Who we are What data we collect How we use your data Legal basis (GDPR)How long we keep data Your rights (GDPR)Cookies Google Calendar (health profession…International transfers Changes to this policy Contact

Last updated: November 2026

Privacy Policy

Your privacy matters. This policy explains in plain language what we collect, how we use it, and your rights.

Nexo is an online platform that helps patients book appointments with independent mental health professionals, targeted at users in Portugal.

For privacy matters or to exercise your GDPR rights, contact us at nexo.saudemental@gmail.com.

This inbox is for data protection enquiries only.

Data you provide directly:

Name and email address (when you register)
Booking details (date, time, session type)
Messages you send when requesting an appointment
Professionals and clinics on the free plan: records of intermediation fees and their payments (amount, reference, date and transfer details) and the details needed to issue invoices

Data collected automatically:

Browsing data and technical cookies (see our Cookie Policy)
IP address and browser type (for security)
Subscription purchase history from the App Store, when a health professional or clinic subscribes in the iOS app (product, status and dates; payment details stay with Apple and never reach Nexo)

What we do NOT collect:

Clinical session notes
Diagnoses or health history
Therapy histories

Account management and authentication
Processing bookings
Collecting the free plan intermediation fee and issuing the related invoices
Communications about your request (confirmation, decline)
Improving the platform using aggregated, anonymised insights

We do not sell your data. Only if you accept marketing cookies (see our Cookie Policy) do we share technical browsing signals with Meta (Facebook/Instagram) to measure and optimise ads — never health data, appointment details, or messages.

Contract: to run bookings and deliver the service
Legal obligation: keeping fee invoicing records for the period required by law
Legitimate interests: security, fraud prevention, and responsible product improvement
Legitimate interests: occasional tips and news about using your account, sent to registered professionals, with an unsubscribe link in every email
Consent: marketing emails only with clear opt-in
Patients registered by a professional: the data is provided by the professional, who is responsible for informing the patient that Nexo is used to centralise it and for having a lawful basis to record it; Nexo uses it only to manage bookings and related communications

Active account: while you keep your account
After account deletion: up to 30 days (cool-off and security)
Billing records: up to 10 years where a legal obligation applies

Access your data
Correct inaccurate data
Request deletion of your account and data where applicable
Data portability
Object to certain processing

To exercise these rights, email nexo.saudemental@gmail.com. We will respond within the time limits set by applicable law.

We use cookies as described in our dedicated policy, which forms part of this information.

Cookie Policy

Practitioners can connect their Google Calendar to Nexo. We only do so after the practitioner authorises it on Google's consent screen, and we request only the access strictly necessary:

View busy times (calendar.readonly): we use busy intervals to prevent a patient from booking a time when the practitioner is already busy, and we show the practitioner's own events in their Nexo agenda, for them only. We do not store the content of those events.
Create the video call (calendar.events): when the practitioner ticks "Create the Google Meet link automatically" for an online appointment, we create an event with a Google Meet link in their calendar. With this permission we only create, reschedule or delete the events Nexo created for an appointment.
We only store what is needed for the connection to work — the access tokens and the identifier of the event we created — protected with the same reinforced technical and organisational measures used for other sensitive data in this policy: encryption in transit and at rest, role-based access control, and audit logs.

We do not sell or transfer this data to third parties, we do not use it for advertising or to train artificial intelligence models, and no one reads it, except if the practitioner asks for support purposes, where required by law, or for security.

You can disconnect at any time in Settings → Google Calendar (we revoke access and delete the tokens) or at https://myaccount.google.com/permissions.

Nexo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Data is stored on servers in the European Union (Supabase — Europe region). We do not transfer data outside the EEA without appropriate safeguards under the GDPR.

Subscriptions bought in the iOS app are billed and managed by Apple (Apple Distribution International Ltd., Ireland). We use RevenueCat, Inc. (USA) to validate those subscriptions and link them to your Nexo account (account identifier, product, status and dates), under Standard Contractual Clauses. Subscriptions paid on our website are processed by Stripe Payments Europe, Ltd. (Ireland).

We may update this policy to reflect legal or product changes. We will notify you by email about material updates. The last updated date is always shown at the top of this page.

Privacy enquiries and rights requests: nexo.saudemental@gmail.com

Data controller (Art. 4(7) GDPR): Nexo Technologies S.à r.l.-S, a simplified private limited liability company organised under the laws of Luxembourg, with registered office at 13, Rue Charlotte Engels, L-1482 Luxembourg, registered with the Luxembourg Trade and Companies Register (RCS) under number B309386.