Effective September 7, 2026
NORM Rhythm ("we," "us") is operated by NeuroSpire Labs, Inc., 5416 Alumni Drive NW, Huntsville, AL 35806, (256) 850-4426. NORM Rhythm is a relationship and self-growth program spanning our apps and web. It provides coaching and self-growth support — it is not therapy or medical care.
NORM Rhythm collects information you share, including assessment answers, mood, and relationship information. We treat this as sensitive. We do not sell it, share it with advertisers, or use it to target ads, and we do not load advertising or social-media trackers on screens where you enter that content.
To personalize your program, process your subscription, keep the service secure, communicate with you, and improve NORM Rhythm using aggregated/de-identified data.
Contract, legitimate interests, legal obligations, and — for sensitive data — your explicit consent, withdrawable anytime.
Contracted processors only: Stripe / RevenueCat (payments), NORM Identity (sign-in), Sentry (crash monitoring, configured not to receive your mood/journal/message content), hosting/email. We do not sell personal information or share sensitive content with advertisers.
Where NORM Rhythm connects you with a licensed therapist, that clinical care is provided by independently licensed professionals under a separate agreement and HIPAA Notice of Privacy Practices, and is never used for advertising.
Not all information we hold is Protected Health Information (“PHI”). PHI means individually identifiable health information created or received by a licensed provider in the course of providing treatment, payment, or health care operations — for example clinical session notes, diagnoses, treatment plans, clinical assessments administered as part of care, and the billing records associated with them.
Self-help and educational content you create on the Platform is not PHI. Journal entries, daily check-ins, goals, and self-administered assessments taken outside a course of treatment are personal data we protect under this policy, but they are not clinical records and are not subject to HIPAA.
Where the same instrument is used both ways, the distinction is the context: taken as part of treatment by a licensed clinician it is PHI; taken on your own for self-insight it is not.
Kept while your account is active.
Clinical records (PHI) are retained for the period required by applicable law and professional standards. The retention clock runs from the date of service, not from the date of last contact.
Platform data is retained while your account is active. If your account is closed or deactivated, we keep it so your history can be restored if you return — closing an account is not the same as deleting it, and on its own it deletes nothing.
Deleting your account deletes it. When you ask us to delete — in-app where the product offers it, or by emailing the address below — we permanently erase the data you own, including your login. We do not archive it, and it cannot be restored afterwards. Three narrow exceptions: a record that involves another person is unlinked from you rather than deleted from their copy; we keep a minimal, contentless record that a deletion happened; and we keep what the law requires.
We may retain data beyond these periods where required to do so: to comply with a legal obligation, to resolve a dispute, to enforce our agreements, or where the records are subject to a litigation hold. A litigation hold suspends deletion entirely, including a deletion you have requested, until the hold is lifted.
You can access, correct, export, or delete your data in-app or by emailing support@neurospirelabs.com. GDPR and CCPA rights apply; we do not sell or "share" personal information for advertising.
Deletion does not require a written request. For access, correction, or a copy of your records, write to the address below and identify the records sought.
Records are produced within 30 days of a verified request, with one 30-day extension where necessary and where we notify you of the reason.
Where a record contains information about another person — for example a shared couple journal — we provide your own entries only. We will tell you that a shared record exists and that part of it has been withheld; releasing another person’s entries requires their consent or a court order naming them.
Identity verification is required before any record is released.
If we discover a breach of unsecured personal data or PHI, we will:
We maintain a written incident-response plan and test it. Nothing in this section limits any right you have under applicable law.
Encryption in transit and access controls. NORM Rhythm is for users 18 and older.
This policy is versioned. Minor corrections increment the decimal (2.0 to 2.1); a material revision increments the whole number (2.0 to 3.0). The version in effect at the time an incident, claim, or dispute arises is the version that governs that matter, regardless of any later revision. Prior versions and their effective dates are retained and available on request.
We'll revise the "Last updated" date on changes. support@neurospirelabs.com · NeuroSpire Labs, Inc., 5416 Alumni Drive NW, Huntsville, AL 35806 · (256) 850-4426