Your Privacy Matters: Human First AI is committed to protecting your personal data and being transparent about what information we collect and how we use it. This policy explains how we handle your data in compliance with GDPR (EU) and PDPA (Singapore).
1. About Us
Human First AI is an AI-powered leadership development and wellbeing platform developed through a collaboration between:
- BrainBank Pte Ltd (Singapore) — Technology development and AI infrastructure
- Human First AI AB (Sweden) — Burnout science, organizational psychology, and EU operations
For users in the European Economic Area (EEA), Human First AI AB acts as the primary data controller. For users in Asia-Pacific, BrainBank Pte Ltd acts as the primary data controller.
Contact: policy@brainbank.world
2. Personal Data We Collect
2.1 Account Information
- Email address
- Name (optional)
- Organization name (if applicable)
- Country/region
- Language preference
2.2 Wellbeing Data (Special Category Data)
We collect health-related data that is considered "special category data" under GDPR Article 9:
- Daily mood and emotional state ratings
- Energy and stress levels
- Sleep quality indicators
- Burnout risk indicators
- Wellbeing trends over time
Important: This data is only processed with your explicit consent and is used solely to provide personalized wellbeing support.
2.3 Conversation Data
- Messages and conversations with Human First AI (our AI coach)
- Journal entries and reflections
- Goals and action items you create
2.4 Usage Data
- Features accessed and learning content completed
- Session duration and frequency
- Device type and browser information
3. Legal Basis for Processing
| Purpose | Legal Basis (GDPR) |
|---|
| Account creation and service delivery | Contract performance (Art. 6(1)(b)) |
| Wellbeing tracking and health data | Explicit consent (Art. 9(2)(a)) |
| AI coaching conversations | Contract performance (Art. 6(1)(b)) |
| Service improvement and analytics | Legitimate interest (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
4. How We Use Your Data
- Personalized Coaching: To provide AI-powered coaching tailored to your wellbeing patterns and goals
- Trend Analysis: To show you insights about your mood, energy, and stress over time
- Content Recommendations: To suggest relevant exercises, articles, and meditations
- Service Improvement: To improve our AI models and platform features (using anonymized/aggregated data)
- Communications: To send service notifications and, with consent, wellness tips and updates
5. AI and Automated Decision-Making
Human First AI uses artificial intelligence to:
- Generate personalized coaching responses
- Identify patterns in your wellbeing data
- Recommend relevant content and exercises
- Provide burnout risk indicators
These AI features are designed to support your wellbeing journey but do not make decisions that have legal or similarly significant effects on you. You always remain in control of your data and can request human review of any AI-generated insights.
6. Data Sharing
We do not sell your personal data. We may share data with:
- Service Providers: Cloud hosting (EU-based for EEA users), AI services (with appropriate safeguards), email services
- Our Partners: Data may be shared between BrainBank and Human First AI for service delivery, subject to appropriate data protection agreements
- Your Organization: If you're on an enterprise plan, your organization may receive aggregated, anonymized team insights only — never individual data without your explicit consent
- Legal Requirements: When required by law or to protect our rights
7. International Data Transfers
As a cross-border collaboration between Singapore and Sweden, your data may be transferred internationally:
- EEA Users: Your data is primarily processed within the EU/EEA. Any transfer outside the EEA (including to Singapore) is protected by EU Standard Contractual Clauses (SCCs) as adopted by European Commission Implementing Decision (EU) 2021/914.
- Singapore Users: Your data is processed in compliance with the Personal Data Protection Act (PDPA) 2012.
We conduct Transfer Impact Assessments where required and implement supplementary security measures to protect your data.
8. Data Retention
- Account data: Retained while your account is active, plus 30 days after deletion request
- Wellbeing data: Retained while your account is active; deleted upon account deletion
- Conversation history: Retained for 12 months, then anonymized
- Anonymized analytics: May be retained indefinitely for research and service improvement
9. Your Rights
For EEA Users (GDPR Rights)
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate personal data
- Erasure: Request deletion of your personal data ("right to be forgotten")
- Portability: Receive your data in a machine-readable format
- Restriction: Request limited processing of your data
- Objection: Object to processing based on legitimate interest
- Withdraw Consent: At any time for consent-based processing
- AI Transparency: Request explanation of AI-assisted decisions
For Singapore Users (PDPA Rights)
- Access: Request information about your personal data
- Correction: Request correction of errors or omissions
- Withdrawal: Withdraw consent for collection, use, or disclosure
To exercise these rights, go to Settings > Privacy in the app, or contact policy@brainbank.world
10. Data Security
- All data encrypted in transit (TLS 1.3) and at rest (AES-256)
- Regular security audits and vulnerability assessments
- Role-based access controls and audit logging
- Data hosted in secure, certified data centers
- Privacy by design principles embedded in development
11. Data Breach Response
In the event of a personal data breach, we will:
- Notify the relevant supervisory authority within 72 hours (GDPR) or as soon as practicable (PDPA)
- Notify affected individuals if the breach poses a high risk to their rights
- Document the breach and remedial actions taken
12. Children's Privacy
Human First AI is not intended for users under 16 years of age. We do not knowingly collect personal data from children.
13. Changes to This Policy
We may update this policy periodically. Significant changes will be communicated via email or through the Service at least 30 days before taking effect.
14. Contact & Complaints
For all inquiries:
BrainBank
policy@brainbank.world
EEA users may also lodge a complaint with the Swedish Data Protection Authority (IMY) or their local supervisory authority. Singapore users may contact the Personal Data Protection Commission (PDPC).