Privacy Policy

ResonantVibe LLC — VAVE

Version 2.24

Effective Date: September 28, 2026

Last Updated: October 10, 2026

Applicable to users in the United States

1. Introduction

At ResonantVibe LLC ("ResonantVibe," "Company," "we," "us," or "our"), we respect your privacy and are committed to protecting it through our compliance with this Privacy Policy.

This Privacy Policy describes the types of information we may collect from you, or that you may provide, when you use any of the following (collectively, our "Services"):

• our website located at resonantvibe.com (our "Website");
• any VAVE System you use — VAVE Nidra 6 (6.2, 6.3 or 6.4), VAVE Nest 4 (4.2), VAVE Nest Plus 6 (6.4), VAVE Go, VAVE Perch, Great VAVE or VAVE Lounge (each model is named for its MRFT engine's channels; the number after the dot is the configuration, its vibration positions. VAVE Nidra 6.3 has 3, and a bolster added later makes it a 6.4) — each of which contains a VAVE Player (the on-board playback and control computer) and delivers a session through multi-channel vibroacoustic transducers and audio (typically via headphones). Every VAVE System delivers music and vibration. PEMF (delivered through a biomat layer), light, and virtual reality are planned modalities and are not currently included in any VAVE System: they are not add-on modules, they cannot be purchased, and no payment enables them (collectively, a "Device" or "VAVE System");
• where present, a VAVE Streamer (a room-level network and cache device that synchronizes multiple Players) and a VAVE Core (a venue-level device that synchronizes multiple Streamers);
• the biofeedback sensors that integrate with a VAVE System as its Biofeedback layer — the InteraXon Muse S Athena headband (a third-party device measuring brain activity (EEG) and heart rate) and, if and when voice analysis is offered and you enable voice biofeedback, a microphone capturing voice-derived acoustic features — measuring your physiology before, during, and after a session, together with similar measurements from any future sensor we support (see Section 3.3);
• our VAVE App, the companion mobile/desktop application you use to select a Device and session, enable features such as the Biofeedback module, and view your history (our "App");
• our VAVE Hub, an extended professional application for wellness centers and multi-room/multi-Streamer venues — covering group-session control, live-performance curation, network policy (which unit handles Wi-Fi vs. Ethernet), and, for wellness-center customers, CRM, membership, booking, and staff management (our "Hub"; see Section 3.6);
• the operating software running on the Player/Streamer/Core that keeps hardware, sensors, App, and Backend in sync (our "Session Software"); and
• the VAVE Ecosystem Backend, our cloud infrastructure that holds the account, entitlement, consent, session-history, and biometric records described throughout this Policy (our "Cloud Services" or "Backend").

This Policy also describes our practices for collecting, using, maintaining, protecting, and disclosing your information, and applies to information we collect through the Website, a VAVE System (including its Streamer/Core, Session Software, and integrated Biofeedback sensors), the App, the Hub, and the Cloud Services, as well as in email, text, push notification, and other electronic messages between you and us.

It does not apply to information collected by us offline through means unrelated to the Services, or by any third party — including the manufacturer of the Muse S Athena headband (InteraXon Inc.) — except as this Policy specifically describes.

Certain topics below are governed in more detail by standalone documents that supplement this Policy and control where they conflict with it for their specific subject matter: our Biometric Data Policy (Illinois/Texas biometric law, Section 11), our Consumer Health Data Privacy Policy (Washington/Nevada consumer health data law, Section 12), and — for wellness-center and practitioner customers — a separate Hub data policy (Section 3.6). Our retention schedule is Section 13 of this Policy. By using our Services, you agree to this Privacy Policy and, where applicable, those supplementary documents. This Policy may change from time to time (see Section 27, "Changes to This Policy").

2. Age, Eligibility, and Research Eligibility

Our Services are for adults only. A VAVE account may be created and held only by a person 18 years of age or older, who must accept the General Medical Disclaimer, Waiver & Health Acknowledgment before the account is activated for sessions. No one under 18 may use a VAVE System or provide personal information to or through our Services. We do not knowingly collect personal information from anyone under 18 (and in no event from children under 13, consistent with COPPA). If we learn that we have collected personal information from a minor in violation of this Section, we will delete it. If you believe we might have collected such information, contact us using the information in Section 28 ("Contact Us").

Participation in a named ResonantVibe research study (Section 10.2) likewise requires that you be at least 18 years old, in addition to meeting that study's specific eligibility criteria. The general, in-app research consent described in Section 10.1 is offered only to account holders, who must be 18 or older.

3. Information We Collect About You and How We Collect It

We collect several types of information from and about users of our Services, including information by which you may be personally identified ("personal information"); information concerning your physical, physiological, or biological state, such as EEG, heart-rate, and, if and when voice analysis is offered, voice-derived data ("Biofeedback Data," see Section 3.3), which is sensitive health and/or biometric information under state law; information that is about you but does not by itself identify you; and information about your devices, internet connection, and usage of the Website, App, Hub, and Cloud Services.

We collect this information directly from you; automatically, through a VAVE System, its Session Software, the App, the Hub, the Website, and the Cloud Services; and from third parties such as business partners, payment processors, Covered Customers (Section 8), and research partners.

3.1 Information You Provide to Us

• account and registration information, such as your name, email address, phone number, date of birth, password, and shipping or billing address (a postal address on your App profile is optional);
• health-profile information you provide through the General Medical Disclaimer and condition screening flows (see Section 3.5 for how acceptance records are kept);
• purchase and transaction information, including order history and, where applicable, payment information, which depends on what you are buying: for VAVE System purchases, which are paid by ACH bank debit, we collect bank-account details — your bank account and routing numbers and the associated ACH debit authorization records — processed by Stripe, our third-party payment processor; for subscriptions, in-app purchases, and small accessories, we collect payment card information, likewise processed by Stripe. ResonantVibe does not store your full bank-account or payment-card numbers — Stripe processes them on our behalf;
• for wellness centers, practitioners, and professional users: professional credential information submitted for practitioner-license verification, and training-attendance records for Curators and Facilitators (currently proof-of-attendance only — we do not yet operate a formal certification body);
• profile information you provide, such as your gender, height, weight and wellness goals;
• correspondence, if you contact us for support or otherwise; and
• survey responses, contest or promotion entries, and feedback you provide to us.

3.2 Information We Collect Automatically Through the Website

As you navigate the Website, we and our service providers may use automatic data collection technologies (see Section 4, "Cookies and Other Tracking Technologies") to collect traffic data, referring/exit pages, and the resources you access; information about your device and internet connection, including IP address, operating system, and browser type; and your search queries on the Website.

3.3 Information We Collect Through a VAVE System and Its Biofeedback Sensors

A VAVE System's Player, and where present its Streamer and Core, do not hold any information about who is using them beyond a randomly generated, pseudonymized session identifier. The Biofeedback layer that measures your physiology before, during, and after a session consists of one or more of: the Muse S Athena headband (which captures brain activity (EEG) and heart-rate signals) and, if and when voice analysis is offered and you enable voice biofeedback, a microphone (which captures voice-derived acoustic features), together with any future sensor we support (collectively, "Biofeedback Data"). The App lets you choose your Device and session and enable or disable the Biofeedback module and other features.

When the Biofeedback module is enabled, encrypted Biofeedback Data is uploaded from the Device to our storage on Amazon Web Services (AWS) — the session database that holds session metadata and derived biofeedback measures ("deltas") and Amazon S3 object storage for raw biometric recordings where the Raw Biometrics Storage module is enabled — operated under our agreement with AWS, tagged only with the session's pseudonymized identifier. Your account identity, consent records, and payment information are held separately, on different Backend infrastructure (our identity and entitlements provider, which holds no physiological data), and are linked to your session data only within our access-controlled Backend — never on the Device itself. What we retain from a session depends on why the data was collected:

• if Biofeedback was enabled for ordinary use (not research), we compute a processed summary ("delta") from the raw sensor readings at session termination and delete the raw readings once the delta is computed. Deltas and session history are retained for up to twenty-four (24) months from your last interaction with the Services, to show you your own session history and run the features you chose, unless you hold an active Extended Data Retention subscription (which retains them while it is active);
• if you hold an active Raw Biometrics Storage subscription and have given its separate consent, the raw readings are also retained for as long as that subscription is active; on lapse, raw data is deleted within ninety (90) days after an export window, and your account returns to delta-only storage;
• if the session is part of a named research study you've separately consented to (Section 10.2), both the raw data and the delta are retained for that study under the research schedule in Section 13. Sessions where you've only given the general research consent (Section 10.1) still follow the ordinary-use rule above — raw readings are deleted once the delta is computed, and only the de-identified delta is used for research.

Regardless of which path applies, you can only ever view your own delta/summary (and, with Raw Biometrics Storage, your own raw) data in the App — never another user's — shown as your Activity history for the period your subscription tier allows (see Section 3.4). We handle this Backend linkage between your identity and your Biofeedback Data under administrative, physical, and technical safeguards (see Section 14); however, because the Backend does retain the ability to connect a session back to your identity, this is best described as a secure, access-restricted pseudonymization architecture rather than full de-identification — the data does not become legally "de-identified" unless and until identifiers are irreversibly removed (see Section 10 on how we handle research data differently).

The Muse S Athena headband is a third-party product (manufactured by InteraXon Inc.); its firmware and any companion app provided directly by that manufacturer are governed by InteraXon's own privacy practices, not this Policy (see Section 26, "Third-Party Links and Services").

3.4 Information We Collect Through the App

• account and authentication information;
• Device selection, pairing, and session data, including session duration, settings used, and, where applicable, your Biofeedback Data delta described in Section 3.3;
• session and diagnostic metadata generated by our Session Software, such as start/end times, Bluetooth/Ethernet connection status, and software version ("Device Data");
• information you enter into the App, such as goals, notes, or journal entries;
• with your permission, your device's camera, used only to scan the QR code on a VAVE System when you set up the System or check in for a session; the App reads the code on your device, and no image or video is sent to us or stored;
• with your permission, location access, which iOS and Android require before the App can read the name of the Wi-Fi network your phone has joined; the App uses that permission only to confirm that your phone joined your VAVE System's network while you add the System, never reads your position, and sends us no location;
• with your permission, access to your local network, which the App uses to find your VAVE System and to start and end sessions on the System; and
• with your permission, information from your mobile device's operating system, such as push notification tokens. The App does not connect to Apple Health or Google Fit.

What history you can see in the App, and for how long, depends on your subscription tier: Base shows only the current day's session metadata (no Biofeedback Data); Home tier and above show your full personal history and Biofeedback Data summaries where you've consented to the Biofeedback module; Pro adds privacy-scoped client session records for practitioners; and Center adds center-wide audit views. If your subscription lapses, the App's display reverts to the Base-tier view, but your underlying history is not deleted by the lapse itself — see Section 13 for how long we actually keep it.

3.5 Information We Collect Through the Cloud Services (Backend)

The Backend is the system of record for your account, consent records, entitlements, session history, and Biofeedback Data. Consent records include each acceptance of the General Medical Disclaimer and any condition-triggered risk acknowledgment or modality override — in each case with the exact form version presented, the acceptance timestamp, and your authenticated account, retained with your account records. The Player, Streamer, Core, and App display or transit data; only the Backend permanently records it, under the access architecture described in Section 3.3. See Section 14 ("Data Security") for more on how the Backend and our storage providers protect this information.

3.6 Information Handled Through the VAVE Hub

The Hub is an extended version of the App used to run and configure multi-room and multi-Streamer group sessions, give Curators live-performance control, and manage which unit on a network handles Wi-Fi versus Ethernet. For wellness centers and practitioner customers, the Hub also provides CRM, membership, booking, and staff-management functionality. All Hub data — including a center's client records, staff information, and membership/billing data — is still recorded and controlled by our Backend, on the same infrastructure and under the same security measures described in this Policy. However, because this practice-management data raises distinct considerations (employment data, franchise/CRM data, and a wellness center's own client relationships), the detailed rules governing it are set out in a separate Hub data policy rather than fully restated here. This Policy's role-based access rules (Section 6) apply to Hub-mediated client data in the meantime, and in a professional deployment the signed agreement between the organization and us governs how health information is handled (Section 9).

3.7 Information Collected for Research Studies

If you apply to or participate in a named ResonantVibe research study (currently offered as pilot studies), we collect additional information beyond ordinary Service use, under a separate, study-specific informed consent process (see Section 10.2):

• general and medical/health-conditions screening responses used solely to determine your eligibility and safety for a study (for example, implants, pregnancy, seizure history, skin sensitivity, medications, and recent surgery);
• raw and processed Biofeedback Data collected during study sessions — including EEG and heart rate, and any further signal named in that study's consent form — associated with a study-specific pseudonymized participant ID rather than your name;
• survey and self-report responses about your experience; and
• if you separately agree on a Media Release Form, photographs or video recordings of you, at the permission level you select (private documentation only, educational/presentation use, or public media) — never used for commercial promotion or advertising without your further, separate, explicit permission.

3.8 Information We Collect from Third Parties

• business partners and resellers who help us fulfill orders or provide the Services;
• payment processors, who confirm that a transaction was completed; and
• Covered Customers (Section 8) or research partners who share information back with us in connection with your care or study participation.

3.9 Guests and Operator-Run Participants (Pre-Session Confirmation)

You do not need a VAVE account to receive a session — for example, as a guest in a household or as a participant in a session run by an Owner, Operator, Facilitator, or a Covered Customer's staff. Before your first session, however, you complete a short pre-session confirmation flow on your own phone, through which we collect: a contact channel you choose (an email address or a mobile number for SMS), your name as you type it to sign the General Medical Disclaimer, your date of birth (used to verify the adults-only rule in Section 2), and the health attestations of the General Medical Disclaimer and condition screening — each recorded with the exact form version presented and the acceptance timestamp, in the same manner as the account-holder consent records described in Section 3.5.

If you do not complete this flow on your own phone, the person running your session may instead confirm to us that they checked your age, shared the General Medical Disclaimer with you, and that none of its listed conditions applies to you (Terms of Use §15). In that case we keep that person's confirmation and collect nothing that identifies you, and your session is recorded as a Private Mode session is (Section 6), under that person's account.

We collect and use this information for safety and incident-record purposes only: verifying your eligibility, delivering the confirmation and any safety notices for your session, and maintaining the record of your attestation. Completing this flow makes you an identified data subject even though you hold no account, and you have the same rights of access, correction, and deletion over this information as an account holder (Sections 12, 18, and 19, as applicable), exercisable without a VAVE account by email to privacy@resonantvibe.com or by phone at +1 (303) 222 0963.

Guest pre-session confirmation records are retained for twenty-four (24) months from the session date and are then deleted; if an incident occurs, that person's record moves to our separate incident file. If you ask us to delete your data, we delete your contact details, your name and your date of birth within thirty (30) days of your request; your pre-session safety confirmation (your screening answers, your acceptance of the General Medical Disclaimer without your name, and, in place of your date of birth, only a yes that you passed the adults-only check) stays for those twenty-four (24) months as the safety record and is then deleted. We do not use a contact channel collected through this flow for marketing: we will not send marketing email or text messages to it unless you separately give express consent to receive them (consistent with the TCPA), and providing your email address or mobile number in the pre-session confirmation flow is not such consent. ResonantVibe does not currently send marketing or promotional text messages to anyone, on any consent basis (see Section 18); the separate express-consent rule stated here therefore operates today for email, and would govern text messages only if a marketing text program were ever introduced.

4. Cookies and Other Tracking Technologies

We use cookies and similar technologies on the Website in up to four categories, and our consent banner names only the ones the Website uses: essential cookies that make the Website work, such as security and remembering your cookie choice, and can't be switched off; page statistics, which help us understand how the Website is used and which we collect with HighLevel for our own use only; chat, which loads our HighLevel chat and stores a chat session and the pages you visit on your device; and video, which loads videos embedded from YouTube or Vimeo, services that store data on your device. We use no advertising cookies: our consent banner keeps advertising pixels, session recording and product analytics from running, whatever you choose. We apply one consent standard to every visitor, in every territory: no non-essential cookie or similar tracking technology is set until you have affirmatively consented to it. Our consent banner asks for your prior, opt-in consent before any non-essential cookie is set, and you can give or withdraw that consent at any time from the "Cookie Settings" link in the Website's footer. When your browser sends a Global Privacy Control (GPC) signal, we honor the signal as an opt-out request: we record your opt-out of the sale or sharing of your personal information as soon as you arrive, and page statistics stay off while the signal is on.

We do not use cookies to collect Biofeedback Data, and session data from a VAVE System is never shared with advertising networks. Our Cookie Notice sets out the cookies we set, their providers, and durations.

5. How We Use Your Information

• provide, operate, and maintain the Website, App, Hub, VAVE Systems, and Cloud Services;
• create and manage your account, and process orders, subscriptions, and seat/module add-ons;
• administer the General Medical Disclaimer and screening flows, including recording a condition you report and letting you proceed only after your recorded acknowledgment (physician clearance confirmed, or risks accepted);
• operate real-time session features, such as displaying live Biofeedback readings through the App during a session;
• generate session history, trends, and personalized insights based on your Biofeedback Data delta and usage over time, consistent with your consent and subscription tier;
• where you've separately authorized it, share your data with a Covered Customer's Hub account (Section 8) or use de-identified session data or study data for research (Section 10);
• provide customer support and respond to your inquiries;
• send you administrative communications, including about your account, orders, security, and changes to our Services;
• send you marketing communications, where permitted and consistent with your preferences — we do not send marketing or promotional text messages (see Section 18);
• monitor and improve the Services, including through aggregated or de-identified analysis;
• detect, prevent, and address fraud, security incidents, and technical issues; and
• comply with our legal obligations and enforce our agreements.

We do not use your Biofeedback Data for any purpose other than those described in this Policy without your additional consent. We do not sell your personal information — including Biofeedback Data or consumer health data — and we do not use third-party advertising trackers or data brokers.

6. Roles and Data Access

Because VAVE Systems are often shared — in a household, a studio, or a multi-room venue — who can see what depends on your role:

Private Mode is a workflow an operator may use under a qualifying business agreement with us. In a Private Mode session we do not record who the participant is, biofeedback is not available, and the session counts toward the System's usage total without being attributed to a person; the operator is responsible for the participant's consent, age confirmation, and identity records under that agreement. Private Mode is not offered to individual accounts and is not part of any subscription tier.

8. How We Disclose Your Information

We may disclose aggregated information, and information that does not identify any individual, without restriction. We do not sell, rent, or share your personal information — including Biofeedback Data — with third parties for their own marketing purposes, and we do not use third-party advertising trackers or data brokers. We may disclose personal information, including Biofeedback Data, only as follows:

• to our subsidiaries and affiliates — currently the four affiliated entities named below and in Section 15, each bound to handle personal data consistently with this Policy and under an intercompany data agreement that defines the permitted data fields as an allowlist: Resonaid, our commonly owned nonprofit research organization, which is the only affiliate that receives health or biometric data, and only from consenting study participants (Section 10); Resonod and Resonan WellNest, our service and field-operations affiliates, which receive commercial client information only — contact details, model, serial number, fault description, service and parts history, and hardware-only telemetry (such as amplifier temperature, transducer impedance, power-rail voltages, error codes, and firmware version) — with Biofeedback Data, session content, and session counts or usage patterns expressly excluded; and Resonarah, our franchise program, which receives only business and contact data relating to clients within the franchise network, and no Biofeedback Data, consumer health data, session content, or usage patterns;
• to contractors and service providers we use to support our business — for example, Amazon Web Services (hosting and storage of physiological data), Supabase (identity, authentication, and entitlements), Cloudflare (content delivery), and Stripe (our payment processor) — who are contractually bound to keep personal information confidential and use it only for the purposes for which we disclose it to them; Section 15 is the current roster of our sub-processors;
• to a Covered Customer's Hub account, or a research partner, as described in Sections 8.1 and 10;
• to a buyer or other successor in a merger, divestiture, restructuring, or sale of some or all of ResonantVibe LLC's assets, subject to appropriate confidentiality and security obligations;
• to comply with any court order, law, or legal process, including a government or regulatory request;
• to enforce our Terms of Use, Terms of Sale, or other agreements; and
• if we believe disclosure is necessary to protect the rights, property, or safety of ResonantVibe LLC, our users, or others.

8.1 Sharing with a Covered Customer (Wellness Center or Practitioner)

Some of our customers are wellness centers, clinics, or individual practitioners ("Covered Customers") who use the Hub in a professional capacity. If you receive a VAVE session through a Covered Customer, or you designate one to have access to your data, we share the applicable session data and Biofeedback Data with that Covered Customer's Hub account for purposes of your care or the coaching relationship you have with them.

For consumer, direct-to-consumer use of the Services — that is, where you use a VAVE System, the App, and your own account without going through a Covered Customer — your data is protected by this Policy, our Consumer Health Data Privacy Policy (Section 12), and applicable state law.

If you receive VAVE sessions through a professional deployment, such as a clinic or a practitioner's practice, the signed agreement between that organization and us governs how health information is handled in that deployment.

Separately, our agreement with each Covered Customer permits ResonantVibe to use de-identified data derived from sessions delivered through their account for our own research and product-improvement purposes — we only ever use this data in de-identified (unidentified) form, never in a way that identifies you. That agreement requires the Covered Customer to disclose this practice to their own clients through their own intake, consent, or privacy materials, so you should also expect to see it disclosed there if you receive VAVE sessions through a Covered Customer.

9. Professional Deployments

If you use the Services as part of a professional deployment, such as a clinic or a practitioner's practice, the signed agreement between your organization and us governs how health information is handled in that deployment. Your individual, consumer use of a VAVE System is protected by this Policy and, where applicable, our Consumer Health Data Privacy Policy. In every context we maintain administrative, physical, and technical safeguards, including encryption in transit and at rest, role-based and logged access, workforce training, and a designated privacy and security officer, reachable at privacy@resonantvibe.com.

10. Research Use of Your Data

10.1 General Research Consent (Shown Before Any Session)

Separate from the named research studies described in Section 10.2, the App may ask you — before you start any ordinary session, not just as part of a formal study — whether you're willing to let us use that session's data for research purposes beyond running the session itself, such as product improvement, internal analysis, or academic publication and collaboration. This prompt is optional and opt-in: if you decline, or simply don't respond, your data is used only to provide you the session and the ordinary features described elsewhere in this Policy. This general research consent is offered only to account holders, who must be 18 or older (Section 2).

• Only de-identified (unidentified) data is used for this general research purpose — we do not use your identified Biofeedback Data for research this way, even if you opt in.
• You can change this preference at any time in Settings → Privacy → Research Preferences; changing it applies going forward and does not affect research already completed using data from earlier sessions.
• This general, in-app consent is separate from, and does not substitute for, the study-specific Research Informed Consent Form described in Section 10.2, which we use whenever we collect identified data or raw biometric readings for a named study.

10.2 Named Research Studies

Participation in a ResonantVibe research study (our current studies are pilot studies) is entirely separate from ordinary use of the Services, and from the Covered Customer relationship described in Section 8.1. If you apply to or participate in a study, you'll be asked to complete a study-specific screening form and to review and sign a separate Research Informed Consent Form before anything is collected — these describe exactly what will be measured, the risks and benefits, compensation, and your right to withdraw at any time without penalty.

• Your identity is protected by a pseudonymized participant ID; a separate log linking your name to that ID is stored securely, restricted to authorized research personnel, and destroyed once data collection and analysis are complete.
• No personal identifiers are included in the data files used for analysis or publication.
• At the end of your consent form, you separately choose whether we may use your de-identified study data for future research, share it with other researchers, or place it in a data repository; if you decline, your data is used only for the specific study you joined. You may revoke this future-use permission at any time up until the study's data collection and analysis are complete and the data has been pooled and de-identified; after that point, data already incorporated into de-identified research datasets can no longer be withdrawn, and we do not need to come back and ask again before that future, de-identified use.
• Photographs or video recordings are only collected if you separately sign a Media Release Form, and only at the permission level you choose there (private documentation, educational/presentation use, or public media) — never for commercial promotion without your further, explicit permission.
• Identified (not de-identified) research data is never used for a purpose beyond the specific study you consented to. Our current pilot studies are not subject to Institutional Review Board (IRB) review, as explained in the study consent forms; any future study that requires IRB review under applicable law will undergo that review before it begins, and its consent documents will disclose it.

Research participation requires that you be at least 18 years old — the same adults-only rule that applies to all use of the Services (Section 2).

11. Biometric Data (Illinois BIPA / Texas CUBI)

To the extent your Biofeedback Data is treated as a "biometric identifier" or "biometric information" under laws such as the Illinois Biometric Information Privacy Act or the Texas Capture or Use of Biometric Identifier Act, the following applies, and is set out in full in our standalone Biometric Data Policy:

• Purpose. We collect Biofeedback Data only to run the biofeedback features you choose, display your readings, and generate the insights you enable — never to identify you, and never using facial recognition, fingerprints, or voiceprints (if and when voice analysis is offered, voice biofeedback analyzes acoustic features of your voice for wellness insights and is never used to identify you).
• Consent. We collect it only after your informed, written (electronic) consent during App onboarding, describing what is collected, why, and for how long. You may decline and still use a VAVE System's non-biofeedback functions.
• No sale or profit. We do not sell, lease, trade, or otherwise profit from your biometric data.
• Disclosure. We disclose it only to service providers bound by contract to protect it, with your further consent, or as required by law.
• Retention and destruction. We permanently destroy identifiable biometric data when its purpose is satisfied, when you delete your account or withdraw consent, or within twenty-four (24) months of your last interaction with the Services — whichever comes first — including from routine backups on our backup-expiry cycle. This twenty-four-month cap applies to every user, regardless of any Extended Data Retention or Raw Biometrics Storage subscription; an active subscription refreshes your "last interaction" only through your actual use of the Services. Research-study data is retained in coded form under your study consent and, once de-identified, is no longer biometric information under these laws.
• Security. We protect it with encryption in transit and at rest and role-based access controls, at least as protective as how we treat other confidential information.

12. Consumer Health Data (Washington My Health My Data Act / Nevada SB 370)

For consumers those laws protect, this Section supplements this Policy and is set out in full in our standalone Consumer Health Data Privacy Policy, which controls over this Policy for consumer health data where the two conflict.

• What we collect. Biofeedback Data (heart rate, brainwave activity, voice-derived features if and when voice analysis is offered, and similar measurements), health-profile and screening responses, session logs, wellness insights derived from those measurements, and any health information you choose to enter, such as mood tags or notes.
• Why. Solely to operate the biofeedback, screening, and session features you request, display your readings, generate insights, troubleshoot and secure the Services, and comply with law — collected with your consent or as necessary to provide the Services you've requested.
• Consent. Before your first biofeedback session, we ask for your affirmative, opt-in consent; you may withdraw it anytime in Settings or at privacy@resonantvibe.com, without losing access to non-biofeedback functions.
• Sharing. We do not sell consumer health data, and will not without the separate signed authorization the law requires — which we do not currently seek from anyone. We share it only with contracted service providers, a Covered Customer's Hub account where applicable, and authorities where legally required — never with advertising networks, data brokers, or social media platforms, and never for targeted advertising.
• Your rights. You may confirm whether we collect or share your consumer health data; access it, including who we've shared it with; withdraw consent; and have it deleted, including from backups. Exercise these rights at privacy@resonantvibe.com, by phone at +1 (303) 222 0963, or in-app under Settings → Privacy; we respond within the time your state's law requires. If we deny a request, you may appeal, and if the appeal is denied, contact the Washington Attorney General (atg.wa.gov) or the Nevada Attorney General (ag.nv.gov).

13. Data Retention

We keep personal data only as long as needed for the purpose it was collected, then delete or irreversibly de-identify it, on the following schedule:

You can request deletion anytime through Settings → Privacy → Delete, at privacy@resonantvibe.com, or by phone at +1 (303) 222 0963. When you delete your account or ask us to delete your data, we delete your name and the personal data we hold about you, and we delete your Biofeedback Data within 30 days, with backups purged within 90 days. We keep a record that each session took place (the time, the composition, the duration and the VAVE System) without anything that identifies you and without any Biofeedback Data, as in a Private Mode session (Section 6): under the account of the person who ran the session, or, for sessions you ran on your own VAVE System, in that System's history. Where a Covered Customer controls client data through the Hub, deletion follows that Covered Customer's signed agreement with us and its instructions. Research-study data is kept separate from ordinary consumer deletion requests as described in your study consent form, so a consumer account deletion does not inadvertently delete data you consented to provide for research. A legal hold pauses deletion only for the specific records it covers, and only for as long as required.

14. Data Security

• Biofeedback Data is uploaded from the Device tagged only with a pseudonymized session identifier, to our storage on Amazon Web Services (AWS) — the session database for session metadata and deltas and Amazon S3 for raw biometric recordings — operated under our agreement with AWS; your identity, consent, and payment records are held on separate Backend infrastructure that holds no physiological data, linked only within access-controlled systems (Section 3.3). No single provider holds both your identity and your physiological data.
• Biofeedback Data and payment transactions are encrypted in transit and, where stored, at rest.
• Access to identifiable data is role-based and logged, and our workforce receives relevant training.

If a security incident affects your personal data, we will contain and investigate the incident, notify you and the relevant authorities when and as required by applicable law (including, in a professional deployment, the timelines its signed agreement sets), and tell you plainly what happened, what data was involved, and what we are doing about it.

The safety and security of your information also depends on you: keep any password or credential confidential, and don't share it with anyone. Transmission over the internet, Bluetooth, or other wireless connections is never completely secure; although we do our best to protect your information, any transmission is at your own risk, and we are not responsible for circumvention of privacy settings or security measures on the Services.

15. Sub-Processors

We use a limited set of sub-processors to operate the Services, each contractually required to protect personal data — including Biofeedback Data where they touch it — consistent with this Policy, our Consumer Health Data Privacy Policy, and applicable law:

• Amazon Web Services, Inc. — hosting and storage for all physiological data: the session database holding session metadata and derived biofeedback measures ("deltas"), and Amazon S3 object storage for raw biometric recordings where the Raw Biometrics Storage module is enabled — in each case tagged only with pseudonymized session identifiers and processed under our agreement with AWS;
• Supabase — identity, authentication, and entitlements only: account data, credentials, consent records, subscription entitlements, device registrations, and catalog metadata — no Biofeedback Data is stored on or transits this service;
• Cloudflare — content delivery and object storage (R2) for the session audio and program content you listen to, and network and edge services for the marketing Website only — no Biofeedback Data, and no API traffic carrying Biofeedback Data is proxied through Cloudflare's network;
• Stripe — payment processing and subscription billing;
• HighLevel (GoHighLevel) — CRM and customer communications (transactional and, with your consent, marketing), and, with your consent, the Website's page statistics and chat (Section 4), for contact data, correspondence, and Website usage data — no Biofeedback Data;
• Google (Google Workspace) — business email and support correspondence, for contact data and correspondence — no Biofeedback Data.

This Section is the authoritative, current roster of our sub-processors. Our four affiliates, named in Section 8, receive personal data only as that Section describes. We do not currently use a third-party product-analytics provider; if we engage one, we will add that provider to this Section before the provider processes any personal data. We add any new sub-processor to this Section first, and we provide at least 30 days' notice before adding a sub-processor that will process Biofeedback Data; Covered Customers and Hub business customers may subscribe to change notices at privacy@resonantvibe.com.

16. Device Transfer and Ownership Changes

If you sell or transfer a VAVE System to a new owner, the System must be factory reset before the transfer: local caches, session-history and biometric buffers, network credentials, and any Local Cast pairings are wiped. Your own purchases remain on your account and are re-downloadable to your other Systems; the new owner starts with a clean device and must create their own account and accept our Terms of Use. If a Streamer or Core is replaced or decommissioned, any not-yet-forwarded history or biometric buffer is flushed to the Backend, or surfaced to the Owner, before decommissioning.

17. Automated Decision-Making and Profiling

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects concerning you, and we do not currently generate automated personalized recommendations from your Biofeedback Data. If we introduce such a feature in the future, we will update this Policy before it launches, explain the logic involved and the significance of the processing, obtain your explicit consent before any such processing of your data occurs, and provide the rights applicable law requires — including the right to obtain human review, contest a decision, and express your point of view.

18. Your Privacy Choices

• Cookies. Manage or refuse cookies through your browser or our "Cookie Settings" control; refusing some cookies may affect Website functionality.
• Marketing Communications. Opt out of marketing emails or push notifications by following the unsubscribe instructions in those messages, or by adjusting your notification settings in the App. We do not send marketing or promotional text messages. Transactional and service text messages — delivery and shipping notifications, service scheduling and reminders, support replies, and account and security notices — are governed by our SMS Terms, and you can stop them at any time by replying STOP to any message.
• Biofeedback and Biometric Data Consent. Withdraw your consent to Biofeedback Data collection anytime through the App's settings or by contacting us — non-biofeedback functions keep working.
• Covered Customer Sharing and Research Participation. You control whether to share your data with a Covered Customer (Section 8.1) or participate in research (Section 10), and may withdraw either on a going-forward basis.

Residents of certain states may have additional rights and choices; see Section 19 below.

19. Your U.S. State Privacy Rights

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we use sensitive personal information (including Biofeedback Data) only to provide the Services you request, there is generally no separate "limit" step needed to protect it — though the right remains yours.

State consumer privacy laws may provide their residents with additional rights, including, as of the date of this Policy, in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia, among others. Depending on where you live, you may have the right to:

• confirm whether we process your personal information;
• access and delete certain personal information;
• correct inaccuracies in your personal information (this right may not apply in Iowa or Utah);
• receive a copy of your personal information in a portable format;
• opt out of processing for targeted advertising (not applicable, as we do not engage in it), sale (not applicable, as we do not sell data), or certain automated profiling (see Section 17 — we do not currently engage in such profiling); and
• limit or require consent for processing sensitive personal information, including Biofeedback Data.

To exercise these rights, contact us using the information in Section 28. We will verify your request as applicable law requires, and will not discriminate against you for exercising your rights.

25. International Data Transfers

We are based in Denver, Colorado, and our Cloud Services are hosted with the United States-based providers described in Section 15 — all physiological data on Amazon Web Services, identity and entitlements on separate infrastructure, and session content delivered via Cloudflare's network. The Services are currently offered in the United States, and your personal information, including Biofeedback Data, is processed in the United States.

26. Third-Party Links and Services

The Website, App, Hub, and VAVE Systems may link to or integrate with third-party products or services not owned or controlled by us — including the Muse S Athena headband (InteraXon Inc.) described in Section 3.3. This Policy does not apply to those third parties; we encourage you to review their privacy policies before connecting them to your account.

27. Changes to This Policy

We post any changes we make to this Privacy Policy on this page and update the "Last Updated" date at the top. If we make material changes to how we treat your personal information, we will notify you through a notice on the Website, App, or Hub, or by other means required by applicable law. You are responsible for keeping an up-to-date, active, deliverable email address on file, and for periodically reviewing this Policy.

28. Contact Us

If you have questions about this Privacy Policy, including its retention schedule in Section 13, or about our standalone Biometric Data Policy or Consumer Health Data Privacy Policy, or if you wish to exercise any of the rights described above, please contact us at:

ResonantVibe LLC

42 W Byers Pl., Denver, Colorado 80223

Privacy and data-rights requests: privacy@resonantvibe.com or +1 (303) 222 0963

General customer support: support@resonantvibe.com

Orders and purchasing: sales@resonantvibe.com

ResonantVibe LLC. Privacy Policy, v2.24.‍