ERAS Technologies Limited (Hong Kong) · Last updated 22 October 2026
This notice applies to anyone who takes part in an ERAS Lab session — a biosensing study, squad/peak-performance monitoring session, or public "Live Emotion" activation run by ERAS Technologies Limited or one of its clients. It is separate from, and does not replace, the Privacy Policy that applies to users of the ERAS consumer app. If you are both an ERAS app user and an ERAS Lab participant, both notices apply to the relevant parts of your data.
You must be 18 or older to take part in an ERAS Lab session.
1. What we collect
A participant code and, where applicable, a callsign you or your organization choose — we do not require your name.
Year of birth, gender, and country.
Your signed consent record for this specific session.
Raw EEG signal from up to three UMind Mirror sensors.
Heart rate, beat-to-beat (RR/PPI) intervals, motion, skin temperature, and optical PPG from a connected Polar device.
Scores we calculate from the above in real time or after the session: cognitive load, focus, stress, fatigue trend, signal quality, and — for public activations only — attention, liking, and intensity.
2. How this data is used and who sees it
What happens to your data depends on the type of session:
Research and testing sessions: your data is processed to produce aggregated results and per-second timelines delivered to the organization that commissioned the study ("the client"). The client receives your data linked only to your participant code, not your name.
Squad / peak-performance monitoring: your live, per-second scores are shown to your team's coach, squad leader, or commander via a private dashboard link, identified by your callsign, for the duration of the session.
Public "Live Emotion" activations: your live attention, liking, intensity, and heart rate are shown on a public screen, visible to other people present at the event, for as long as you are the most recently active participant on that screen. See Section 3 for how consent works for this specifically.
We do not sell your data, and we do not use it for any purpose beyond the engagement you were told about and consented to.
3. Public display at activations
If you take part in a public "Live Emotion" activation, your physiological and emotional state is shown on a screen other attendees can see. Because of this, we ask for your explicit, separate consent immediately before you take part — not as part of any earlier registration — confirming that you understand:
Your live heart rate, attention level, and emotional reactions will be visible to people around you during the activation.
You can stop at any time — tell the operator, or remove the sensors; the operator ends your display immediately.
Your data is not stored beyond what is described in Section 5 once the activation ends, unless you separately agree to a research use.
4. Monitoring in employment, sporting, or command contexts
If you are taking part because of your relationship with an employer, team, military unit, or similar organization — for example, a squad or peak-performance monitoring session — we rely on consent you give directly to us, but we recognize that your ability to decline may be affected by that relationship. Your organization is responsible for ensuring that any requirement or expectation that you take part is lawful under the employment, military, or other regulations that apply to you, and for providing you with any additional protections those regulations require. This notice describes only how ERAS Technologies Limited handles your data — it does not determine whether your organization's monitoring program itself is lawful in your jurisdiction, which depends on rules specific to your employment or service relationship.
5. Where your data is stored and for how long
Live session scores (squad dashboards, public activations) are held in temporary storage for up to 12 hours, automatically deleted after that.
Research and session data (raw sensor recordings, timelines, results) is stored on servers in Hong Kong (AWS, ap-east-1), encrypted.
Research and session data is retained for 12 months after the engagement ends, unless a different period is specifically agreed with the client, after which data linking back to your participant code is deleted.
6. Cross-border considerations
Our infrastructure is in Hong Kong. If the client commissioning your session, or the location where your session takes place, is in the EU/UK, the UAE (including DIFC), or elsewhere, additional local data protection law may apply to how your data is handled, on top of this notice. Ask the operator running your session which additional rules apply to your specific engagement.
7. Your rights
You can ask the operator who ran your session, or contact us at the address below, to:
Access the data recorded about you
Delete your data, where it has not already been required to be shared with the client as part of the engagement you consented to
Withdraw consent for any future session (this does not affect data already collected with your consent)
8. Security
We use encryption in transit and at rest (AWS KMS) for all stored session data, and access to raw research data is limited to the operator running your session and, where applicable, the client receiving results.