skip to content

Last updated: 5 October 2026

Privacy Policy

Privacy and professional secrecy are the foundation of clinical practice. At nexmin we apply that same rigour to our technology. This Privacy Policy explains how we collect, use and protect information on the nexmin platform (hereinafter, the “Platform”).

1. Who is the Data Controller for your data?

For the purposes of data protection regulations (GDPR and LOPDGDD), the person responsible for your user account data is:

  • Identity: Humbert Torroella Navarro (sole trader / self-employed individual)
  • Tax ID: 38847531W
  • Postal address: Cal Puntes, 08672 Gaià (Barcelona)
  • Privacy email: hola@nexmin.ai

2. Our dual role: Controller vs. Processor

It is essential to distinguish two types of data on nexmin:

  • Your data as a Professional (our responsibility): This is the data we use to manage your subscription (your name, email and billing details). For this data, we are the Data Controllers.
  • Your Patients' data (your responsibility): This includes recordings, notes, transcripts and clinical histories. For this data, YOU are the Data Controller and nexmin acts solely as your Data Processor, providing you with the technological infrastructure. We will never use this data for our own purposes.

3. Integration with Google Calendar (Important notice)

nexmin connects to your Google Calendar for two things: so that your booking page does not offer times you already have busy, and so that bookings confirmed online are added to your calendar. It does not sync or change the rest of your events.

Google data use statement: nexmin's use and transfer of information received from Google APIs to any other application will comply with the Google API Services User Data Policy , including the limited-use requirements.

  • What Google data do we use? The list of your calendars (name and identifier), so you can choose which ones block your availability and where bookings go; the busy periods in those calendars, without titles or other details of your events; and the email address and identifier of the connected Google account, to show you which account is connected.
  • What do we write to your calendar? nexmin adds each confirmed booking to the calendar you choose (by default, your primary calendar) and only creates and deletes the events of its own bookings there. Each event includes the date, the service, the name and email of the person who booked, who is added as a guest, and the video call link if there is one. If the booking is cancelled or rescheduled, nexmin deletes the event or replaces it with one at the new time. What nexmin writes to your calendar stays in your Google account and is also governed by Google's terms.
  • What do we NOT do? We do not share, sell or transfer your calendar data to third parties for advertising purposes. We do not use data obtained from Google Workspace to develop, improve or train Artificial Intelligence models.
  • How long do we keep it and how is access removed? While the connection is active, we keep the access Google gives us and the email address of the connected account, both encrypted, together with that account's identifier. When you disconnect Google Calendar in nexmin, we delete them. Events already created are yours and remain in your calendar. Disconnecting in nexmin does not remove the permission in your Google account: you can remove it at any time at myaccount.google.com/connections.

4. Artificial Intelligence and Health Data

nexmin uses advanced Artificial Intelligence engines (LLMs) to process session audio and generate clinical drafts (session summary, process variables, process reading). To safeguard professional secrecy:

  • AI analysis runs on Google Cloud (Vertex AI), in the European Union. Audio transcription is carried out by a specialised provider with servers in the United States. Both process the data as processors, under data processing agreements.
  • Use and retention of data in AI features: Audio, transcripts and clinical data are processed by the provider required for each feature. nexmin does not use your sessions to train AI models. The providers that process them work under terms that exclude that use. This does not mean that no data is retained during processing. Google Cloud may keep what it receives in memory for 24 hours to respond faster and, if its systems detect possible abuse, retain the request for up to 90 days for review, always in the European Union. The transcription provider keeps each audio file and its transcript until they are deleted: nexmin deletes them as soon as it receives the transcript, and their backups are gone within 30 days at most. Its technical logs may keep data about the request. See Google Cloud’s official documentation on data retention in Vertex AI, including conditions that depend on the model, feature and configuration.

5. What data do we collect and for what purpose?

As Data Controllers, we collect:

  • Account creation data: First name, surname and email address to give you access to the Platform.
  • Billing data: Tax ID/VAT number, address and payment details (securely processed through our provider Stripe) to issue your invoices.
  • Public website forms: If you request the guide or another resource from the website, we process your name, your email address and, if you provide it, your type of practice in order to send you what you asked for and manage your request, based on your consent. We also keep the date and version of the text you accepted and, if the visit comes from a campaign, its source. If you tick the updates box, we will ask you to confirm it by email, and only then may we write to you about nexmin. Every email includes a link to unsubscribe; you can also withdraw your consent by writing to hola@nexmin.ai.
  • Technical and usage data: IP address, browser type and system logs, to protect the Platform and prevent fraud. On the commercial pages of the public website, Umami, hosted by us, produces basic visit statistics without cookies, based on our legitimate interest in knowing which pages are useful; you can object as explained in the cookie policy. We do not use Google Analytics or any other tool that requires your permission. We do not send forms, email addresses, user identifiers, clinical content or demo information to Umami.

6. How long do we retain data?

  • Your account data: We will retain your account data while your subscription is active. If you cancel, we will retain your billing data in restricted form for the periods required by applicable law.
  • Website form data: We keep them for as long as they are needed to handle your request and, for updates, until you withdraw your consent. You can ask for them to be erased at any time at hola@nexmin.ai.
  • Your patients' data: Audio is retained according to the “Retention” preference you configure for each patient (for example, Ephemeral Audio or Full Retention). Transcripts and other clinical data follow their own retention rules. Patient deletion is handled through the specific flow available in the App; cancelling a subscription does not automatically delete clinical data. You can request the retention and deletion conditions at hola@nexmin.ai and in the data processing agreement.

7. Who do we share your data with?

We do not sell or rent your data to third parties. We share only the information necessary with service providers essential to nexmin’s operation (our “Sub-processors”): hosting and AI analysis (Google Cloud, in the European Union), delivery of the website and the App, audio transcription (with servers in the United States), email, video calls and payments (Stripe). If you connect WhatsApp, messages also pass through Meta and voice notes are transcribed by another provider in the United States. When a provider processes data outside the European Economic Area, the transfer relies on the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework. Processing is governed by the contractual terms applicable to each provider, and you can request the full list at hola@nexmin.ai. Visit measurement on the public website is described separately in the cookie policy: Umami’s basic statistics, hosted by us, use no cookies and rely on our legitimate interest.

8. Your Rights

You may exercise your rights of Access, Rectification, Erasure, Objection, Restriction of processing and Data portability at any time by emailing hola@nexmin.ai If we have reasonable doubts about your identity, we may request additional information that is strictly necessary to confirm it, in accordance with Article 12(6) of the GDPR.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you consider that the processing does not comply with the regulations in force.