Privacy Policy

Privacy and professional secrecy are the foundation of clinical practice. At nexmin we apply that same rigour to our technology. This Privacy Policy explains how we collect, use and protect information on the nexmin platform (hereinafter, the “Platform”).

1. Who is the Data Controller for your data?

For the purposes of data protection regulations (GDPR and LOPDGDD), the person responsible for your user account data is:

• Identity: Humbert Torroella Navarro (sole trader / self-employed individual)
• Tax ID: 38847531W
• Postal address: Cal Puntes, 08672 Gaià (Barcelona)
• Privacy email: hola@nexmin.ai

2. Our dual role: Controller vs. Processor

It is essential to distinguish two types of data on nexmin:

• Your data as a Professional (our responsibility): This is the data we use to manage your subscription (your name, email and billing details). For this data, we are the Data Controllers.
• Your Patients' data (your responsibility): This includes recordings, notes, transcripts and clinical histories. For this data, YOU are the Data Controller and nexmin acts solely as your Data Processor, providing you with the technological infrastructure. We will never use this data for our own purposes.

3. Integration with Google Calendar (Important notice)

nexmin allows you to synchronise the Platform with your Google Calendar account to manage your appointments automatically.

Google data use statement: nexmin's use and transfer of information received from Google APIs to any other application will comply with the Google API Services User Data Policy , including the limited-use requirements.

• What do we use access for? Exclusively to read, create and update your session events in your calendar.
• What do we NOT do? We do not share, sell or transfer your calendar data to third parties for advertising purposes. We do not use data obtained from Google Workspace to develop, improve or train Artificial Intelligence models.

4. Artificial Intelligence and Health Data

nexmin uses advanced Artificial Intelligence engines (LLMs) to process session audio and generate clinical drafts (synthesis, process variables, process reading). To safeguard professional secrecy:

• AI processing takes place on secure cloud infrastructure servers (e.g. Google Cloud Vertex AI) under strict enterprise-grade Data Processing Agreements (DPAs).
• Zero Public Training: Your patients' audio, transcripts and clinical data NEVER are used to train our providers' public language models or to improve base models. Data is processed ephemerally to generate your report and is not stored in the AI engines.

5. What data do we collect and for what purpose?

As Data Controllers, we collect:

• Account creation data: First name, surname and email address to give you access to the Platform.
• Billing data: Tax ID/VAT number, address and payment details (securely processed through our provider Stripe) to issue your invoices.
• Technical and usage data: IP address, browser type and system logs, in order to ensure Platform security and prevent fraud.

6. How long do we retain data?

• Your account data: We will retain it while you keep your subscription active. If you cancel, we will keep your billing data duly blocked for the period required by tax legislation (usually 5 years).
• Your patients' data: It will be governed by the “Retention” preferences you configure in the Platform (e.g. Ephemeral Audio or Full Retention). If you delete a patient or cancel your account, the associated clinical data will be securely and irreversibly deleted from our main servers.

7. Who do we share your data with?

We do not sell or rent your data to third parties. We only share the information strictly necessary with essential service providers for nexmin to operate (our “Sub-processors”), such as web-hosting providers (Google Cloud Platform) or payment gateways (Stripe). All of them operate under binding contracts that guarantee GDPR compliance.

8. Your Rights

You may exercise your rights of Access, Rectification, Erasure, Objection, Restriction of processing and Data portability at any time by emailing hola@nexmin.ai and attaching a copy of your ID card or equivalent document to identify yourself.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you consider that the processing does not comply with the regulations in force.