Privacy notice

Who operates the service

Richard Andres Marles Bonilla, Calle Paciente Inglés 22, 50019 Zaragoza, Spain, operates NuviaMy and handles account administration and support information. Contact richard@nuviamy.com or use our contact form. Further operator details appear in the legal notice.

Information handled

Account information includes your name, email, practice legal name and registered address, representative role, professional details, optional photo, login/security records and exact agreement acceptance records. Support requests contain information you choose to send. Contact details and message bodies are encrypted in the application database. Signed-in practice users can follow their own conversation inside NuviaMy; authorized platform support can review it through the audited administration area. Email notifications contain only a generic notice, without the submitted message or reply. Public enquiries may receive administrative follow-up by email. Do not include client names, clinical records, passwords or payment card details. Requesting help does not authorize access to clinical records.

On the practice’s instructions, workspace features process client contact details, appointments, intake forms, documents, ordinary clinical notes, signatures and invoices under the accepted DPA, applicable BAA and Processing Schedule. The same agreements cover the trial and paid subscription. The practice determines lawful collection and its patient notices; excluded categories and integrations require a separate arrangement.

Purposes and legal bases

We use account and contact information to create and administer your requested workspace and respond to service requests. Account administration relies on performance of the service contract or requested pre-contractual steps. Security, abuse prevention and technical investigation rely on the legitimate interest in protecting users and the service. Where a legal obligation applies, required records are processed to meet that obligation. Optional browser preferences are stored only with your choice.

Clinical workspace records require defined controller/processor responsibilities and the necessary agreements before real-data use. This notice does not substitute those agreements or a clinic’s patient privacy notice.

Providers and connected services

Amazon Web Services hosts the production application and database on EC2 and private documents and encrypted database backups on S3 in us-east-1 (Northern Virginia). Cloudflare provides DNS. Amazon SES delivers transactional account/service messages. Cloudflare Email Routing and the operator’s Gmail inbox receive administrative messages and generic support notices, excluding clinical content. Brevo SMTP is not used by the current production email configuration. Stripe handles hosted subscription payments and, when enabled by a practice, patient invoice checkout. Patient checkout sends the amount, payer email, connected payment account and internal invoice, practice and client references, with a fixed payment description; it does not send clinical notes, diagnoses or invoice free-text descriptions. Card details are entered on Stripe’s hosted payment page. The optional Google integration exchanges Calendar information; Gmail and Drive capabilities are disabled. Optional Sentry monitoring receives technical error information; default personal-information and local-variable capture are disabled.

Providers receive information needed for their services. The Processing Schedule identifies the standard infrastructure scope and restrictions on external services; additional clinical flows require assessment and appropriate agreements. We do not claim that every provider has signed a BAA or that all information stays in the United States. The operator administers the service from Spain.

Optional video sessions

When enabled by the practice owner, Amazon Chime SDK processes real-time audio, video, connection/device information and opaque meeting and participant identifiers in AWS us-east-1 (Northern Virginia, United States). Sessions can contain health information. NuviaMy is administered from Spain. The assigned therapist admits the authenticated client from a private waiting room. Device preview stays local until participation begins. Recording, transcription, screen sharing and public broadcasting are not enabled.

NuviaMy retains appointment linkage, access/admission state, meeting metadata and audit evidence, rather than recordings of the call. Individual join credentials are transient and are not stored in application records or logs. The owner reviews and explicitly accepts the video processing addendum before general activation; acceptance evidence is retained with the practice agreements. Disabling video stops new joins and closes active rooms. EEA clinical use and excluded record categories require a separate approved arrangement; this activation does not establish that approval.

Locations and international transfers

Our AWS account identifies Amazon Web Services EMEA SARL as its contractual provider. Clinical application records, documents and backups are hosted in us-east-1 (Northern Virginia, United States), with administration from Spain. AWS infrastructure and support arrangements can involve other entities and locations. Transactional email reaches the recipient’s selected mailbox provider. Generic messages, delivery metadata and security logs can still be personal data.

The AWS Service Terms incorporate its Data Processing Addendum, Supplementary Addendum and Standard Contractual Clauses, subject to their application conditions. AWS Inc. is a covered entity in Amazon’s active EU-U.S. Data Privacy Framework certification for non-HR data. That participation does not by itself document coverage of every NuviaMy clinical-data flow. Where GDPR international-transfer rules apply, the mechanism must cover the actual recipient, data and processing: adequacy where applicable, or the appropriate contractual safeguards and any required assessment and supplementary measures. Our evaluation of the hosted EEA clinical-data flows remains pending; acceptance of the Processing Schedule is not approval of an otherwise unsupported transfer.

Contact richard@nuviamy.com for information about the safeguards applicable to your processing or to request the relevant documentation, with confidential details protected as necessary. Encryption at rest and in transit does not mean the service cannot read records while processing them, or that all keys are held exclusively in the EEA. We do not promise EU-only hosting or an absence of international transfers.

Google account and Google Workspace data

Connecting Google is optional. You can manage clients and appointments without connecting it. In Settings → Integrations, connect Google Calendar if your practice needs it. Google then asks you to authorize those permissions. NuviaMy does not ask for or store your Google password.

Data we access and how we use it

• Connected account: we request OpenID and email access to identify the connected Google account. We store its email address, permissions, connection status, access and refresh tokens, and token expiry to operate calendar synchronization.
• Gmail sending: disabled. NuviaMy does not request Gmail sending permission or use the connected Google account to send messages.
• Gmail reading: disabled. NuviaMy does not request mailbox reading permission or retrieve your Gmail inbox.
• Google Calendar: with your permission (calendar.events.owned), we read titles, start and end times and event identifiers for upcoming events in your primary owned calendar to display them in My Google workspace. Appointment sync creates, updates or cancels occupancy blocks with a generic title, start and end times, and a prompt to open NuviaMy. The current sync does not put the client's name, diagnosis, clinical note or appointment purpose in the event description. We retain linked event identifiers, URLs, calendar identifiers, timestamps and sync status to maintain the connection.
• Google Drive: disabled. NuviaMy does not request Drive permission or export documents to Google Drive. Existing copies exported under a previous configuration must be managed in their destination account.

Sharing and access

We use Google user data only to provide or improve the selected, visible integration features. Authorized members of your practice may access connected-service information through NuviaMy according to their permissions; this is a practice connection, not a private mailbox for each team member. Google processes the information exchanged through its services. Our AWS infrastructure processes and stores the account, credentials and synchronization records needed to operate those features. Infrastructure providers act only as needed to provide and secure the service under the applicable arrangements. We do not send Google mailbox or calendar contents to Stripe or use them in general support messages.

Operator staff and service providers are not permitted to read Google user data except with your documented affirmative agreement to view specific data, where necessary for security investigations, where required by law, or for aggregated and anonymized internal operations permitted by Google's policies. Authorized access is restricted to the applicable purpose. Do not send passwords, tokens, email contents or clinical records through general support.

Google API Services User Data Policy and Limited Use

NuviaMy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace user data and developer policy.

We do not sell Google user data, supply it to data brokers, or use or transfer it for advertising, retargeting, creditworthiness or lending decisions. We do not use data obtained through Google Workspace APIs to develop, improve or train generalized or non-personalized artificial intelligence or machine-learning models. Transfers are limited to providing the authorized user-facing features with your consent, security purposes, compliance with law, or a merger, acquisition or asset sale after obtaining your explicit prior consent, as permitted by Google's policies. These restrictions also apply to data derived from Google user data and to our personnel and service providers.

Protection and retention

Production connections use HTTPS. OAuth access and refresh tokens are encrypted in the production application database. Authentication, practice-scoped permissions and restricted operational access protect stored connection records. Google passwords are not collected. No security measure eliminates every risk.

We retain connection credentials while the integration is connected so authorized features can continue to work. Disconnecting clears the connected account email, tokens, permissions and connection timestamps from the active integration record and stops further use through that connection. It does not immediately remove retained database backups. Fetched inbox and upcoming-calendar lists are processed for display rather than stored as mailbox or calendar archives; linked event/file identifiers and synchronization records remain with the associated workspace records until those records are deleted under the applicable retention arrangements.

Disconnect, revoke access and request deletion

1. In Settings → Integrations → Google actions → Disconnect Google, stop the NuviaMy connection and clear its active credentials.
2. To revoke Google's authorization as well, open your Google Account third-party connections, select NuviaMy and remove access. Disconnecting inside NuviaMy does not itself revoke the authorization at Google.
3. To request deletion of Google-related records retained by NuviaMy, use our contact form or email richard@nuviamy.com with the subject “Google data deletion” and identify your account and practice without including clinical content or tokens. We verify authority, delete data that is no longer required, and explain any records retained for legal or security obligations and the applicable retention. Backup copies age out under the backup arrangements described below; deletion from the active database is not immediate erasure of every retained copy.

Disconnecting or deleting NuviaMy records does not recall sent email or automatically delete files and events already in Google or recipients' accounts. Manage those copies in Gmail, Calendar or Drive. Removing Google's access does not by itself delete records already stored in NuviaMy. Trial expiry or subscription cancellation is not a deletion request.

Before accessing Google user data for a new purpose or in a materially different way, we will notify affected users and obtain their consent to the changed use. Publishing a revised notice alone will not authorize an undisclosed new use.

Retention and deletion

Account and workspace records remain available during the relationship; trial expiry or subscription cancellation does not automatically delete them. Authorized owners retain reading/export according to permissions. Current S3 database backups expire after 35 days and noncurrent backup versions 35 days after becoming noncurrent; this is not a strict maximum total age. Daily instance snapshots retain seven recovery points. Document versions have no automatic deletion lifecycle. Account closure must address active data and retained copies under the Processing Schedule.

Contact the operator for account closure or deletion. Requests are assessed against applicable preservation obligations and permissions, and the outcome is communicated. No universal clinical-record deletion deadline is promised.

Your requests

You may contact the operator to request access, correction, deletion, restriction, portability or to object to processing where those rights apply. We may need proportionate identity verification. Optional preference storage can be withdrawn using Cookie settings. You may complain to the Spanish Data Protection Agency or another competent authority.

Patients should direct clinical-record requests to their treating practice; NuviaMy assists the authorized practice according to the applicable agreement. No clinical details should be included in general support messages.

Browser storage and updates

Essential cookies support authentication and secure forms. Optional storage remembers the guided tour only when you accept preferences. See the cookie policy. No advertising analytics are installed. Material changes will be reflected in a new version of this notice.