Privacy Policy

1. Who we are

The controller of your personal data is NEXAI AGENCY S.R.L., with its registered office in București, Sector 6, Str. Drumul Taberei nr. 73B, Bl. TS40, Sc. A, Et. 2, Ap. 14, Romania, CUI 52784369, registered with the Trade Register under no. J2025082521001, represented by David Nicolau, Administrator ("NexAi", "we").

For any question or request about personal data, you can write to us at contact@nexaiagency.ro.

2. When this policy applies

This policy explains how we process personal data when you:

• visit the Ela platform;
• create an account and fill in the application for access to Ela;
• communicate with us about your application (phone, email, WhatsApp).

This policy does not apply to patient data processed through the Ela service after a contract is signed. For that data, the clinic is the controller and NexAi acts as processor, under a data processing agreement (DPA) signed separately with each clinic.

3. What data we collect

We only collect the data you give us in the form:

• contact details: first name, last name, your role at the clinic, email address, phone number;
• account details: email address and password (the password is stored encrypted by the authentication system and we cannot see it);
• clinic details: name, country, city, tax identification code, website, specialties, number of doctors and locations;
• information about your activity: call volume, reception hours, languages spoken by patients, how appointments are booked, the clinic's needs, the preferred voice for Ela;
• minimal technical data: the date and time of your consent, the policy version accepted, the language chosen and the strictly necessary authentication cookies.

We do not ask for patient data, health data or personal identification numbers. Please do not include such information in your answers.

4. Why we use the data and on what legal basis

• To evaluate your application, contact you, organize the discovery call and send you an offer – basis: steps taken at your request before entering into a contract (Art. 6(1)(b) of Regulation (EU) 2016/679 – "GDPR").
• To manage your account, secure the platform, prevent abuse and keep internal records – basis: our legitimate interest in operating a secure platform (Art. 6(1)(f) GDPR).
• To send you news about Ela – only if you ticked the separate option, basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time, without affecting processing carried out before.
• To meet legal obligations (for example accounting and tax, if you become a client) – basis: legal obligation (Art. 6(1)(c) GDPR).
• To establish, exercise or defend legal claims – basis: legitimate interest (Art. 6(1)(f) GDPR).

5. Prioritizing applications

Based on your answers in the form (for example call volume or number of doctors), we calculate an internal score that helps us decide the order in which we contact clinics. The score has no legal effect and is not an automated decision to accept or reject: every application is reviewed by a person on our team.

6. Who we share the data with

We do not sell or rent your data. We only share it with providers who help us run the platform and our communication, acting as processors, under contract and only as far as necessary:

• the platform's hosting, database and authentication provider;
• automation and customer relationship management (CRM) tools;
• email, phone and messaging services (including WhatsApp), used to contact you;
• advisers (accountants, lawyers), when needed, under a duty of confidentiality.

We may share data with public authorities only when the law requires us to.

7. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area. In such cases, we make sure the transfer only takes place with appropriate safeguards, such as a European Commission adequacy decision (for example, the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission. You can ask us for details at contact@nexaiagency.ro.

8. How long we keep the data

• Unfinished applications (account created, form not submitted): 90 days from the last change, then deleted automatically.
• Submitted applications that do not become a contract: 12 months from the last update, then deleted automatically.
• If you become a client: for the duration of the contract and afterwards for the periods required by tax and accounting law or needed to defend legal claims.
• Data for news: until you withdraw your consent.

9. Your rights

Under the GDPR, you have the right:

• to access your data and receive a copy of it;
• to have inaccurate data corrected;
• to have your data erased ("the right to be forgotten");
• to restrict processing;
• to data portability;
• to object to processing based on legitimate interest;
• to withdraw your consent at any time;
• to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, București, www.dataprotection.ro.

You can download or delete your account and data directly from the status page of the app ("Your data"). For the other rights, you can write to us at contact@nexaiagency.ro. We reply within one month of receiving your request.

10. How we protect the data

We use encrypted connections (HTTPS), passwords stored encrypted, data access strictly limited per account (each user sees only their own data) and internal access given only to team members who need it. No system is completely secure, but we take appropriate technical and organizational measures and will inform you as required by law if an incident affects you.

11. Cookies

The platform only uses strictly necessary cookies: to keep you logged in and to remember the language you chose. We do not use analytics, advertising or tracking cookies. For this reason we do not show a cookie banner. If we add such cookies in the future, we will ask for your consent first.

12. Minors

The platform is intended exclusively for clinics and professionals. We do not knowingly collect data from people under 18.

13. Changes

We may update this policy. The current version and the date of the last update always appear at the top of the page. If the changes are important, we will let you know by email or in the app.

14. Contact

NEXAI AGENCY S.R.L. · contact@nexaiagency.ro · București, Sector 6, Str. Drumul Taberei nr. 73B, Bl. TS40, Sc. A, Et. 2, Ap. 14 · CUI 52784369 · J2025082521001