Privacy policy

• Controller: NEXI HEALTH, S.L. (Tax ID B21726005).
• Purposes: providing you with the wellbeing support service (conversations with Bruna, questionnaires, and recommendations), managing accounts for staff at organizations that contract the service, producing anonymous statistics for those organizations, improving the service through pseudonymized usage metrics, and measuring the effectiveness of our ads on Facebook and Instagram.
• Legal basis: your explicit consent for wellbeing data, the performance of the terms of service, and our legitimate interest in maintaining, improving, and promoting the service.
• Recipients: technology providers acting on our behalf, with data hosted in the European Union. Your organization only receives aggregated, anonymous figures. If you arrive through one of our ads and finish the conversation, Meta receives the identifier for that click. We do not sell your data.
• Retention: conversations and product analytics events, 30 days; questionnaire results, for as long as your organization maintains the service plus 30 additional days.
• Rights: access, rectification, erasure, objection, restriction, portability, and withdrawal of consent, by writing to dpo@nexi-health.com. You may also lodge a complaint with the Spanish Data Protection Agency.

• Controller: NEXI HEALTH, S.L.
• Tax ID: B21726005
• Address: Paseo de Miramón, 170 – Gipuzkoa Science and Technology Park, 20014 Donostia/San Sebastián (Gipuzkoa), Spain
• Data protection officer: dpo@nexi-health.com

The service reaches you through your city council or another organization that contracts it (hereinafter, "your organization"). Although your organization gives you access, we are the ones who decide how your data is processed and who are accountable for it. Your organization has no access to your conversations or your individual answers.

If you use Bruna and the recommendations:

• Access data: your email address or mobile phone number, depending on how you sign in, and the verification codes we send you. If you start from your organization's link without signing in, we create an anonymous identifier that is linked to your account if you create one later.
• Name or the name you would like us to call you.
• Sociodemographic data you provide: date of birth, pronouns, marital status, employment status, industry sector, continent of nationality, and the area or neighborhood where you live.
• Wellbeing data: your responses to validated questionnaires on emotional wellbeing (WHO-5 index) and loneliness (UCLA three-item scale), and their scores.
• The content of your conversations with Bruna, in text or by voice. If you use voice, the audio is transcribed in real time and only the text is stored: the audio is not retained.
• If you speak with Bruna by phone: your number, and the date, time, and duration of the call.
• Your recommendations: the ones we suggest to you and the ones you save as favorites.
• Pseudonymized usage data: entry and return to the service, conversation start and progress, completion of initial onboarding, access to and use of recommendations (views, opens, favorites, filters, and discovery), return intervals, general duration ranges, and, if you arrive via a campaign link, its "ref" reference and "utm" parameters (source, medium, campaign, and ad). We do not send conversation content, search terms, responses, scores, sociodemographic values, or contact details to the analytics tool.
• If you arrive through one of our ads on Facebook or Instagram: the click identifier that Meta adds to the link ("fbclid") and your browser type. We cannot identify you from that identifier; only Meta can link it to its user.
• Technical data: IP address, browser and device type, language, and activity and error logs.

Your wellbeing data, and what you choose to share in your conversations, may reveal information about your health, which the law protects as a special category of data. For this reason, we only process it with your explicit consent and with enhanced protective measures.

If you work at an organization and use the dashboard:

• Name, email address, organization, role, and access credentials (passwords are stored in irreversibly encrypted form).
• If you choose to sign in with Google or Microsoft, the name, email address, and profile picture provided by that service.
• IP address, browser, and a log of the relevant actions you perform in the dashboard.

• Providing you with the service: maintaining the conversation with Bruna, conducting questionnaires, and preparing your personalized recommendations. Legal basis: performance of the terms of service (Article 6.1.b of the GDPR) and, for wellbeing data, your explicit consent (Articles 6.1.a and 9.2.a of the GDPR).
• Protecting you if we detect a risk situation: if signals appear during the conversation suggesting you may be in danger, Bruna stops the conversation and displays emergency phone numbers and resources to help you regain calm. We do not share this with your organization or any third party. Legal basis: your explicit consent and, where your life or safety is at stake, the protection of your vital interests (Articles 6.1.d and 9.2.c of the GDPR).
• Producing anonymous statistics for your organization: we combine results from many individuals so that your organization can understand the general wellbeing of its population or workforce. Legal basis: your explicit consent. The output is anonymous data that can no longer be used to identify you.
• Managing your account and access: verifying your identity, sending you codes, access links, invitations, or account notifications. Legal basis: performance of the terms of service (Article 6.1.b of the GDPR). For organization staff, our legitimate interest and that of the organization in delivering and using the contracted service (Article 6.1.f of the GDPR).
• Keeping the service secure: preventing unauthorized access and misuse, detecting errors, and maintaining audit logs. Legal basis: our legitimate interest in the security of the service (Article 6.1.f of the GDPR).
• Improving the service: we analyze pseudonymized usage events to understand where users drop off and how the chat and recommendations are used. User, conversation, and organization identifiers are transformed using separate secret keys before being sent to PostHog; we do not send conversation content, search queries, responses, scores, sociodemographic values, contact details, or the specific reason a conversation ends. Our team does not read your conversations for this purpose, and we do not use your data to train artificial intelligence models, whether our own or those of third parties. Legal basis: our legitimate interest in improving the service (Article 6.1.f of the GDPR).
• Measuring and improving our ads on Facebook and Instagram: if you arrive through one of our ads and finish the conversation with Bruna, we notify Meta, from our servers, that the click resulted in a completed conversation. We only send the click identifier, your browser type, and the time you finished: never your name, contact details, responses, scores, or what you share in the conversation. If the conversation stops because of a risk situation, we do not notify Meta. This allows Meta to measure which ads work, show them to people with similar interests, and stop showing them to people who have already used the service. Legal basis: our legitimate interest in promoting the service and making effective use of the resources allocated to promoting it (Article 6.1.f of the GDPR). You may object by writing to our data protection officer; you can also avoid this by accessing the service through your organization's link instead of an ad.
• Fulfilling legal obligations and responding to requests from authorities. Legal basis: compliance with a legal obligation (Article 6.1.c of the GDPR).

You may object at any time to processing based on our legitimate interest by writing to our data protection officer.

Bruna is an artificial intelligence system, not a person. To talk with you, it uses language models from Google (Gemini) and Anthropic (Claude, via Amazon Web Services), which run in data centers in the European Union and which, under their terms, do not use your data to train their models.

Bruna adapts the conversation and recommendations to what you tell it, and detects risk signals in order to trigger the protocol described above. None of this produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR: it does not affect your access to other services from your organization and is not shared with anyone. Even so, if you have questions about how it works, you can write to us and a person will get back to you.

Your organization only sees aggregated, anonymous figures, and only from groups of at least 10 people who are also sufficiently diverse that no individual can be identified. It never sees your conversations, your individual responses, your name, or your contact details.

Providers that process data on our behalf, under a data processing agreement that requires them to use it solely to provide their service to us:

• Google Cloud: hosting, database, AI models (Gemini), voice transcription, and Bruna's voice. In the Madrid region and other European Union regions.
• Amazon Web Services: Anthropic AI models (via Amazon Bedrock) and email delivery. In the European Union (Frankfurt).
• Telnyx: sending SMS verification codes and connecting phone calls with Bruna.
• Sentry: technical error detection, hosted in the European Union (Germany) and configured to not receive any data that identifies you.
• PostHog: product analytics hosted in the European Union. It receives only pseudonymized identifiers and the usage events described above, under our data processing agreement.

Meta Platforms Ireland Limited, only if you arrive through one of our ads on Facebook or Instagram and finish the conversation, using the data and for the ad measurement purpose described above. For that disclosure, Meta and NEXI HEALTH are joint controllers under the controller addendum to Meta's terms; Meta decides how it subsequently uses that data as an independent controller, according to its privacy policy. You can exercise your rights with either of us.

Google and Microsoft, only if you choose to sign in with your account from those services. In that case, they process your data as independent controllers, according to their own privacy policies.

Authorities and courts, when required by law.

We do not sell your data. Apart from the disclosure to Meta described above, we do not share it with anyone for advertising purposes.

We store and process your data in data centers in the European Union, mainly in Madrid.

All our providers process your data with residency in the European Union. Some belong to corporate groups headquartered in the United States; if an international transfer or access from outside the European Economic Area were ever to occur, it would be covered by the EU-U.S. Data Privacy Framework (European Commission adequacy decision of July 10, 2023), where the provider is certified, or by the standard contractual clauses approved by the European Commission (Article 46 of the GDPR). Meta, which is not one of our providers but a joint controller for the disclosure described above, may process the click identifier in the United States under that same Data Privacy Framework. You can ask us for information about these safeguards by writing to our data protection officer.

• Conversations with Bruna, including voice transcriptions: 30 days from the end of the conversation.
• Voice audio: not retained. It is processed in memory for transcription and discarded immediately.
• Questionnaire results, sociodemographic data, and recommendations: for as long as your organization maintains the contracted service. When the contract ends, they are deleted within 30 days.
• Your account: until you request its deletion or your organization's contract ends. Afterward, your data is deleted within 30 days.
• Technical logs and product analytics events: 30 days.
• Meta ad click identifier: we delete it as soon as we notify Meta that you have finished the conversation, or within 7 days at most if you do not finish it.
• Dashboard audit logs: for as long as your organization maintains the contracted service, plus 30 additional days.

Backups. To enable service recovery in the event of a critical failure, we store encrypted backups with restricted access, which are automatically deleted within a maximum of 12 months. As a result, deleted data may remain in those backups until they expire. We do not use them for any other purpose, and should we ever need to restore one, we would first re-apply all pending deletions.

When required by law, we will retain the minimum necessary data in a locked state, available exclusively to judges, courts, and authorities, for the statute of limitations period applicable to any potential liabilities (Article 32 of Organic Law 3/2018).

• We separate your identity from your wellbeing data: we store them linked to a pseudonymous identifier, managed by an independent internal service.
• For analytics, we transform user, conversation, and organization identifiers using HMAC and separate secret keys before sending them to PostHog.
• We encrypt data in transit and at rest, with encryption keys managed by us.
• We limit access to the people who need it for their work, subject to a duty of confidentiality, and we log sensitive actions.
• We apply anonymity rules to statistics: we hide any group of fewer than 10 people or that is not sufficiently diverse.
• If a security breach were to occur that affects you, we would notify the Spanish Data Protection Agency and, where applicable, you.

You can exercise the following rights at any time, free of charge:

• Access: find out what data of yours we process and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection: object to processing based on our legitimate interest.
• Restriction: ask us to keep your data without using it while a complaint is being resolved.
• Portability: receive the data you have provided to us in a structured, commonly used format.
• Withdraw your consent at any time, without affecting processing carried out beforehand. Since the service relies on that data, withdrawing your consent means you will no longer be able to use the conversation with Bruna or the recommendations.

To exercise them, write to dpo@nexi-health.com stating which right you wish to exercise and the email address or phone number you use the service with. We will reply within one month, which may be extended by two further months if the request is complex; in that case we will let you know. If we need to verify your identity, we will only ask for what is strictly necessary.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es). We recommend that you write to us first: we will try to resolve it.

The service is intended for people aged 18 and over. We do not knowingly process data from minors; if we find out that a minor is using the service, we will delete their data.

The service only uses technical cookies and local storage that are strictly necessary for the service to function:

• Session ("better-auth" and session context cookies): keep your session active and securely link it to your profile. They last for the duration of the session.
• Language ("PARAGLIDE_LOCALE" cookie): remembers the language you have chosen.
• Interface preferences ("collapsibleState" cookie and local storage): remember, for example, whether the side menu is open.

Product analytics and data disclosed to Meta are sent from our servers and do not install or read cookies or any other identifiers on your device: we do not use the Meta pixel. We do not use analytics, advertising, or third-party cookies. Because they are technical, the cookies listed above are exempt from consent requirements (Article 22.2 of Law 34/2002). You can delete them from your browser, although you will then need to sign in again. If we ever use other cookies, we will ask for your permission beforehand.

We may update this policy to reflect changes to the service or to the law. If the change is significant, we will notify you in the app itself before it takes effect and, where necessary, we will ask for your consent again. The date of the last review appears at the top of this page.