Neurotech companies have access to some of users’ most sensitive data — and few regulations on what they can do with it.