Privacy Policy

1. Who decides about each piece of data

• Professional account, practice, subscription and website browsing data: Nheva is the controller.
• Client data entered or collected for care (registration, records, activities, mood diary, messages, charges): the professional or practice is the controller, and Nheva acts as processor, following their instructions and the Professional Agreement.
• Client payments collected by Nheva: Nheva processes the data needed to process, pay out and, if applicable, refund the payment.

2. What data we process

• Professionals: name, e-mail, phone for alerts, license number and certificate (when requesting the early-career discount), practice details, prices, availability, professional website content, payout details (PIX key or bank account, holder and CPF/CNPJ) and subscription history.
• Clients: name, contacts, CPF and data the professional records; progress notes and records; app activities, answers and mood diary; messages exchanged through the practice's WhatsApp; sessions and charges.
• Payers: name and CPF for PIX; card details are entered directly with Stripe and are not kept by Nheva.
• Usage: access and security logs, IP address, device and technical errors.

3. Why we use it and on which legal basis

• Providing the contracted service: performance of a contract.
• Health protection and psychological care by the professional, for clients' sensitive data, as well as compliance with professional rules on records.
• Processing payments, payouts and refunds, and meeting tax and regulatory obligations: performance of a contract and legal obligation.
• Keeping the platform secure, preventing fraud and logging access: legitimate interest and legal obligation (Brazilian Internet Civil Framework).
• Sending operational notices (alerts, charges, reminders): performance of a contract.

We don't sell personal data, don't use it for advertising and don't use client data to train artificial intelligence models.

4. Artificial intelligence

When the professional uses AI features, the text or audio is sent to AI model providers only to generate the response. Before sending, we remove the client's name, CPF, phone and e-mail. Results are drafts reviewed by the professional; there are no automated decisions about clients.

5. Who we share it with

We share data only with providers needed for the service, under contract and with security and confidentiality obligations:

• Clerk (sign-in and authentication);
• Supabase (database and file storage);
• Vercel (hosting and access to AI models) and the AI model providers reached through it;
• Stripe (card payments) and MisticPay (PIX payments);
• transactional e-mail providers (Brevo, Mailjet or Resend);
• WhatsApp/Meta, through the practice's connected number, for messages with clients;
• Google (Calendar, Meet, Drive and Gmail), only when the professional connects their own Google account: session events without clinical content, Meet links and transcripts, copies of signed notes in their Drive and emails they send;
• Sentry (error monitoring, without clinical content).

Nheva's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is not used for advertising or to train artificial intelligence models.

We may also share data when required by law or a competent authority. One client's data is never shown to another practice; the Nheva team has no access to records and sees financial data only, without client names.

6. International transfer

Some of these providers process data outside Brazil, mainly in the United States. In those cases we adopt the safeguards provided for in the LGPD, such as data protection contractual clauses.

7. Security

Client personal data, progress notes, documents, activities and answers, mood diary, scale results, care alerts, WhatsApp contacts and messages, and payout details are encrypted (AES-256) with keys separated by field and by practice. The database denies any direct access from the browser, records are visible only to the responsible professional, signed notes can't be changed and every access to records is logged. No measure is infallible; in case of a relevant incident, we will notify those affected and the ANPD as required by law.

These measures are described in plain language on this site's Security and privacy page.

8. How long we keep it

• Clinical records: for the minimum period required by the Federal Council of Psychology, even after the account is closed.
• Financial and tax records: for the period required by tax law.
• Access logs: for the period required by the Brazilian Internet Civil Framework.
• Other account data: while the account exists and for as long as needed to meet obligations and exercise rights.

After those periods, data is deleted or anonymized.

9. Your rights

You may request confirmation of processing, access, correction, anonymization, portability, deletion of data processed with consent, information about sharing and review of automated decisions, and you may complain to the National Data Protection Authority (ANPD).

Professionals: write to privacidade@nheva.com.br. Clients: requests about care data should be made to your professional, who is the controller; Nheva helps them respond. If you prefer, write to privacidade@nheva.com.br and we will forward it.

How to delete your app or platform account, and what must be kept by law, is explained on the Account and Data Deletion page.

10. Cookies

We use only essential cookies: those for sign-in and account security and the one that remembers your language. We don't use advertising or third-party tracking cookies.

11. Children and adolescents

Professional accounts are only for people aged 18 or over. When the professional sees children or adolescents, it is up to them to obtain the guardians' consent and process the data in the client's best interest.

12. Data protection officer and changes

Data protection officer (DPO): privacidade@nheva.com.br. We may update this Policy; material changes will be announced in the app or by e-mail.