Effective October 2, 2026
NORM Rhythm ("we," "us") is operated by NeuroSpire Labs, Inc., 5416 Alumni Drive NW, Huntsville, AL 35806, USA, (256) 850-4426. NORM Rhythm is a relationship and self-growth program delivered through our mobile app (formerly called Aligned) and on the web. It provides coaching and self-growth support. It is not therapy or medical care (see our Terms).
This policy applies wherever you use NORM Rhythm. Section 12 sets out the additional rights you have in particular countries.
NORM Rhythm lets you record assessment answers, moods, reflections, journal entries and relationship information. We treat this as sensitive personal information. We do not sell it. We do not share it with advertisers. We do not use it to target ads to you, even if you agree to marketing cookies elsewhere. We do not load third-party advertising or social-media tracking technologies (such as the Meta, Snap, TikTok, Pinterest or Google advertising pixels) on any screen where you enter mood, relationship, assessment or private-message content.
You give us:
Collected automatically:
We do not collect precise location, and we do not use third-party advertising trackers.
We use your information to:
Your content is what we use to compute your scores. That is the core function of the program.
We process your data:
You may withdraw that consent at any time by deleting that content or your account.
We use a small number of processors under contract. Each is limited to what it needs:
We do not sell personal information. We do not share your sensitive content with any advertiser or data broker. We may disclose information if the law requires it, to protect someone's safety, or in a business transfer (with notice to you).
Where NORM Rhythm offers to connect you with a licensed therapist, that clinical care is provided by independently licensed professionals under a separate agreement and Notice of Privacy Practices. Information you share in that clinical relationship is protected health information (PHI). It is governed by that provider's HIPAA notice, not by this policy, and it is never used for advertising.
NORM Rhythm is not a healthcare provider and is not a HIPAA covered entity. Not all information we hold is Protected Health Information ("PHI"). PHI means individually identifiable health information created or received by a licensed provider in the course of treatment, payment or health care operations. Examples are clinical session notes, diagnoses, treatment plans, clinical assessments given as part of care, and the billing records that go with them.
Self-help content you create is not PHI. Journal entries, daily check-ins, goals, and assessments you take on your own outside a course of treatment are personal data, protected under this policy. They are not clinical records and are not subject to HIPAA. Where the same instrument is used both ways, the context decides. An assessment taken as part of treatment with a licensed clinician is PHI. The same assessment taken on your own for self-insight is not.
Your mood and relationship information may be "consumer health data" under laws such as Washington's My Health My Data Act. We collect it only to provide the features you use, and only with your consent. We do not sell it or share it for advertising. You may withdraw consent and request deletion (§10).
We keep your data while your account is active.
Closing is not deleting. If your account is closed or deactivated, we keep your data so your history can be restored if you return. Closing an account deletes nothing on its own.
Deleting your account deletes it. You can delete your account in the NORM Rhythm app at Profile → Delete Account, or on the web at norm-rhythm.com/account-deletion. When you do, we permanently erase the data you own in that app:
There is no waiting period. The deletion happens as part of your request, not on a later schedule. We do not archive the data, and it cannot be restored afterwards.
Deleting in one app deletes that app. One NORM login opens every NORM product. Deleting inside one app does not delete the login, and does not touch what other NORM apps hold. To erase the login itself, and everything under it in every NORM product, email support@neurospirelabs.com and we will do it. We ask for that in writing because it is irreversible and reaches beyond the app you are using.
These are the only exceptions:
Accounts that also carry a staff or clinical role are not deleted in-app. We route those requests to support, because those records are subject to legal retention periods.
Wherever you live, you can access, correct, export or delete your data:
We do not sell your personal information or "share" it for cross-context behavioral advertising. California and other US states (CCPA/CPRA and similar laws): you have the rights to know, delete, correct and opt out.
We use encryption in transit, access controls and agreements with our providers. No system is perfectly secure.
NORM Rhythm is for people 18 and older. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.
Where your data goes. NORM Rhythm is operated from the United States, and your information is stored and processed there. US law may protect it differently from the law where you live. When your country's law requires a recognized safeguard for this transfer, we rely on one. For example, the data processing terms of our principal service providers incorporate the European Commission's standard contractual clauses and the UK addendum to them. Wherever you live, everything in §1, §9 and §10 applies to you, and support@neurospirelabs.com handles every request.
United Kingdom and European Economic Area. Under the UK GDPR and the EU GDPR you have the rights of:
You may complain to your data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in Ireland, the Data Protection Commission (dataprotection.ie); elsewhere in the EEA, the authority in your country.
Canada. We handle your information under PIPEDA and, in Quebec, Law 25. You consent to processing in the United States by using NORM Rhythm. NORM Rhythm is provided in English. If you would prefer this policy, or a request you make under it, handled in French, write to us and we will arrange it. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Australia. We handle your personal information under the Australian Privacy Principles in the Privacy Act 1988. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).
New Zealand. Under the Privacy Act 2020 you may access and correct your information. You may complain to the Office of the Privacy Commissioner (privacy.org.nz).
The Caribbean. Where your country has a data protection law, we honour the rights it gives you. These laws include:
You may also complain to your country's data protection authority, where it has one.
If we discover a breach of unsecured personal data or PHI, we will:
We maintain a written incident-response plan and test it. Nothing in this section limits any right you have under applicable law.
This policy is versioned. Minor corrections increase the number after the decimal point (2.0 to 2.1). A material revision increases the whole number (2.0 to 3.0). The version in effect when an incident, claim or dispute arises is the version that governs that matter, regardless of any later revision. Prior versions and their effective dates are kept and are available on request.
We will update this policy as NORM Rhythm changes, and revise its effective date. We will notify you in the app of any material change.
support@neurospirelabs.com · NeuroSpire Labs, Inc., 5416 Alumni Drive NW, Huntsville, AL 35806, USA · (256) 850-4426