BRAIN BOOST ACADEMY, INC.™

Including the Proprietary Divisions

BrainChild Blueprint™ | BrainChild Breakthrough™ | BrainChild Community™

Effective Date: January 1, 2022

Last Updated: August 1, 2026

OUR PRIVACY COMMITMENT:

Brain Boost Academy works with children, teens, young adults, Parents, Adult Participants, and families, and we recognize that the information families share with us can be personal and important.

Families may share information with BBA because they are looking for greater understanding, clearer educational direction, appropriate support, or meaningful next steps for themselves or someone they care deeply about.

We take that trust seriously.

Our goal is to collect and use information thoughtfully and for purposes connected to the services families have requested, while using reasonable safeguards and respecting the privacy rights that apply to the individuals we serve.

We appreciate the trust you place in Brain Boost Academy and remain committed to approaching your information with care, respect, responsibility, and the same collaborative spirit we bring to our work with Participants and families.

PART I — INTRODUCTION & SCOPE

1. INTRODUCTION

Brain Boost Academy, Inc.™ (“Brain Boost Academy,” “BBA,” “we,” “us,” or “our”) respects the privacy of the children, teens, young adults, adult participants, parents, legal guardians, families, professionals, website visitors, prospective clients, clients, students, and other individuals who interact with us.

Brain Boost Academy, Inc. is a California corporation and owns and operates the proprietary divisions:

BrainChild Blueprint™
BrainChild Breakthrough™
BrainChild Community™

This Master Global Privacy Policy & Privacy Notice (“Privacy Policy”) describes how BBA may collect, use, process, store, disclose, transfer, and protect personal information through our websites, evaluations, programs, services, communications, online systems, communities, and other interactions.

BBA is based in California but may provide educational programs and services to individuals located throughout the United States and internationally.

Privacy rights and legal requirements may therefore vary depending upon where an individual is located, the nature of the information involved, how the information is collected or used, and which BBA service is being provided.

Where applicable law provides additional privacy rights or protections, BBA will seek to comply with those applicable requirements.

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy may apply to information collected through:

BBA websites and webpages;
BrainChild Blueprint™;
BrainChild Breakthrough™;
BrainChild Community™;
Right-Fit Questionnaires;
inquiry forms;
intake forms;
registration and enrollment;
educational and neurodevelopmental assessments;
computerized assessments;
remote evaluations;
home-based evaluation/intervention activities;
online programs;
digital learning programs;
group programs;
videoconferencing;
Zoom or similar platforms;
email;
telephone;
text messaging;
electronic forms;
payment and billing systems;
scheduling systems;
electronic signatures;
audio recordings;
video recordings;
screen recordings;
transcripts;
AI-assisted transcription and documentation;
program-monitoring systems;
surveys and questionnaires;
website analytics;
cookies and similar technologies; and
other systems used to provide or support BBA services.

Certain services may be governed by additional privacy notices, consents, authorizations, or agreements.

3. RELATIONSHIP TO BBA TERMS & CONDITIONS

This Privacy Policy should be read together with BBA’s:

Master Terms & Conditions;
Applicable Enrollment Agreement;
Right-Fit Questionnaire;
Intake & evaluation documents;
Recording notices;
Parent or Guardian authorizations;
Adult Participant consents;
ROI- release-of-information authorizations;
Media, Photo, Video & Testimonial Authorizations; and
Other program-specific agreements.

If another document provides additional privacy protections or requirements for a particular service, those provisions may also apply.

PART II — WHOSE INFORMATION WE MAY COLLECT

4. PARTICIPANTS & CLIENTS

BBA may collect personal information relating to:

Minor Participants;
Adult Participants;
Parents;
Legal Guardians;
Family members;
Prospective Clients;
Current Clients;
Former Clients;
Website visitors;
Community members;
Professionals communicating with BBA;
Individuals authorized to receive Participant information; and
Other individuals who interact with BBA.

5. MINOR PARTICIPANTS

A Participant under age 18 is generally treated by BBA as a Minor Participant unless another legal rule applies.

BBA generally works with a Parent, Legal Guardian, or other legally authorized decision-maker when providing services to a minor.

Depending upon the program, information about a minor may be collected:

From the Parent or Legal Guardian;
Directly from the Participant;
During an assessment or intervention;
Through a computerized evaluation;
Through a Parent-facilitated activity;
From records provided to BBA;
Through a third-party platform; or
From another authorized source.

BBA recognizes that information concerning children and teens requires particular care.

6. CHILDREN UNDER AGE 13 & COPPA

Certain BBA Participants may be under age 13.

The federal Children’s Online Privacy Protection Act and COPPA Rule can apply to operators of websites or online services directed to children under 13 and to other online services that have actual knowledge that they are collecting personal information online from children under 13. When COPPA applies, verifiable parental consent is generally required before applicable collection, use, or disclosure.

Accordingly, where COPPA applies to a BBA-controlled online service, BBA will provide appropriate parental notice and obtain verifiable parental consent or use another legally permitted procedure before collecting applicable personal information directly online from a child under 13.

Additional children’s privacy consent may be required for:

Computerized assessments;
Participant portals;
Interactive online programs;
Apps;
Digital activities;
Audio or video collection;
Persistent identifiers;
Uploads; or
Other online services involving direct collection from a child.

Information that a Parent or Legal Guardian provides to BBA about their own child may be subject to different requirements than information collected directly online from the child.

7. ADULT PARTICIPANTS

A Participant who is 18 years of age or older generally controls their own privacy decisions unless another legally recognized arrangement applies.

A Parent, family member, or other individual who pays for services for an Adult Participant does not automatically acquire the right to:

receive the Adult Participant’s private information;
access evaluation results;
receive recordings;
receive transcripts;
make privacy decisions for the Adult Participant; or
authorize disclosures on the Adult Participant’s behalf.

BBA may require the Adult Participant’s authorization before sharing information with another person unless disclosure is otherwise permitted or required by law.

PART III — CATEGORIES OF INFORMATION BBA MAY COLLECT

8. IDENTIFYING & CONTACT INFORMATION

BBA may collect information such as:

name;
Parent or Guardian name;
Participant name;
mailing address;
email address;
telephone number;
date of birth;
age;
relationship to Participant;
preferred contact method;
account information; and
other identifying or contact information.

9. EDUCATIONAL & DEVELOPMENTAL INFORMATION

Depending upon the service, BBA may collect information concerning:

educational history;
school placement;
grade level;
academic performance;
reading;
spelling;
writing;
learning strengths;
learning challenges;
attention;
processing;
memory;
executive-function-related learning skills;
developmental history;
previous assessments;
current or previous programs;
educational supports;
parent concerns;
adult participant concerns;
educational goals; and
other information relevant to understanding the participant’s history.

10. ASSESSMENT & EVALUATION INFORMATION

BBA may collect information generated through educational and neurodevelopmental assessments, including:

assessment responses;
standardized scores;
computerized-assessment data;
response times;
error patterns;
observations;
rating scales;
questionnaires;
oral responses;
written responses;
reading samples;
performance data;
records supplied to BBA;
evaluator notes;
audio samples;
video samples;
screen recordings;
transcripts; and
other information related to the evaluation.

11. RIGHT-FIT & INTAKE INFORMATION

BBA may collect information through its Right-Fit and intake processes concerning matters such as:

Participant abilities;
learning needs;
reading ability;
ability to follow directions;
computer skills;
mouse or keyboard skills;
ability to use required technology;
attention and participation;
sensory considerations;
parent availability;
parent facilitation capability;
evaluation goals;
family concerns; and
other information used to determine whether a BBA offering appears appropriate.

12. HEALTH, DIAGNOSTIC & OTHER SENSITIVE INFORMATION VOLUNTARILY PROVIDED TO BBA

Parents, Legal Guardians, and Adult Participants may voluntarily provide information concerning:

diagnoses;
disabilities;
developmental history;
medications;
physical health;
mental-health history;
behavioral concerns;
sensory considerations;
prior clinical or educational evaluations;
medical history;
safety concerns; or
other health-related information.

BBA may use this information when reasonably relevant to:

understanding the participant’s background;
determining program fit;
planning an educational or neurodevelopmental assessment;
understanding factors that may affect participation;
developing educational recommendations;
maintaining safety; or
determining whether consultation with another professional may be appropriate.

The receipt of health-related information does not, by itself, convert BBA’s educational and neurodevelopmental services into medical or therapeutic services.

13. COMMUNICATIONS

BBA may collect and maintain communications such as:

emails;
text messages;
telephone notes;
videoconference communications;
Zoom chat;
online-community communications;
form submissions;
questions;
feedback;
complaints;
Parent communications;
Participant communications; and
other correspondence.

14. PAYMENT & TRANSACTION INFORMATION

BBA may collect or process information relating to:

purchases;
programs selected;
payment plans;
invoices;
billing address;
transaction history;
payment status;
refunds or credits; and
related financial records.

Complete payment-card or bank credentials may be processed directly by third-party payment processors rather than stored by BBA.

15. WEBSITE & TECHNICAL INFORMATION

When an individual uses a BBA website or online service, BBA or its technology providers may collect information such as:

IP address;
browser type;
device type;
operating system;
device identifiers;
referring page;
pages viewed;
dates and times of visits;
site interactions;
login information;
cookie identifiers;
analytics information; and
other technical information.

16. RECORDINGS & TRANSCRIPTS

Where disclosed and appropriately authorized, BBA may collect:

audio recordings;
video recordings;
screen recordings;
speech or reading samples;
evaluation recordings;
Zoom recordings;
group-call recordings;
transcripts;
automated captions;
AI-assisted transcripts;
summaries;
chat content; and
other documentation generated from recorded communications.

PART IV — HOW BBA COLLECTS INFORMATION

17. INFORMATION PROVIDED DIRECTLY

BBA may collect information when an individual:

visits a website;
requests information;
schedules a consultation;
submits an inquiry;
completes a Right-Fit Questionnaire;
completes intake;
enrolls;
purchases a service;
completes an assessment;
submits records;
participates in an evaluation;
participates in a consultation;
joins a community;
attends a group call;
communicates with BBA;
uses an online program; or
otherwise voluntarily provides information.

18. INFORMATION FROM AUTHORIZED THIRD PARTIES

With appropriate authorization or as otherwise legally permitted, BBA may receive information from:

Parents;
Legal Guardians;
Adult Participants;
schools;
teachers;
educational professionals;
physicians;
psychologists;
therapists;
speech-language pathologists;
occupational therapists;
educational consultants;
attorneys;
assessment companies;
testing platforms;
software providers; or
other authorized sources.

19. INFORMATION COLLECTED AUTOMATICALLY

BBA and its service providers may automatically collect certain information through:

website technologies;
cookies;
analytics tools;
security systems;
digital platforms;
computerized assessments;
learning programs;
login systems;
videoconferencing tools; and
similar technologies.

PART V — HOW BBA USES INFORMATION

20. PURPOSES FOR USE

BBA may use personal information for purposes reasonably related to its services and operations, including:

responding to inquiries;
determining Right-Fit;
evaluating program appropriateness;
enrollment;
scheduling;
administering assessments;
reviewing assessment performance;
developing learning profiles;
preparing BrainChild Blueprint™ & Plans;
identifying patterns of learning strengths and challenges;
developing educational recommendations;
providing educational programs;
providing intervention programs;
providing Parent coaching;
providing group programs;
managing BrainChild Community™;
monitoring participation and progress;
communicating with Participants and families;
providing technical support;
billing and payment processing;
maintaining records;
documentation;
internal quality assurance;
professional consultation when appropriate;
improving programs;
maintaining system and Participant safety;
fraud prevention;
enforcing agreements;
responding to legal requirements; and
other disclosed purposes reasonably related to the requested service.

21. DATA MINIMIZATION

BBA seeks to collect personal information that is reasonably relevant to the purpose for which it is being collected.

BBA does not intend to collect sensitive personal information merely because such information may be available.

22. AGGREGATED & DE-IDENTIFIED INFORMATION

Where permitted by law, BBA may use information that has been aggregated or de-identified so that it does not reasonably identify a particular Participant or family for purposes such as:

program improvement;
internal analysis;
educational planning;
quality assurance;
statistical analysis;
understanding program outcomes; or
business planning.

BBA will not represent de-identified information as anonymous if BBA retains information reasonably capable of reconnecting it to a specific individual.

PART VI — CHILDREN’S PRIVACY

23. PARENTAL INVOLVEMENT

BBA generally expects Parents or Legal Guardians to be involved in enrollment decisions for Minor Participants.

Depending upon age, program, and applicable law, BBA may require:

Parent or Guardian authorization;
verification of parental identity or authority;
consent for online collection;
consent for recording;
consent for computerized assessment;
consent for program participation; or
other age-appropriate authorization.

24. DIRECT COLLECTION FROM CHILDREN

Where BBA directly collects information from a child through an online service, BBA will consider:

the child’s age;
whether COPPA applies;
the information collected;
the purpose of collection;
whether parental consent is required;
the technology involved; and
other applicable legal requirements.

BBA does not intend to require a child to provide more online personal information than is reasonably necessary for the activity in which the child is participating where COPPA applies.

25. ADVERTISING & CHILD PARTICIPANT INFORMATION

BBA does not intend to use individualized Participant evaluation results, learning profiles, diagnoses provided to BBA, assessment responses, or private developmental information for unrelated behavioral advertising.

Public use of a Participant’s identifiable photograph, voice, likeness, testimonial, or personal story is governed separately by applicable authorization.

PART VII — RECORDING, TRANSCRIPTION & ARTIFICIAL INTELLIGENCE

26. RECORDING

Certain BBA interactions may be recorded when disclosed and appropriately authorized.

These may include:

portions of evaluations;
assessment or program activities;
Parent consultations;
Adult Participant consultations;
one-to-one meetings;
group programs;
workshops;
coaching calls;
Zoom sessions; and
community programs.

27. PURPOSES OF RECORDING

Recordings may be used for purposes such as:

accurate documentation;
review of Participant responses;
evaluation review;
scoring;
analysis;
preparation of a BrainChild Blueprint™ & Plan;
professional consultation;
program participation
quality assurance;
continuity of services;
participant replays;
educational replays; or
other disclosed program purposes.

28. TRANSCRIPTION

Audio or video communications may be converted into written transcripts.

Transcription may occur through:

manual transcription;
videoconferencing software;
automated speech recognition;
captioning tools;
AI-assisted technology; or
another transcription service.

29. AI-ASSISTED TOOLS

BBA may use artificial intelligence or automated technologies to assist with:

transcription;
summarization;
note organization;
identification of action items;
documentation;
administrative organization;
reviewing communications; and
other support functions.

AI-generated transcripts and summaries may contain errors.

Automated systems may misunderstand:

words;
names;
technical language;
speakers;
context; or
meaning.

BBA personnel may review, correct, supplement, disregard, or otherwise appropriately use AI-generated content.

An AI-generated transcript, summary, note, or suggestion does not by itself constitute BBA’s final educational conclusion, assessment interpretation, recommendation, or BrainChild Blueprint™ & Plan,

BBA’s final educational interpretations and recommendations reflect human review and judgment.

30. THIRD-PARTY AI & TECHNOLOGY PROVIDERS

BBA may use third-party technology providers for:

AI-assisted transcription;
videoconferencing;
recording;
automated captions;
summaries;
document processing;
storage;
testing;
scheduling;
communication;
program delivery; or
other operational functions.

Information may be transmitted to or processed by those providers when reasonably necessary to provide the applicable function.

BBA will not represent that a third-party provider has a particular privacy or AI-training practice unless BBA has a reasonable basis for that representation.

31. GROUP PROGRAMS & REPLAYS

When disclosed and appropriately authorized, BBA group sessions may be recorded and made available to authorized Participants.

Replay materials may include:

video;
audio;
edited video;
transcripts;
AI-assisted transcripts;
summaries;
questions;
Participant comments;
display names; and
chat content.

Participants should use reasonable judgment regarding information they voluntarily disclose in a recorded group environment.

32. RECORDINGS ARE NOT AUTOMATIC MARKETING AUTHORIZATION

Consent to a BBA evaluation recording, program recording, transcription, AI-assisted processing, or group replay does not automatically authorize BBA to use an identifiable Participant’s:

name;
photograph;
voice;
likeness;
testimonial;
personal story;
evaluation information; or
recording

for public advertising or promotional purposes.

Separate authorization may be required for public marketing use.

PART VIII — HOW BBA MAY DISCLOSE INFORMATION

33. SERVICE PROVIDERS

BBA may disclose personal information to vendors and service providers that perform functions on BBA’s behalf, such as:

website hosting;
cloud storage;
payment processing;
scheduling;
videoconferencing;
testing platforms;
computerized programs;
transcription;
AI-assisted documentation;
electronic signatures;
email;
text messaging;
analytics;
cybersecurity;
technical support; and
other operational services.

BBA seeks to limit disclosures to information reasonably necessary for the applicable service.

34. AUTHORIZED PROFESSIONALS & THIRD PARTIES

With appropriate authorization or as otherwise legally permitted, BBA may communicate with:

teachers;
schools;
school districts;
educational providers;
physicians;
psychologists;
therapists;
speech-language pathologists;
occupational therapists;
attorneys;
educational consultants;
family members; or
other individuals designated by the Client or Adult Participant.

35. LEGAL, SAFETY & COMPLIANCE DISCLOSURES

BBA may disclose information when reasonably necessary and permitted or required by law to:

comply with a valid legal process;
respond to a court order;
satisfy a legal obligation;
address an immediate safety concern;
protect BBA’s legal rights;
protect Participants or others;
investigate fraud or misuse;
protect systems or information; or
respond to an appropriate government or regulatory authority.

36. BUSINESS TRANSFERS

If BBA is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, personal information may be transferred as part of that transaction subject to applicable privacy requirements.

PART IX — SALE, SHARING, MARKETING & ADVERTISING

37. INDIVIDUALIZED PARTICIPANT INFORMATION

BBA’s policy is to not sell individualized:

assessment results;
BrainChild Blueprint™ information;
Participant educational records;
Participant developmental information;
Participant diagnoses provided to BBA; or
private Participant communications

to unrelated third parties for their independent commercial use.

38. WEBSITE ADVERTISING & ANALYTICS

Website analytics, advertising pixels, cookies, or similar technologies can be treated as a “sale,” “sharing,” targeted advertising, or similar regulated activity under some privacy laws depending upon how the technology is configured and used.

If BBA engages in an activity subject to an applicable opt-out right, BBA will provide the legally required mechanism.

BBA should periodically review its website advertising, analytics, cookie, and tracking configuration to ensure this Privacy Policy accurately reflects actual practices.

39. MARKETING COMMUNICATIONS

BBA may send service-related communications regarding:

enrollment;
appointments;
payments;
evaluations;
program activities;
account information;
policy updates; and
other transactional matters.

Where permitted, BBA may also send educational or promotional communications.

Recipients may use applicable unsubscribe mechanisms to stop nonessential marketing email.

Unsubscribing from marketing does not necessarily prevent communications reasonably necessary to provide an enrolled service.

PART X — COOKIES, TRACKING & ONLINE TECHNOLOGIES

40. COOKIES & SIMILAR TECHNOLOGIES

BBA websites may use cookies and similar technologies for purposes such as:

essential website operation;
login functionality;
security;
remembering preferences;
analytics;
understanding website use;
improving website performance; and
marketing where permitted.

BBA may use a separate Cookie Notice or consent-management system when appropriate.

41. COOKIE CHOICES

Depending upon applicable law and website configuration, visitors may have the ability to:

accept cookies;
reject certain nonessential cookies;
modify cookie preferences; or
use browser settings to restrict cookies.

Disabling cookies may affect website functionality.

42. DO NOT TRACK & OTHER CROSS-SITE TRACKING DISCLOSURES

California’s Online Privacy Protection Act requires applicable commercial websites to disclose how they respond to browser “Do Not Track” signals or similar mechanisms if they engage in covered cross-site collection, and whether other parties may collect personally identifiable information about a consumer’s online activities over time and across different websites.

Where BBA is legally required to recognize a legally valid opt-out preference signal, BBA will implement the applicable requirements.

PART XI — DATA RETENTION, SECURITY & INCIDENTS

43. RETENTION

BBA retains personal information for periods reasonably necessary to:

provide services;
complete evaluations;
prepare Plans and recommendations;
operate programs;
maintain appropriate business records;
satisfy payment and tax requirements;
respond to disputes;
maintain continuity of services;
meet legal or contractual obligations;
satisfy applicable professional requirements; or
accomplish the disclosed purpose for which the information was collected.

Different categories of information may be retained for different periods.

Information may be deleted or de-identified when no longer reasonably necessary, subject to applicable requirements.

44. RECORDINGS & WORKING DOCUMENTS

Recordings, transcripts, working notes, AI-generated summaries, and similar documentation may have different retention periods depending upon their purpose.

BBA may delete working materials when they are no longer reasonably necessary and retention is not otherwise required.

Participants should not assume that BBA will permanently preserve a recording merely because one was made.

45. INFORMATION SECURITY

BBA uses reasonable administrative, technical, and organizational measures intended to protect personal information against:

unauthorized access;
unauthorized disclosure;
loss;
misuse;
alteration; or
destruction.

Security measures may vary according to the sensitivity and nature of the information involved.

No electronic transmission, cloud service, internet connection, or information system can be guaranteed to be completely secure.

46. SECURITY INCIDENTS

If BBA becomes aware of a security incident involving personal information, BBA will evaluate the incident and take actions required by applicable law, which may include:

investigation;
containment;
remediation;
documentation;
vendor coordination; and
legally required notification.

PART XII — PRIVACY RIGHTS & REQUESTS

47. ACCESS, CORRECTION, DELETION & OTHER REQUESTS

Depending upon applicable law and the nature of the information involved, individuals may have rights to request:

access to personal information;
confirmation that information is being processed;
correction of inaccurate information;
deletion of certain information;
information regarding disclosures;
withdrawal of certain consent;
restriction of certain processing;
portability;
opt-out of certain activities; or
other privacy choices.

The availability of a particular right depends upon applicable law.

48. LIMITATIONS ON REQUESTS

Some privacy requests may be limited by:

legal obligations;
contractual obligations;
assessment-security requirements;
intellectual-property rights;
test-publisher restrictions;
record-retention requirements;
fraud-prevention needs;
the rights and privacy of another individual; or
another legally recognized exception.

49. VERIFYING REQUESTS

BBA may take reasonable steps to verify the identity and authority of a person making a privacy request.

For a Minor Participant, BBA may verify Parent or Guardian authority.

For an Adult Participant, BBA may require the Adult Participant’s authorization before providing information to another person.

50. NONDISCRIMINATION

Where applicable law prohibits retaliation or discrimination for exercising privacy rights, BBA will not unlawfully discriminate against an individual for exercising those rights.

PART XIII — CALIFORNIA PRIVACY

51. CALIFORNIA PRIVACY COMPLIANCE

Brain Boost Academy, Inc. is a California corporation and is committed to handling personal information in accordance with the California privacy laws applicable to BBA’s business, websites, online services, programs, evaluations, and other activities.

Depending upon BBA’s activities and the information involved, California requirements may concern:

online privacy disclosures;
personal-information collection;
information concerning children and minors;
audio, video, and electronic recordings;
data security;
marketing;
consumer rights;
data breaches;
sensitive information; and
other privacy or confidentiality obligations.

Nothing in this Privacy Policy is intended to waive a privacy right that cannot lawfully be waived.

52. CCPA / CPRA — BBA’S CURRENT STATUS

The California Consumer Privacy Act, as amended by the California Privacy Rights Act and subsequent amendments and regulations (“CCPA”), applies only when applicable statutory coverage requirements are met.

Based upon BBA’s current understanding of its size and business practices, BBA does not presently believe that it meets the statutory thresholds that would make BBA a covered “business” under the CCPA.

The California Privacy Protection Agency currently identifies the principal thresholds as a for-profit business doing business in California that determines the purposes and means of processing personal information and meets at least one of the following:

gross annual revenue of $26.625 million or more for the preceding calendar year;
buying, selling, or sharing personal information of 100,000 or more California residents or households; or
deriving 50% or more of annual revenue from selling or sharing California residents’ personal information.

These thresholds and applicable requirements can change over time.

BBA will periodically evaluate whether its status has changed.

CCPA/CPRA requirements apply if BBA meets the applicable statutory coverage requirements, with additional obligations depending on the categories of personal information and the manner in which that information is collected, used, disclosed, sold, shared, or otherwise processed.

The inclusion of CCPA information in this Privacy Policy is intended to provide transparency and prepare for potential future obligations. It is not intended as a voluntary representation that BBA is presently a covered CCPA business when the statutory requirements have not otherwise been met.

53. IF BBA BECOMES SUBJECT TO THE CCPA

If BBA becomes subject to the CCPA, BBA will implement applicable notices, procedures, and consumer-rights mechanisms.

Depending upon then-current law and BBA’s practices, these may include:

Notice at Collection;
disclosures of categories of information collected;
disclosures of purposes for collection and use;
right to know;
right to access;
right to request correction;
right to request deletion;
right to opt out of covered sale or sharing;
right to limit certain uses of sensitive personal information where applicable;
recognition of qualifying opt-out preference signals;
appropriate consumer-request methods;
verification procedures;
applicable retention disclosures;
required service-provider or contractor provisions; and
protection against unlawful discrimination for exercising rights.

The CCPA currently provides rights including limiting certain uses/disclosures of sensitive information, opting out of sale/sharing, and obtaining information regarding personal information held by covered businesses.

54. SENSITIVE PERSONAL INFORMATION

Because of the nature of BBA’s work, BBA may receive information that an individual reasonably considers sensitive.

Depending upon applicable law, this may include:

health-related information;
developmental history;
diagnoses provided to BBA;
disability information;
private communications;
evaluation information;
educational records;
assessment results;
account information;
family information; and
other sensitive information.

Under the CCPA, certain categories such as health information and specified private communications can qualify as sensitive personal information when the CCPA applies.

BBA intends to use sensitive information for purposes reasonably related to:

requested services;
Right-Fit Questionnaires;
evaluations;
educational planning;
development of a BrainChild Blueprint™ & Plan;
program delivery;
communication;
safety;
documentation;
legal compliance; and
other disclosed purposes.

55. CALIFORNIA ONLINE PRIVACY PROTECTION ACT

Regardless of whether BBA currently meets CCPA thresholds, California’s Online Privacy Protection Act (“CalOPPA”) applies to operators of covered commercial websites or online services that collect personally identifiable information online from California consumers.

CalOPPA requires applicable privacy policies to disclose categories of personally identifiable information collected, categories of third parties with whom information may be shared, applicable processes for reviewing/changing information, material-change notification practices, the policy’s effective date, and specified tracking information.

BBA intends for this Privacy Policy to address those requirements to the extent applicable to BBA’s actual online practices.

56. CALIFORNIA PRIVACY RIGHTS OUTSIDE THE CCPA

BBA’s current belief that it does not meet CCPA thresholds does not mean that other California privacy or consumer-protection laws do not apply.

BBA will continue to evaluate applicable requirements concerning:

online privacy;
recordings;
security;
children’s information;
electronic communications;
marketing;
data breaches; and
other privacy matters.

57. CHANGES IN BBA’S CCPA STATUS

BBA’s status may change because of:

business growth;
increased revenue;
increased numbers of consumers or households;
changes to advertising practices;
changes in website technology;
changes in data-sharing practices;
mergers or acquisitions;
changes in California law; or
changes to statutory thresholds.

If BBA becomes subject to additional requirements, BBA will update its privacy notices, processes, consent mechanisms, and operational practices as required.

PART XIV — OTHER UNITED STATES PRIVACY LAWS

58. PRIVACY RIGHTS IN OTHER U.S. STATES

A number of U.S. states have enacted comprehensive privacy laws with differing:

applicability thresholds;
definitions;
exemptions;
consumer rights;
sensitive-data requirements;
consent requirements;
targeted-advertising rules; and
operational requirements.

For example, Colorado’s comprehensive privacy law applies only when specified processing thresholds are met.

BBA will evaluate applicable state laws based on:

the Participant’s location;
BBA’s business activity in that state;
the type of information involved;
the volume of information processed;
the purpose of processing; and
applicable statutory thresholds.

Where an applicable state privacy law grants an individual additional rights, BBA will seek to honor those rights as required.

59. CONSUMER HEALTH DATA LAWS

Some U.S. states regulate consumer health data outside traditional healthcare privacy frameworks.

Because Parents or Adult Participants may provide BBA with diagnoses, health history, developmental information, disability-related information, or other information that could fall within a state law’s definition of consumer health data, additional requirements may apply in some jurisdictions.

BBA will evaluate those obligations where applicable.

60. WASHINGTON — MY HEALTH MY DATA

Washington’s My Health My Data Act regulates certain consumer health data and expressly imposes obligations on covered small businesses as well as other regulated entities. Those obligations can include a consumer health data privacy policy, limits on collection or sharing, consumer rights, security requirements, and processor-contract requirements.

Importantly, Washington requires the applicable Consumer Health Data Privacy Policy to be separately and distinctly linked rather than merely incorporated into a general privacy policy.

Therefore, if BBA accepts Washington Participants and BBA’s activities fall within that law, BBA will maintain a separate Washington Consumer Health Data Privacy Policy and any additional consent or rights processes required by applicable law.

This Master Privacy Policy is not intended to substitute for that separate notice when one is legally required.

61. NEVADA CONSUMER HEALTH DATA

Nevada also regulates certain consumer health data and requires covered regulated entities to maintain a consumer health data privacy policy addressing matters including categories of health data collected, sources, use, sharing, third parties, consumer requests, and material changes.

If BBA’s Nevada activities fall within that law, BBA will provide the notices, consent mechanisms, rights processes, security practices, and other measures applicable to those activities.

62. OTHER STATE-SPECIFIC REQUIREMENTS

If another U.S. state imposes privacy requirements applicable to BBA’s services or information practices, BBA may:

supplement this Privacy Policy;
provide a state-specific notice;
obtain additional consent;
provide an additional privacy-request mechanism;
modify a particular data practice; or
limit a service when reasonably necessary for compliance.

PART XV — INTERNATIONAL PARTICIPANTS

63. INTERNATIONAL SERVICES & DATA TRANSFERS

Brain Boost Academy, Inc. is established in the United States.

Individuals outside the United States should understand that personal information provided to BBA may be:

transmitted to the United States;
stored in the United States;
processed in the United States; or
processed in another country where an authorized technology provider operates.

Privacy laws in those locations may differ from the laws of the individual’s country.

When an applicable privacy law requires a particular international-transfer safeguard, BBA will seek to use an appropriate legally recognized mechanism.

64. EUROPEAN ECONOMIC AREA — GDPR

The EU General Data Protection Regulation can apply to a company established outside the European Union when that company offers goods or services to individuals in the EU or monitors their behavior there.

If GDPR applies to a BBA activity, BBA will identify an appropriate lawful basis for processing.

Depending upon the circumstances, the basis may include:

steps requested before entering a contract;
performance of a contract;
consent;
compliance with a legal obligation;
legitimate interests where appropriate; or
another lawful basis available under applicable law.

Where additional legal conditions apply to particular categories of information, BBA will address those conditions as required.

65. EEA PRIVACY RIGHTS

Where GDPR applies, individuals may have rights concerning:

access;
correction;
erasure;
restriction;
objection;
portability;
withdrawal of consent where consent is the basis for processing; and
lodging a complaint with an applicable supervisory authority.

The availability of a specific right depends upon the circumstances and applicable legal basis.

66. INTERNATIONAL TRANSFERS FROM THE EEA

EU data-protection requirements include rules governing transfers of personal information outside the EU.

Where those requirements apply, BBA may rely upon an applicable lawful transfer mechanism, safeguard, or exception recognized under then-current law.

BBA will not represent that it participates in a particular certification or transfer framework unless that representation is accurate at the time.

67. UNITED KINGDOM

The UK GDPR may apply to organizations outside the United Kingdom that offer goods or services to individuals in the UK.

Where applicable, BBA will seek to comply with UK requirements concerning:

lawful processing;
transparency;
individual rights;
security;
processors;
international transfers; and
other applicable obligations.

68. EEA OR UK REPRESENTATIVE

An organization established outside the EEA or UK may, under certain circumstances, be required to appoint a local representative when the relevant GDPR regime applies.

If BBA becomes legally required to appoint such a representative, the applicable contact information will be added to this Privacy Policy or an appropriate jurisdiction-specific notice.

69. CANADA

Canada’s federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) applies in specified circumstances to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities, while provincial laws may apply instead of or alongside the federal framework in some circumstances.

Where Canadian privacy law applies to BBA, BBA will seek to address applicable principles and requirements relating to:

accountability;
identifying purposes;
consent;
limiting collection;
limiting use and disclosure;
retention;
accuracy;
safeguards;
transparency;
access; and
privacy complaints.

70. OTHER COUNTRIES

Privacy requirements vary significantly among countries.

If BBA intentionally offers services to individuals in another jurisdiction, BBA may:

provide additional privacy disclosures;
obtain additional consent;
modify data practices;
use jurisdiction-specific agreements;
implement transfer safeguards;
appoint a local representative when required; or
limit availability of a service

when reasonably necessary to address applicable law.

PART XVI — THIRD-PARTY LINKS & SERVICES

71. THIRD-PARTY WEBSITES

BBA websites or programs may contain links to independent third-party websites, applications, stores, platforms, or services.

BBA does not control the independent privacy practices of those third parties.

Individuals should review the applicable third-party privacy notices before providing personal information directly to those services.

72. THIRD-PARTY ASSESSMENTS & PROGRAMS

Certain BBA evaluations or programs may use third-party:

assessment publishers;
software;
digital programs;
learning platforms;
apps;
testing systems; or
monitoring systems.

Those providers may process information according to their contractual role and applicable privacy requirements.

Where appropriate, BBA may provide additional information concerning a specific third-party system.

PART XVII — PRIVACY POLICY CHANGES

73. UPDATES TO THIS PRIVACY POLICY

BBA may update this Privacy Policy to reflect changes in:

BBA services;
technologies;
vendors;
information practices;
applicable laws;
business operations; or
privacy requirements.

The updated policy will identify its effective or last-updated date.

Where legally required, BBA will provide additional notice or obtain additional consent before materially changing a use of personal information.

74. MATERIAL CHANGES

Depending upon the nature of the change, BBA may provide notice through:

its website;
email;
Client portal;
enrollment platform;
program communication;
updated consent form; or
another appropriate method.

PART XVIII — CONTACTING BBA & EXERCISING PRIVACY RIGHTS

75. PRIVACY CONTACT

Questions, concerns, or privacy requests may be directed to:

Brain Boost Academy, Inc.™

Home of:

BrainChild Blueprint™

BrainChild Breakthrough™

BrainChild Community™

100 Crest Drive #123

Pismo Beach, California 93448-123

United States

Privacy Email: Office@BrainBoostAcademy.com

Telephone: (805) 474-1144

Website: BrainBoostAcademy.com

76. INFORMATION TO INCLUDE IN A REQUEST

A privacy request should contain sufficient information for BBA to:

understand the request;
identify the applicable person or Participant;
locate relevant records; and
verify the requester’s identity or authority when necessary.

BBA should not require information that is disproportionate to what is reasonably necessary to authenticate the request.

77. AUTHORIZED REPRESENTATIVES

Where applicable law allows another individual to submit a privacy request on someone’s behalf, BBA may request documentation reasonably necessary to confirm that authority.

For Minor Participants, BBA may confirm Parent or Legal Guardian authority.

For Adult Participants, BBA may require authorization directly from the Adult Participant unless another legal authority exists.

78. INTERNATIONAL PRIVACY CONTACTS

If BBA becomes legally required to appoint a Data Protection Officer, EU representative, UK representative, Canadian privacy officer, or another jurisdiction-specific privacy contact, that information will be added to this Privacy Policy or a supplemental privacy notice.

OUR PRIVACY COMMITMENT

Brain Boost Academy works with children, teens, young adults, Parents, Adult Participants, and families, and we recognize that the information families share with us can be personal and important.

We take that trust seriously.