Privacy notice

Effective 18 July 2026. Questionnaires are processed locally in your browser by default. The optional, disabled-by-default Brazil account pilot covers only records that an email-verified user who self-attests that they are 18 or older and live in Brazil explicitly chooses to save.

Public controller and retention details

Controller legal name: Guilherme Passero
Country: Netherlands
Privacy and support email: contact@nuracheck.com

Privacy at a glance

Questionnaires work locally in the website by default: no advertising, behavioural analytics or automatic upload. You choose session-only or longer browser storage and can delete it at any time. A completed record can leave your device only through the separate, disabled-by-default Brazil account pilot after every eligibility, consent and explicit-save condition is met. Contact contact@nuracheck.com for privacy requests without sending answers or detailed medical information.

Controller and contact

NuraCheck is a service operated by Guilherme Passero, an individual established in the Netherlands. NuraCheck is the service name and is not presented as a registered trade name. For privacy, support or accessibility requests, email contact@nuracheck.com.

Data kept on your device

Questionnaire answers, progress and calculated results stay on your device according to your session or persistent-storage choice. Persistent data uses browser storage and remains until you delete it in NuraCheck or clear the relevant browser storage. A print or download you explicitly create leaves NuraCheck; any resulting copy is controlled by you and the selected destination.

Optional account and cloud records

The controlled website pilot is limited to email-verified users who self-attest that they are 18 or older and live in Brazil. Supabase Auth processes email, password hash, verification and session data for the website pilot. NuraCheck stores account consent state and completed records in an EU-jurisdiction Cloudflare D1 database. Each health record is encrypted in the Worker before D1 storage. D1 does not store email. Raw answers leave the browser only after separate health-data consent and an explicit save action for that result.

Technical data and providers

Cloudflare hosts and protects the website and may process request metadata needed to deliver it securely. Persisted Workers logs, observability and application analytics are disabled. Calling, texting or opening an external website is an explicit user action handled by the operating system or another service under its own privacy terms. If the website account pilot is enabled, Cloudflare D1 stores encrypted account records. Supabase provides authentication and automatically records security events such as signup, login, password changes and logout; those records may include event time, account subject ID, IP address and browser or device information. Zoho Mail sends tracking-free numeric-code authentication email and processes messages voluntarily sent to contact@nuracheck.com. Authentication email and Supabase Auth audit events never receive questionnaire identity, answers, scores or bands. NuraCheck has no advertising or behavioural analytics.

Purposes and legal bases

Local-only questionnaire processing in the website is initiated by you, remains under your control and is not received by NuraCheck. The requested, separate website account service uses GDPR 6(1)(b) and LGPD 7(V). Separate cloud health-data processing relies on explicit consent under GDPR 6(1)(a) and 9(2)(a), and LGPD 7(I) and 11(I); every upload requires another save action. Minimized provider security and deletion evidence uses applicable legal-obligation or legitimate-interest bases under GDPR 6(1)(c)/(f) and LGPD 7(II)/(IX). Correspondence is processed to answer your request and meet applicable rights duties. Cloud consent can be withdrawn without deleting the login account; withdrawal deletes active cloud questionnaire records and blocks future uploads.

Retention

Website session data ends with the browser session. Persistent local data remains until you delete it using the product's controls or clear the relevant browser storage. Completed website cloud records remain until you delete them, withdraw cloud health-data consent or delete the account. Unverified identities are scheduled for deletion after seven days; verified identities remain for the account life. Recovery-code hashes remain until use, regeneration, MFA removal or account deletion, and deletion jobs remain only until provider deletion succeeds. Active D1 records are deleted immediately, while encrypted Time Travel residuals may remain for up to seven days. A random, non-identifying deletion receipt is retained for five years. Authentication email and provider security logs use the shortest approved setting where configurable and otherwise follow approved provider terms. Contact case records may remain for up to five years after closure; unnecessary sensitive attachments and free text are deleted within 90 days after closure.

International transfers

Optional account records are stored in a D1 database created with EU jurisdiction. Brazil-to-EU transfer relies on ANPD Resolution 32/2026's EU adequacy decision. Provider request handling may still occur in other documented locations, so jurisdiction is not an execution-location guarantee.

Your choices and rights

You can delete local questionnaire data in the website at any time. A signed-in website pilot user can inspect saved answers, export all cloud records, delete one cloud record, withdraw cloud health-data consent to delete every active cloud record while keeping the login account, or delete the account. Depending on local law, you may also request access, correction, deletion, restriction, portability or objection for account, technical or correspondence data. Email contact@nuracheck.com; we aim to acknowledge requests within ten business days, while statutory response periods still apply. Do not include questionnaire answers or detailed medical information in email.

United States privacy disclosures

NuraCheck does not sell personal information, share it for targeted advertising, use questionnaire data for profiling or offer financial incentives for data.

Adults only

NuraCheck is intended only for people aged 18 or older and requires an age confirmation before a questionnaire starts. It does not knowingly accept questionnaire or contact information from children. Anyone under 18 must not continue and should use Delete your data to remove any local questionnaire state.