Who we are What data we collect How we use your data Legal basis (GDPR)How long we keep data Your rights (GDPR)Cookies Google Calendar (health profession…International transfers Changes to this policy Contact

Last updated: October 2026

Privacy Policy

Your privacy matters. This policy explains in plain language what we collect, how we use it, and your rights.

Nexo is an online platform that helps patients book appointments with independent mental health professionals, targeted at users in Portugal.

For privacy matters or to exercise your GDPR rights, contact us at nexo.saudemental@gmail.com.

This inbox is for data protection enquiries only.

Data you provide directly:

Name and email address (when you register)
Booking details (date, time, session type)
Messages you send when requesting an appointment

Data collected automatically:

Browsing data and technical cookies (see our Cookie Policy)
IP address and browser type (for security)

What we do NOT collect:

Clinical session notes
Diagnoses or health history
Therapy histories

Account management and authentication
Processing bookings
Communications about your request (confirmation, decline)
Improving the platform using aggregated, anonymised insights

We do not sell your data. Only if you accept marketing cookies (see our Cookie Policy) do we share technical browsing signals with Meta (Facebook/Instagram) to measure and optimise ads — never health data, appointment details, or messages.

Contract: to run bookings and deliver the service
Legitimate interests: security, fraud prevention, and responsible product improvement
Consent: marketing emails only with clear opt-in
Patients registered by a professional: the data is provided by the professional, who is responsible for informing the patient that Nexo is used to centralise it and for having a lawful basis to record it; Nexo uses it only to manage bookings and related communications

Active account: while you keep your account
After account deletion: up to 30 days (cool-off and security)
Billing records: up to 10 years where a legal obligation applies

Access your data
Correct inaccurate data
Request deletion of your account and data where applicable
Data portability
Object to certain processing

To exercise these rights, email nexo.saudemental@gmail.com. We will respond within the time limits set by applicable law.

We use cookies as described in our dedicated policy, which forms part of this information.

Cookie Policy

Practitioners can connect their Google Calendar to Nexo. We only do so after the practitioner authorises it on Google's consent screen, and we request only the access strictly necessary:

View busy times (calendar.readonly): we use busy intervals to prevent a patient from booking a time when the practitioner is already busy, and we show the practitioner's own events in their Nexo agenda, for them only. We do not store the content of those events.
Create the video call (calendar.events): when the practitioner ticks "Create the Google Meet link automatically" for an online appointment, we create an event with a Google Meet link in their calendar. With this permission we only create, reschedule or delete the events Nexo created for an appointment.
We only store what is needed for the connection to work — the access tokens and the identifier of the event we created — protected with the same reinforced technical and organisational measures used for other sensitive data in this policy: encryption in transit and at rest, role-based access control, and audit logs.

We do not sell or transfer this data to third parties, we do not use it for advertising or to train artificial intelligence models, and no one reads it, except if the practitioner asks for support purposes, where required by law, or for security.

You can disconnect at any time in Settings → Google Calendar (we revoke access and delete the tokens) or at https://myaccount.google.com/permissions.

Nexo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Data is stored on servers in the European Union (Supabase — Europe region). We do not transfer data outside the EEA without appropriate safeguards under the GDPR.

We may update this policy to reflect legal or product changes. We will notify you by email about material updates. The last updated date is always shown at the top of this page.

Privacy enquiries and rights requests: nexo.saudemental@gmail.com

Data controller (Art. 4(7) GDPR): Nexo Technologies S.à r.l.-S, a simplified private limited liability company organised under the laws of Luxembourg, with registered office at 13, Rue Charlotte Engels, L-1482 Luxembourg, registered with the Luxembourg Trade and Companies Register (RCS) under number B309386.