Privacy notice

Working draft. This notice is written to align with the Mauritius Data Protection Act 2017. It should be reviewed by a qualified person or your data protection officer, and the provider and retention details confirmed, before launch.

Last updated: 15 June 2026. Effective from: 15 June 2026.

Who we are

NeuroFlex is operated by NeuroFlex Ltd, a company registered in Mauritius under business registration number C26231112, with its registered office in Port Louis, Mauritius. For the purposes of the Data Protection Act 2017, we are the data controller for the personal data described here. As the Act requires, we are registered as a controller with the Data Protection Office of Mauritius.

For any question about this notice or your personal data, contact us at hello@neuroflex.mu or through our contact page.

What this notice covers

It explains what personal data we collect when you use this website, the shop, the enquiry and training forms, and the family account and dashboard, why we use it, the lawful basis we rely on, who we share it with, how long we keep it, and the rights you have.

What we collect

Shop and orders: your name, contact details, delivery address, the items you order, and order history. Payment is handled by our payment provider, and we do not store full card details.
Enquiries and training: the name, email and message you send through our forms, and the programme you ask about.
Family account and dashboard: your account email, and the information you choose to add about a child, such as a name or initials, an optional birth year, and the progress notes you write, including any products you link to them.
Optional contribution to our statistics: if you choose to, after an order you can share a few details about the child or adult the tools are for, such as an age, the main areas of need, and your region. This is always optional, and we anonymise it.
Technical: basic information your browser sends, such as approximate location and device type, and small items stored on your device, described under Cookies below.

Children’s and health-related data

The information you may add about a child in the dashboard can reveal their developmental or health needs. Under the Act this is special category data, and it receives extra protection. We process it only with your specific, informed consent, given when you choose to add it, and only to provide the dashboard to you. The account is for parents and caregivers, the data is private to your account, and we ask you to share only what is genuinely useful to you. You can withdraw consent, and remove the data, at any time.

Why we use it, and our lawful basis

To take and fulfil orders and provide the service you asked for. Basis: performance of a contract.
To reply to enquiries and arrange training. Basis: your consent, or steps taken at your request before a contract.
To provide the family dashboard, including any child information you add. Basis: your consent, with specific consent for special category data.
To run and secure the website and keep records we are required to keep. Basis: our legitimate interests and our legal obligations.
To build anonymous statistics and research that help us understand local needs and support more families, using only the details you choose to contribute, which we anonymise. Basis: your consent.

We do not sell your personal data, and we do not use it to build advertising profiles.

Cookies and local storage

We keep this light. We do not use third party advertising or analytics trackers, and our fonts are served from our own site rather than a third party. We store a small amount of information on your device so the site works: your language choice, your cart, your calm mode preference, and a record that you have seen our consent notice. The family account uses your browser’s storage to keep you signed in. You can clear these through your browser at any time.

Who we share it with

We share personal data only with the service providers who help us run NeuroFlex, and only as far as they need it: our website hosting, our database and backend, and our payment provider. These providers act on our instructions. We may also disclose data where the law requires it.

Where your data is processed

Some of our providers process data outside Mauritius. Our website hosting and our database are provided by reputable platforms whose servers may be located abroad, including in Europe. Where personal data is transferred abroad, we do so in line with the Act, on the basis of appropriate safeguards or your consent, and we take steps to keep it protected to a comparable standard.

How long we keep it

We keep personal data only for as long as we need it for the purpose it was collected. We keep order and tax records for seven years to meet our legal and accounting obligations. Account and child information is kept while your account is open and deleted when you close it.

Where you choose to contribute details for our statistics and research, we anonymise and aggregate them so they no longer identify you or your child. This anonymised information is no longer personal data, and we keep it for an indefinite period so we can carry out long-term analysis and comparison that helps us understand local needs and support more families.

How we protect it

We take appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, and we limit access to those who need it.

Your rights

Under the Data Protection Act 2017 you have the right to:

ask what personal data we hold about you, and get a copy;
have inaccurate data corrected;
have your data erased, or its use restricted;
object to certain uses of your data;
withdraw consent at any time, without affecting use before you withdrew it;
not be subject to a decision based solely on automated processing.

You can download your data and delete your account at any time from your account settings. Deleting your account removes every child record and note with it. For any other request, contact us at hello@neuroflex.mu, and we will respond within the time the Act allows.

Complaints

If you are not satisfied with how we handle your data, you can complain to us first, and you also have the right to lodge a complaint with the Data Protection Office of Mauritius (dataprotection.govmu.org).

Changes to this notice

We may update this notice from time to time. We will change the date at the top, and where the change is significant we will make it clear.

Contact

For anything about your data, email hello@neuroflex.mu or visit our contact page.