SECURITY AND PRIVACY
how we protect your clinical data.
Recording a session, retaining its audio and working with a transcript are separate decisions. This page explains nexmin’s measures and the controls you can configure.
Before adding clinical information, review the privacy policy and the terms that apply to your practice.
LOCATION
1. clinical data hosted in the european union.
The application and primary database are hosted in Madrid. For paid accounts, all processing will take place in the European Union.
- Primary database in Madrid, with encryption keys managed by nexmin.
- Audio storage is separate from the database.
- You can request information about providers and processing terms.
ENCRYPTION
2. protection in transit and in storage.
Connections use HTTPS and protected clinical database fields use application-level encryption. Encryption reduces risks, but also requires access controls and appropriate account management.
- Data is transmitted through encrypted connections.
- Fields such as notes, transcripts and identifying information are encrypted.
- Keys are managed separately from record contents.
DATA USE
3. nexmin does not use your sessions to train AI models.
The providers that process them work under terms that exclude that use. nexmin uses content to provide the functions requested by the professional.
- Provider processing is subject to the terms of the contracted service.
- Training terms and retention terms are separate matters.
- Read the privacy policy and request any processing details you need.
ACCESS
4. you can enable two-factor authentication.
Each professional can add a temporary code generated by an authenticator app. This protection is enabled from the account; it is not automatically enabled for every user.
- Compatible with TOTP authenticator apps.
- Access to clinical material depends on account permissions.
- Review access settings before onboarding a team.
REVIEW
5. generated notes need professional review.
Generated clinical notes and hypotheses are drafts. Check their content, correct errors and validate notes through the review workflow. Outputs may contain omissions or interpretations you disagree with.
- The tool does not replace your clinical judgement.
- Check the transcript when there are doubts or errors.
- Validating a note is a professional decision, not a guarantee that the analysis is accurate.
LOGS
6. records to investigate access and incidents.
nexmin records authentication events, changes and reads on clinical routes covered by auditing. These records help investigate incidents; they do not amount to logging every view of every screen.
- Logs include event metadata without copying the clinical response body.
- Repeated reads may be grouped to avoid duplicates.
- Contact us if you need to investigate access.
RETENTION
7. configure what happens to audio.
A policy can be set for the organisation or an individual. Audio deletion depends on an explicit policy and the session workflow; do not assume that audio disappears when analysis finishes.
- You can work without recording the session and add your own notes or summary.
- Modes that delete audio retain the resulting clinical documents.
- Retention mode keeps audio; audio is also retained when no explicit deletion policy is set.
DOCUMENTATION
8. review the terms for your practice.
Using software does not by itself establish compliance with data protection or clinical record obligations. You need to define the purpose, information provided to the person, legal basis and applicable retention periods.
- Read the privacy policy and service terms.
- Request the data processing agreement and provider information.
- Consent templates need to be adapted to your activity and reviewed before use.
CONTACT
ask us about security.
To request documentation or clarify the terms for your practice, write to hola@nexmin.ai.
You can also read the privacy policy at /privacidad.