Research Terms

Version: research-2-2026-11-08 · 8 November 2026

Our terms

Who we are. Helibrain is run by Robert Loshkarev’s Serbian sole proprietorship (preduzetnik; registration details on request), business address Jadranska 46, 1, 26000 Pančevo, Serbia. Contact: hello@helibrain.com. “You” means the researcher who creates the study, or the institution they are authorised to represent.

Study links. A study link opens your chosen tasks for participants and records responses, timings and scores for your private export. These terms cover study links and study data; the main Terms and Privacy policy cover ordinary website and account use. Anyone can create a study after confirming their account email.

Your responsibilities. You are the controller of study data. You decide the research purpose and lawful basis, inform participants, obtain consent and any ethics approval required, and follow your institution’s rules and the law that applies to you. Obtain the necessary permissions for children or other participants needing additional protection. You answer participants’ rights requests; we help with requests concerning data we process for you.

Participant codes. Pass an assigned pseudonymous code through the link’s ?pid= parameter. Keep the key linking codes to people yourself. Do not send names, emails, phone numbers, student or patient identifiers, or ask for identifying information in task responses. Email-like and other identifier-like codes are rejected, but validation cannot establish that every code is anonymous. Tell us if identifying information is sent by mistake so we can delete it.

Use of study data. By default we use study data only to run your study for you. Study runs stay out of public player results and norms. Each study has an optional setting, off by default: Contribute anonymised aggregate results to Helibrain's open norms. If you enable it, you instruct us to create only anonymised aggregates: group means and spreads by task, age band and language. Never trial rows or participant codes. We may publish those aggregates only when people cannot be identified, labelled as study-contributed, and never silently mixed into public player norms. Do not send identifying or individual age data for this purpose. The setting currently records your permission; aggregate generation has not been implemented. You must include this sentence in your own consent form before enabling the setting:

Turning the setting off stops future contributions; already published, irreversibly anonymised aggregates cannot be linked back to a participant for removal.

Acceptable use. Use study links lawfully, describe the study honestly, and do not attack the service, collect unrelated information, resell access or present the tasks as your own product. Do not use tasks for diagnosis, treatment or clinical decisions. We may slow down or stop use that harms the service or other users. Where possible we will warn you and allow you to export your data.

No warranty. Study links are provided free of charge and “as is”. We do not promise uninterrupted availability, error-free results or suitability for your research. Browser and device timing varies; you must assess the tasks’ suitability and export the data you need. Exports record the task versions used.

Liability. Our total liability under our own terms is capped at EUR 100, except where the law does not allow a cap, including intent, gross negligence and other non-excludable cases. This cap does not restrict liability, remedies or participants’ rights under the Standard Contractual Clauses below or mandatory data-protection law.

Law and court. Our own terms are governed by Serbian law, with disputes before the courts of Pančevo, Serbia, subject to mandatory rights to another law or court. The transfer clauses below have their own governing law and courts, which take priority for disputes under those clauses.

Changes and acceptance. We will notify you of important changes by email or in the study dashboard before they take effect. You may export and delete your study if you disagree. By creating a study, you agree to these Research Terms, including the incorporated clauses and annexes below. We store the accepted version and time with the study. The acceptance line appears under “Create study”.

Data processing

The European Commission’s Standard Contractual Clauses between controllers and processors in the Annex to Commission Implementing Decision (EU) 2021/915, adopted under Article 28(7) GDPR, are incorporated by reference and apply between you as controller and Helibrain as processor. They are part of our agreement without reproducing their full text here. The GDPR option applies; the optional docking clause is not used. For Clause 7.7(a), we choose Option 2 (general written authorisation), with 14 days’ advance notice of additions or replacements. The completed annexes follow.

The clauses take priority over conflicting wording in our own terms. Your study configuration, the contribution setting and your export or deletion requests are documented instructions. We will notify you of a breach affecting study data without undue delay, and where possible within 48 hours of becoming aware, with updates as information becomes available. The clauses govern confidentiality, assistance with rights requests and other data-protection duties, information, audits, and return or deletion of data; our own terms add no audit limit.

Annex I — Parties

Controller: you, the study creator, or the institution you are authorised to represent. The researcher account and study record identify the accepting account, its contact email, the study, and the acceptance version and time. Before transferring participant data, send your controller’s full name, business or institutional address, and privacy contact’s name, role and email to hello@helibrain.com, identifying the study code. Those details form the controller’s entry in this annex. Your activity is designing and running the study. Creating the study records your electronic acceptance; Helibrain offers and accepts these terms by providing the service.

Processor: Robert Loshkarev’s Serbian sole proprietorship (preduzetnik; registration details on request), Jadranska 46, 1, 26000 Pančevo, Serbia. Privacy contact: Robert Loshkarev, proprietor, hello@helibrain.com. Its activity is providing, operating and securing study links, scoring, storage and exports for the controller.

Annex II — Description of processing

• Data subjects: participants you invite to your study; the researcher account holder for study administration.
• Data categories: assigned participant codes; task responses and trial rows, including answers, choices and reaction times; task scores and metrics; task configuration and version; study language; input device type; start, submission and completion timestamps; study title, task order, completion URL, settings and account ownership reference. Technical connection information, including IP addresses, can be processed for delivery and security. The abuse-control key is a keyed hash of the client address, separate from participant responses.
• Sensitive data: some selected tasks can reveal health, wellbeing or other sensitive characteristics. Only select them with an appropriate lawful basis and safeguards, including any required explicit consent or ethics approval. Pseudonymisation does not make personal data anonymous. Do not submit direct identifiers or unnecessary sensitive free text.
• Purpose and nature: display tasks, receive and validate responses, score them, store results, let the controller export or delete data, and protect the service. Only if the per-study contribution setting is enabled, also anonymise results into the limited aggregates described above. It does not authorise any other use of personal study data.
• Duration: processing continues while you keep the study. We delete study data on request or when you delete the study. Copies in backups are removed automatically when the backups expire. Export any data you need before deletion. Any legally required retention is limited to that requirement.

Annex III — Technical and organisational measures

• Connections: public access uses HTTPS with TLS at the service’s web entry point. This protects data in transit between the browser and that entry point; it is not a claim that every internal connection or stored record is encrypted.
• Access control: study management and exports require a signed-in account with confirmed email. The gateway derives the researcher identity from the session, and the study service checks ownership on listing, export, settings and deletion. Write requests use an origin check and a dedicated request header. Internal study routes require service authentication. Participant submissions require a random run capability; only its digest is stored.
• Separation and minimisation: studies, participants, results and trials have separate research tables, outside public result and norms tables. Participant links use validated pseudonymous codes. The code-to-person key stays with the researcher. Participant study mode suppresses public analytics and uses the research submission route rather than public result saving and comparisons.
• Deletion and assistance: deleting a study removes its participants, results and trials through database cascades. Owner-only exports and study deletion support portability and erasure; contact us for requests concerning a particular code or for other assistance required by the clauses.
• Backups: the infrastructure configures scheduled database dumps and automatic expiry of the rotating backup copies, with checksums for checking dump integrity. Backup directories restrict filesystem access. This describes the configured backups, without claiming off-site replication or a tested recovery guarantee.
• Logging: study error handling records exception types and diagnostic locations without response values or raw run capabilities. Study gateway requests are excluded from product-activity logging. Operational access and security logs may still contain connection information and request paths; participant codes in links are not secret credentials.
• Abuse protection and integrity: persistent request and start-rate guards, payload and trial-size checks, and automatic pausing after bursts or repeated invalid submissions protect the service. Database transactions and locks protect task order and avoid duplicate submissions. Operational guards may slow or stop harmful use; these terms promise no fixed usage quota.

Annex IV — Sub-processors

We use sub-processors for hosting, backups, email and some scoring services. We share the current list on request and tell you 14 days before adding a new one, so you can object.

This public annex describes categories only. Under the general authorisation in Clause 7.7(a), Option 2, the current agreed list with identities, locations, contacts and processing roles is supplied privately for your study before any transfer; request it at hello@helibrain.com. Replacements also receive 14 days’ advance written notice. We require the protections in the clauses from sub-processors and remain responsible as the clauses require. If an objection cannot be resolved, you may stop transfers, export and delete the study. The specific-authorisation form of Annex IV is not used.

International transfers

Study data is stored on servers in the United States. If your institution requires storage in the EU, contact us; for larger studies we can arrange EU hosting.

Where personal study data leaves the EU/EEA, the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 are incorporated by reference. Module Two (controller to processor) applies to you as the EU/EEA researcher/controller and data exporter, and Helibrain as the Serbian processor and data importer, including its use of US storage. The location of storage does not change those roles. The transfer clauses take priority in a conflict, including over the processing clauses and our own terms.

For Module Two, Clause 7 (optional docking) is not used; Clause 9(a) uses Option 2, general written authorisation, with 14 days’ notice; the optional independent dispute-resolution language in Clause 11(a) is not used. For Clause 17 we choose Option 1, Irish law; Clause 18 designates the courts of Ireland, preserving participants’ rights to bring proceedings where the clauses permit. These choices apply only to the transfer clauses.

Transfer Annex I.A: the controller/exporter and processor/importer, their contacts, activities and electronic acceptance are those in processing Annex I above. Transfer Annex I.B: the subjects, data (including any sensitive data), purposes, processing and retention criteria are those in processing Annex II. Transfers occur continuously as participants use study links and the researcher manages the study, to Helibrain in Serbia and to US storage acting on its behalf. Transfer Annex I.C: the competent supervisory authority under Clause 13 is the authority responsible for the EU/EEA controller/exporter in its country of establishment; provide its name with your controller details before transfer. Transfer Annex II: the measures in processing Annex III apply, including restricted access, separate study storage, pseudonymous codes, encrypted public connections and deletion support. Onward processing is limited to the categories and purposes in processing Annex IV; the privately supplied list identifies each recipient and country. Transfer Annex III’s specific-authorisation list is not used because we select general authorisation.

Helibrain must meet the onward-transfer, local-law assessment and public-authority access obligations in the transfer clauses, including appropriate safeguards for US sub-processors. Before transfers begin, the parties must complete the assessment required by Clause 14 and put any necessary supplementary safeguards in place. If the clauses cannot be complied with, transfers must be suspended or ended as the clauses require. Incorporation alone does not replace that assessment.