Table 1.

Four Thematic Categories about Neuroprivacy

Themes
Data collection and management	“The much bigger problem [than incidental findings] is the privacy problem […] how do you reassure your users that their data is protected, and […] that the rights are theirs and not someone else's to access the data.” (Interview 6) “We're likely to hit a place like most other industries where companies need to own the data in order to monetize and to do anything valuable with it. Not to say that they're directly selling the data, but there's a reason we collect it and it's to become a prominent player in using this data for intelligence purposes and not being able to do so would hinder our company's ability to exist […] That said, we shouldn't be allowed to do everything we want with the data.” (Interview 1)
Ethics principles	“You do this in a way that privacy is paramount and you're developing this with the end user's rights and autonomy as a guiding principle.” (Interview 6, on autonomy) “[…] most neurotech companies I talk to don't have privacy policies and the reason is it's not in our best interest to have privacy policies. […] we work better if we own everything and we kind of just need to tell the customers […] what they need to hear to be happy with that.” (Interview 1, on transparency)
Exceptionalism of brain data	“[…] people are a little more personal about brain data and as a result the privacy problem is more prominent with [them].” (Interview 1) “The question that always comes back to my mind is there something that is unique to this brain access that we have that tells us something that we can't otherwise – that someone couldn't otherwise determine on the basis of, like, digitally observing behavior. And I haven't seen anything of that sort in any consumer oriented neurotech.” (Interview 6)
International standards, policies, and laws	“The consumers have access to their own data. So, the policy of the company is we do not sell data to a third party. People have the option to share data with us anonymously, but should they share the data with us, this data is not sold to a third party and we are fully GDPR compliant globally.” (Interview 2) “The privacy legislation in different jurisdictions has never kept up with technology. So, we've very much had to take it upon ourselves to implement very strict privacy controls.” (Interview 12)

Some quotes may have overlapping relevance to multiple themes. Ellipses are used to shorten quotes for clarity.