on your report are calculated against RedWave’s own Reference Sample. Your measurements are added to it in de-identified, aggregated form only, grouped by age band, and never with your name, contact details, or any identifier attached. No person can be picked out of the Reference Sample, and we do not attempt to re-identify it.
You may ask us to exclude your measurements from the Reference Sample by writing to info@redwavebrain.com. Doing so has no effect on your own report or on your ability to use the Services.
10. Our Own Analysis and Research
RedWave analyses the measurements it collects in order to understand its own service, improve its session protocol and written materials, maintain and update the Reference Sample, and produce general statistics about what RedWave measures.
We may also publish, present, or share findings from this work — including with researchers, partners, the press, or the public — and we may license or provide de-identified, aggregated datasets to third parties. We may do this without asking you again, and we do not pay for or share revenue from it.
The limits we place on ourselves, which are binding:
Only de-identified, aggregated information is ever used. Your name, contact details, date of birth, and any other identifier are stripped before your measurements enter any analysis or dataset.
Nothing identifying you is ever published. We do not publish individual recordings, individual reports, individual results, or any case description from which a person could reasonably be recognised.
We do not attempt to re-identify de-identified information, and we require by contract that anyone receiving a de-identified dataset from us agrees not to attempt it either.
We do not sell identifiable information, and de-identified datasets are never provided to advertisers, data brokers, insurers, or employers.
You may opt out. Write to info@redwavebrain.com and your measurements will be excluded from future pooling, analysis, and any dataset, with no effect on your Services or their price.
This is not clinical research and does not make RedWave a research institution. We do not conduct studies on human subjects, we do not test hypotheses about disease, we do not enrol you in a study, and nothing we publish should be read as a clinical or scientific finding about you or about any condition. Information already pooled in de-identified form cannot be traced back to you and therefore cannot be extracted after the fact.
11. Cookies, Analytics, and Advertising
Our website uses cookies and similar technologies in three categories: those strictly necessary for the site and booking flow to work; analytics that tell us in aggregate how the site is used; and advertising and measurement technologies — which may include pixels operated by advertising platforms — that allow us to promote RedWave to people who have visited our website and to measure whether our advertising works.
Where we draw the line, and we do not cross it:
No advertising or measurement technology runs on our booking, intake, payment, or confirmation pages. Those pages carry only strictly necessary technologies.
No Measurement Data, Intake Context, report, or result is ever transmitted to an advertising platform, in any form, ever.
We do not build or upload audience lists from our client records. We do not upload client emails or telephone numbers to advertising platforms and do not create custom or lookalike audiences from people who have booked or attended a session.
We do not target advertising on the basis of health, condition, symptom, or any measurement. Our advertising is targeted the way an ordinary local business advertises — by geography, general interest, and prior visits to our public pages.
You can refuse or delete cookies through your browser settings, and you can opt out of advertising cookies through the controls we provide on our website; strictly necessary cookies cannot be refused without affecting booking. We honour Global Privacy Control and similar browser opt-out signals where they are transmitted to us.
Marketing to you directly. Where you have given the consent described in our Terms & Conditions, we may send you email and text messages about RedWave’s own services, offers, and reminders. Consent to marketing is never a condition of purchase, and you may opt out at any time by replying STOP, using the unsubscribe link, or writing to info@redwavebrain.com.
12. The Reaction Demo on Our Website
Our website includes a browser-based reaction-time demonstration. It runs entirely in your browser. The times it produces are not transmitted to RedWave, not stored, not linked to you, and not used for any purpose. They disappear when you close or reload the page. It is a toy, not a measurement.
13. Data Security
We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including access controls limiting Measurement Data to staff who need it, encryption of personal information in transit and on portable devices where required, a locked and access-controlled location for the WAVi base station, secure disposal of records, and confidentiality obligations on staff and service providers.
No system is perfectly secure, and we do not promise that ours is. If a breach of security involving your personal information occurs, we will notify you and the relevant authorities as described in Section 15.
14. Data Retention and Deletion
We retain your Measurement Data, report, and Intake Context for three (3) years from your most recent session, so that a later session can be compared against your earlier ones. After that period they are deleted in the ordinary course. Booking, transaction, and communication records are retained for the period required for accounting, tax, and legal purposes.
You may request deletion at any time by writing to info@redwavebrain.com. We will delete what we hold — in both the WAVi system and RedWave’s own records — within thirty (30) days, except where retention is required by law or is reasonably necessary to resolve a dispute or enforce our agreement with you. We will confirm in writing when it is done.
Two honest limits. First, deletion applies only to copies we hold: we cannot retrieve or delete a report or file already given to you or shared by you with someone else. Second, deletion is irreversible and ends the possibility of comparing any future session to your history. De-identified information already pooled into the Reference Sample cannot be traced back to you and therefore cannot be extracted, though you may exclude yourself from future pooling under Sections 9 and 10.
15. Massachusetts Residents
RedWave is located in the Commonwealth of Massachusetts and the following applies:
Written Information Security Program. We maintain a Written Information Security Program designed to comply with the Massachusetts Standards for the Protection of Personal Information, 201 CMR 17.00, including administrative, technical, and physical safeguards and encryption of personal information in transit and on portable devices where that regulation requires it.
Breach notification. In the event of a breach of security involving the personal information of a Massachusetts resident, we will give notice consistent with M.G.L. c. 93H, including, where required, notice to affected residents, the Massachusetts Attorney General, and the Office of Consumer Affairs and Business Regulation.
Secure destruction. We dispose of records containing personal information consistent with M.G.L. c. 93I.
Recording. Massachusetts is an all-party-consent jurisdiction under the Massachusetts wiretap statute, M.G.L. c. 272, § 99. RedWave does not audio-record sessions or telephone calls. Any video-only security recording in a common area is conducted with notice posted at the premises.
Comprehensive privacy rights. Massachusetts does not currently have a comprehensive consumer-privacy statute granting access and deletion rights of the kind found in some other states. We honour the requests described in Section 16 regardless, as a matter of practice.
16. Your Choices and Rights
Whatever state you live in, you may ask us to:
Access — tell you what we hold about you and give you a copy;
Correct — fix anything inaccurate, including Intake Context;
Delete — erase what we hold, subject to Section 14;
Exclude — remove your measurements from future pooling into the Reference Sample;
Opt out — stop marketing emails and text messages at any time;
Withdraw consent — where we rely on your consent, withdraw it going forward.
Write to info@redwavebrain.com. We will respond within thirty (30) days and will not charge you, discriminate against you, or degrade your Services for making a request. We may need to verify your identity before acting, and will ask only for what is necessary to do so.
17. Children’s Privacy
The Services are for adults aged 18 and over only. RedWave does not provide the Services to anyone under 18 under any circumstances, including with parental consent, and does not knowingly collect information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it promptly. If you believe we hold such information, write to info@redwavebrain.com.
18. HIPAA and Regulatory Status
HIPAA does not apply to RedWave. We are not a healthcare provider, we do not conduct HIPAA-covered transactions, and we do not bill health insurance. The information we hold is not a medical record and is not protected health information. We do not describe ourselves as "HIPAA-compliant," because doing so would be misleading.
No clinician, no clinical oversight. Unlike some wellness businesses, RedWave has no medical director and no clinical supervision of any kind. No physician or other licensed professional reviews your data, and none is engaged to do so. This is a deliberate feature of how RedWave operates and is described in our Terms & Conditions.
Other frameworks. Our Services are directed to the United States and are not targeted to individuals in the European Economic Area or the United Kingdom, and we make no independent commitment under the GDPR or UK GDPR. We follow FTC guidance on data security and consumer protection, and applicable US state privacy and consumer-health-data laws as they take effect.
19. Third-Party Websites and Services
Our website and booking flow may link to or rely on third-party services, including our booking and communication platform, website host, and payment processor. Their handling of your information is governed by their own privacy policies, not this one. We are not responsible for the content or privacy practices of any third-party site, and we encourage you to read their policies. We select providers with reasonable security practices and bind them to confidentiality.
20. Changes to This Policy
We may update this Policy. The version in effect when you use the Services governs that use. Where a change is material, we will post the revised Policy at redwavebrain.com with a new effective date and, where we hold your email address, notify you. We archive every version, and you may request the exact version that applied to you at any time.
21. Governing Law
This Policy is governed by the laws of the Commonwealth of Massachusetts, without regard to conflict-of-laws principles. The dispute resolution and arbitration provisions of our Terms & Conditions apply to any dispute arising under this Policy.
22. Contact Us
Questions, requests, and complaints about privacy:
RedWave Recovery LLC
799 Concord Avenue, Cambridge, MA 02138
If you are not satisfied with our response, you may contact the Massachusetts Office of the Attorney General, Consumer Advocacy and Response Division.