PRIVACY POLICY — iNuba Clinic (Professionals)
This Policy informs the professionals, Account Holders and staff of Customer entities ("you") about the processing of your personal data when using iNuba Clinic. The processing of the data of your End Users (the iNuba App users linked to your clinic) is governed by the Data Processing Agreement (section 16 of the Clinic T&C) and, as regards the data that iNuba processes as Data Controller, by the iNuba App Privacy Policy.
1. Data Controller
3DHealthAI, S.L. ("iNuba"), Polígono Industrial Los Vientos, C/ Levante, 1, 46119 Náquera (Valencia), Spain, NIF B-40644445. DPO: dataprotection@inuba.com.
2. Data we process
- Identification and account: name, email address, password (encrypted), telephone number, sector, working mode and other onboarding data (number of customers, teamwork, website, features of interest and how you heard about us); your role and the company you belong to; optional profile picture. If you sign in with Google: email address and name.
- Company tax and billing data: registered company name, NIF/CIF, address, billing email address, CNAE code, currency; subscription identifiers and identifiers of your Stripe Connect account. Card data is processed by Stripe.
- Use of the Platform: access and seat logs, account activity (plan and seat changes, lifecycle), audited access to blocked records, consents and acceptances of legal texts (with date, IP address, device, version and digital fingerprint of the document).
- Communications: transactional emails (verification, billing, non-payment, invitations, calendar reminders, catalogue alerts and pending-note alerts, password reset and account closure), messages you send in the Platform chat with your End Users, and support requests. If you use the WhatsApp help button, available on the Pro and Platinum plans, the conversation takes place on WhatsApp (Meta) using your telephone number.
- Data received from third parties: if your registration comes through an authorised distributor, the distributor provides us with the name of the clinic, the Account Holder's email address and telephone number and, where applicable, the CIF.
- Web analytics: on the public pages we use Google Analytics 4 only if you accept cookies (consent denied by default). There is no third-party analytics in the private area. Certain conversion events are also reported server-side, relying on the identifier captured with your cookie consent.
3. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Registration, authentication and provision of the Platform (including, where applicable, management of the White Label Mode: API credentials, branding and billing for that mode) | Contract (Art. 6(1)(b) GDPR) |
| Billing of the subscription and of commissions; tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Management of non-payment (escalating notices, suspension, closure) | Contract and legitimate interest (Arts. 6(1)(b) and (f) GDPR) |
| Operational service communications | Contract (Art. 6(1)(b) GDPR) |
| B2B marketing (commercial communications about iNuba, management of the trial and subscription cycle through our marketing tool) | Legitimate interest in B2B commercial communication with customers and trial users (Art. 6(1)(f) GDPR), with a right to object in every message sent and at dataprotection@inuba.com |
| Analytics on the public pages | Consent (cookies) |
| Security, auditing and evidencing of consents | Legitimate interest and Art. 7(1) GDPR |
| Relationship with distributors (attribution of the registration, subscription status) | Legitimate interest and performance of the contract |
4. Recipients
- Stripe (payments, billing, taxes).
- Amazon Web Services (EU, Paris) and OVHcloud (France): hosting; Amazon SES: transactional email.
- ActiveCampaign (marketing tool, USA): receives your email address, name and the status of your trial/subscription in order to manage our commercial communications. It receives no End User data. International transfer covered by the EU-US Data Privacy Framework and/or standard contractual clauses, with a data processing agreement in place.
- Calendly (scheduling of demonstrations and sales meetings): if you request a meeting from the Platform or from our website, it receives your name, your email address and the booking details.
- Google: Analytics 4 (only with your cookie consent; possible transfer to the USA subject to the safeguards referred to above), sign-in provider if you sign in with Google, and, if you connect your clinic's Google account, the creation of Calendar/Meet events.
- Meta (WhatsApp): only if you use the WhatsApp help button; iNuba does not store that conversation.
- Authorised distributor: if your registration comes through it, it receives the activation status and the subscription amounts of the clinic (with no End User data).
- Public administrations and authorities where there is a legal obligation.
5. International transfers
Hosting and backups in the EU (France). Transfers to the USA arising from ActiveCampaign, Google and Meta are covered by the EU-US Data Privacy Framework and/or by standard contractual clauses. Further information: dataprotection@inuba.com.
6. Retention
- Active account: for as long as the relationship lasts.
- After closure of the account: Professional's data 4 years; Account Holder's data 6 years (commercial and tax obligations); thereafter, irreversible anonymisation.
- Consent and acceptance records: retained as evidence of compliance with Art. 7(1) GDPR for as long as the relationship lasts and for the periods set out above after closure of the account.
- Non-payment cycle: a suspended account retains its data and may be reactivated by paying up to day 67; after closure the periods set out above apply, with the possibility of restoration during the retention period by requesting it from iNuba, subject to re-acceptance of the texts then in force.
7. Your rights
Access, rectification, erasure, objection (including objection to B2B marketing), restriction and portability, and withdrawal of consents, at dataprotection@inuba.com. The Platform provides you with the consents screen and the acceptance history. Supervisory authority: Spanish Data Protection Agency (AEPD) (aepd.es).
8. Security
Encryption in transit (TLS) for communications with the Platform, role-based access control, email address verification, immutable log of acceptances, auditing of access to blocked records, daily backups on a separate server in the EU, and logical isolation per company.
9. Cookies
The public pages display a banner with genuine options to accept or reject; analytics is disabled by default. Details at inuba.com/politica-de-cookies.
10. Changes
We will publish new versions with their date and digital fingerprint; where appropriate, re-acceptance will be requested through the Platform's mandatory screen.