Data Processing Agreement

1. Parties

Controller: the professional or practice that holds the Nerela account and decides which of their patients' data is processed and why (the “Controller”).

Processor: LAGASTROEMIA VENTURES OÜ, a company incorporated in Estonia, with its registered office at Sakala tn 7-2, Kesklinna linnaosa, 10141 Tallinn, Estonia, VAT number EE102418024, which provides the Nerela service (“Nerela”). Data protection contact: admin@nerela.eu.

2. Subject matter and duration

Nerela processes, on the Controller's behalf, the personal data the Controller enters or collects through the App — mainly data about their patients, including health data — solely to provide the service described in the Terms and Conditions. The types of data, the categories of data subjects and the processing operations are described in Annex I.

This agreement applies for as long as the Controller has a Nerela account and, after that, for as long as Nerela holds data processed on the Controller's behalf (clause 12).

Data about the professional's own account (name, email, billing details for the Nerela subscription) is not covered: for that data, Nerela is the controller, as explained in the Privacy Policy.

3. Nature and purpose of the processing

Nerela hosts, organises, stores, displays, transmits and erases the data so that the Controller can use the App's features: calendar and appointments, patient records, session notes (including attached images), invoicing, online booking and reminders and, if the Controller turns them on, the optional modules (WhatsApp reminders, Virtual Secretary and card payments).

Nerela does not process this data for its own purposes: it does not sell it, does not disclose it to third parties, does not use it for advertising or profiling, and does not use it to train artificial intelligence models.

4. The Controller's instructions

Nerela processes the data only on documented instructions from the Controller, including with regard to transfers outside the European Economic Area (Article 28(3)(a) GDPR). Documented instructions are this agreement, the Terms and Conditions, the actions and settings the Controller makes in the App (for example creating, changing, exporting or deleting data, or turning on a module) and any request the Controller sends in writing to admin@nerela.eu.

If Nerela considers that an instruction infringes the GDPR or other data protection law, it informs the Controller immediately and may suspend carrying it out until the Controller confirms or changes it.

If Union or Member State law requires Nerela to process the data in another way, Nerela informs the Controller before doing so, unless that law prohibits this on important grounds of public interest.

Nerela staff only access the content of the Controller's account when the Controller asks them to (for example, for support), when it is necessary to resolve a security or operational incident, or when the law requires it.

5. Confidentiality and professional secrecy

Nerela ensures that the people authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, including after they stop working with Nerela, and that they access the data only as far as necessary to provide or support the service.

Nerela is aware that the Controller is bound by professional secrecy and treats all clinical information with the same discretion: it does not disclose it to anyone, except on the Controller's instructions or where the law requires it.

6. Security of processing

Nerela applies the technical and organisational measures in Annex II, which are appropriate to the risk of processing health data (Article 32 GDPR). It may replace them with equivalent or better measures as the service evolves, but never in a way that lowers the overall level of protection.

7. Sub-processors

The Controller gives Nerela general authorisation to engage the sub-processors listed in Annex III (Article 28(2) GDPR).

Before adding or replacing a sub-processor, Nerela informs the Controller by email and updates Annex III at least 30 days in advance. If one of Nerela's providers gives Nerela shorter notice of a change in its own chain, Nerela informs the Controller as soon as it becomes aware of the change.

The Controller may object to the change in writing, on reasonable data protection grounds, until the date on which it takes effect. If no acceptable solution is found (for example, no longer using the module concerned), the Controller may close the account before that date without any penalty.

Nerela imposes on each sub-processor, by written contract, data protection obligations equivalent to those in this agreement (Article 28(4)) and remains fully liable to the Controller for their performance.

Services that the Controller chooses and contracts directly, and to which the Controller asks the App to send data, are not Nerela's sub-processors — for example, the video consultation tool whose link the Controller enters, the certified invoicing software or the Stripe account the Controller connects, ADSE (Portugal), the calendar in which the Controller subscribes to the schedule, or the accountant to whom the Controller sends reports. For these, Nerela only transmits the data the Controller specifies, when the Controller specifies it.

8. International transfers

The App's database, authentication and files are hosted in the European Union (Paris, France). Some sub-processors process data outside the European Economic Area (EEA), mainly in the United States: Annex III shows, for each one, where it processes the data and under which safeguard.

Nerela only transfers personal data outside the EEA, or allows a sub-processor to do so, with one of the safeguards in Chapter V GDPR: an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework, for certified companies), the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, or another appropriate safeguard under Article 46.

Transfers linked to WhatsApp (WhatsApp reminders and the Virtual Secretary) only take place if the Controller uses those features.

9. Data subjects' rights

Requests from data subjects (access, rectification, erasure, restriction, objection and portability) are answered by the Controller. The App lets the Controller view, correct and delete their patients' data directly: deleting a patient also deletes their appointments, session notes and clinical images; invoices already issued are kept because of tax obligations, and both they and any WhatsApp conversations are unlinked from the patient record. For portability, the Controller can obtain the data as provided in clause 12.

If a data subject contacts Nerela directly, Nerela forwards the request to the Controller without undue delay and within 5 working days at most, and does not reply on its own account, except to confirm that the request has been forwarded.

Taking into account the nature of the processing, Nerela assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in responding to such requests (Article 28(3)(e)).

10. Personal data breaches

Nerela notifies the Controller of any personal data breach affecting data processed on the Controller's behalf without undue delay after becoming aware of it, by email to the account's address. [PENDING: maximum deadline to be set with the lawyer; proposal: 48 hours.]

The notification includes, as far as Nerela knows it, the information in Article 33(3) GDPR — the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point — and is completed in phases as the investigation progresses.

Nerela immediately takes reasonable steps to contain the breach and mitigate its effects, and helps the Controller meet its own obligations: notifying the competent supervisory authority within the 72 hours set by Article 33 and, where the risk is high, communicating the breach to the data subjects (Article 34). Nerela does not notify authorities or data subjects on the Controller's behalf without the Controller's instruction, unless the law requires it to.

11. Assistance to the Controller

Taking into account the nature of the processing and the information available to it, Nerela helps the Controller comply with the obligations in Articles 32 to 36 GDPR: security of processing, personal data breaches, data protection impact assessments and prior consultation of the supervisory authority. To that end, it makes this agreement and its annexes available, answers reasonable questions about how the App works and tells the Controller about relevant changes to the service.

12. End of the service: return and deletion

At the Controller's written request to admin@nerela.eu, Nerela provides it, within 30 days, with a copy of the personal data it processes on the Controller's behalf, including attached files, in a structured, commonly used and machine-readable format. Where the App allows the data to be exported (under Settings, in the privacy and data section), the Controller can also download it directly; that export is one means of obtaining the data and does not replace this obligation.

Before closing the account, the Controller should obtain a copy of anything it needs to keep — for example, clinical records and invoices that the law or the rules of its profession require it to retain.

After the service ends, Nerela deletes the personal data processed on the Controller's behalf, including existing copies, unless Union or Member State law requires it to be stored. If the Controller asks for a copy before then, Nerela provides it before deleting the data. Data still held in backups is not used for any purpose until it is erased. [PENDING: deadline to be set; proposal: 30 days, plus the backup retention cycle.]

13. Demonstrating compliance and audits

Nerela makes available to the Controller the information needed to demonstrate compliance with this agreement and with Article 28 GDPR — this agreement, the list of sub-processors and the description of the measures in Annex II — and answers the Controller's reasonable questions in writing.

Nerela allows for and contributes to audits, including inspections, conducted by the Controller or by an auditor mandated by the Controller and bound by confidentiality. Except after a personal data breach or at the request of a supervisory authority, audits are requested in writing at least 30 days in advance, take place no more than once a year at the Controller's expense, and may not give access to other customers' data or compromise the security of the service.

14. The Controller's obligations

The Controller warrants that it has a valid legal basis to process its patients' data, including one of the conditions in Article 9(2) GDPR for health data, and that it informs them in accordance with Articles 13 and 14, including about the categories of recipients.

It gives lawful instructions, decides how long each item of data is kept in line with the law and the rules of its profession, and does not enter into the App data about people with whom it has no legitimate professional relationship.

It protects access on its side: it keeps its credentials safe, manages which members of its team have access and at what level, and protects the devices and the email or WhatsApp accounts on which it receives information from the App. It decides whether to turn on the optional modules, knowing that they involve the transfers described in Annex III.

15. Liability

Each party is liable to data subjects in accordance with Article 82 GDPR. If Nerela processes the data for its own purposes or contrary to the Controller's lawful instructions, it is considered a controller in respect of that processing (Article 28(10)). [PENDING: how this fits with the limitation of liability in section 10 of the Terms and Conditions, to be reviewed with the lawyer.]

16. Changes, precedence and governing law

Nerela may update this agreement to reflect changes to the service, to the sub-processors (clause 7) or to the law. Material changes are communicated to the Controller by email or in the App with reasonable advance notice.

If this agreement and the Terms and Conditions conflict on the protection of personal data, this agreement prevails.

This agreement is governed by the GDPR and by the law of the applicable Member State. [PENDING: choice of governing law and jurisdiction, to be decided with the lawyer; the Terms and Conditions do not make one today.]

17. Contact

For any question about this agreement, to request a copy of the data or to report a security incident, the Controller can write to admin@nerela.eu. [PENDING: decide whether Nerela designates a data protection officer (Article 37 GDPR) and a dedicated address for incidents.]

Annex I — Description of the processing

• Data subjects: the Controller's patients, including minors in the Controller's care; people who book an appointment through the Controller's public booking page; people whose data the Controller records in the patient record or in invoicing (for example, whoever receives the invoice); people who write to the WhatsApp number answered by the Virtual Secretary, if that module is active; the professionals and other members of the Controller's team; and the accountant to whom the Controller sends reports.
• Identification and contact data: name, initials, email, phone number, address and tax details (tax identification number and billing name and address).
• Administrative data: appointments (date, time, duration, service, in-person or online format, room, professional and status), attendance and no-shows, payments and invoices, insurer or reimbursement scheme, assigned professional and the patient's origin.
• Health data (special category, Article 9 GDPR): session notes and attached images, clinical background, warning signs and next steps recorded in the patient record, and any other clinical information the Controller enters. The mere fact that someone is a psychologist's patient may reveal health information.
• Communications: reminders, invitations and invoices sent to patients by email and, if the Controller uses WhatsApp, WhatsApp messages (reminders and conversations with the Virtual Secretary).
• Technical data: server access and error logs.
• Operations: collection (by the Controller or through the booking page), recording, organisation, storage, consultation, display, generation of documents (invoices and reports), sending of emails and messages, export and erasure.
• Purpose: providing the Controller with the practice management service described in the Terms and Conditions.
• Duration and retention: for as long as the account exists and, afterwards, in accordance with clause 12. While the account is active, the Controller decides how long each item of data is kept and can delete it in the App.
• Location: database, authentication and files in the European Union (Paris, France); the App's server functions also run in Paris. Static assets and request routing go through Vercel's global network, and processing outside the EEA is listed in Annex III.
• Frequency: continuous, for as long as the Controller uses the App.

Annex II — Technical and organisational measures

Measures that exist in the App today. Nerela reviews them whenever the service changes.

• Encryption in transit: all communication with the App uses HTTPS (TLS), with HSTS enabled so that browsers refuse unencrypted connections.
• Isolation between accounts within the database itself: the tables holding customer data have PostgreSQL Row Level Security (RLS) policies, which only allow reading and writing the rows of the accounts the user belongs to. The separation does not depend solely on the App's code.
• Access levels within an account (owner, manager and team member): patient records, appointments and session notes follow a single rule enforced in the database — the owner and managers see everything; a team member sees the patients assigned to them and, if the account allows it, those shared with the team. Invoicing, expenses and WhatsApp conversations are restricted to the owner and managers, and credentials for external services to the owner.
• Clinical images in a private storage container, organised by account and protected by RLS; they are only displayed through signed links that expire after 12 hours.
• Credentials for external services the Controller connects (certified invoicing software, ADSE) are stored encrypted in the database (pgcrypto), with the encryption key kept outside the database.
• Rate limits on public entry points and on outgoing messages (online booking, links shared with the accountant, the public demo, and WhatsApp and email sending), with the counters kept in the database.
• Webhooks from the payment and WhatsApp providers are only accepted with a valid signature, and scheduled jobs require a secret.
• Security headers: the App cannot be embedded in other websites, and browsers receive HSTS, nosniff, a referrer policy and a permissions policy that blocks the camera, microphone and location.
• Minimising what leaves the App: the subscribed calendar shows only a generic title, never the patient's name; the video consultation link is a random, revocable code limited to the appointment window, which reveals neither the patient's name nor the notes.
• The database service key, which bypasses RLS, exists only on the server and never reaches the browser. Keys and secrets are kept in the hosting provider's environment variables, never in the code.
• Error monitoring (if enabled) with filtering before sending: no request bodies, parameters, cookies, user identity or session recording, plus an automatic attempt to strip email addresses, phone numbers and tax numbers from error text.
• There is no advertising and no third-party analytics in the App.
• Virtual Secretary (if enabled): the text written by whoever sends messages is kept separate from the system instructions, and actions on the calendar can only affect the sender's own appointments, identified by their full international phone number.
• Effective deletion: deleting a patient deletes their appointments, session notes and clinical images, including the files in storage.
• Access by Nerela staff: within the App, only platform administrators have internal functions. Entering a customer's account to give support is only possible with that permission, and every entry is recorded in a log that cannot be changed or deleted from the App.
• Confidentiality of the people who process the data (clause 5) and access to account content only in the cases set out in clause 4.
• A written internal procedure for responding to incidents, including personal data breaches.
• Backups: those made by the database provider under the plan Nerela subscribes to. [PENDING: confirm the Supabase plan and the frequency and retention of backups.]

Annex III-A — Sub-processors that process patient data

List as at 9 October 2026. Locations and safeguards are those stated in each provider's public documentation.

Annex III-B — Providers that do not process patient data

Listed so that the Controller knows who else is involved in the service. They process data about the professional, for which Nerela is the controller.