NeuraClinic

Privacy notice

Operational document pending legal review. This notice describes the currently known operation of NeuraClinic and does not constitute an absolute regulatory compliance statement.

Last updated: August 26, 2026

1. Controller and contact

Eduardo Antonio Saavedra Quijada, an individual operating under the trade name NeuraClinic, with an address at Calle 4 Oeste #38, Colonia Solidaridad, Nogales, Sonora, Mexico, is responsible for data related to NeuraClinic accounts, authentication, security, subscriptions, support and operational communications.

For privacy questions and ARCO requests, contact support@neuraclinic.app. Eduardo Antonio Saavedra Quijada handles these requests.

2. Scope and clinical-data roles

NeuraClinic is intended for psychology professionals and practices. For patient data, records, notes, history, assessments, responses, appointments, files and other clinical information entered by a professional, that professional determines the clinical purposes and acts as controller.

NeuraClinic acts as a technology processor and processes that information on the professional’s behalf and instructions to host, organize, consult, relate, process and present the service features. It does not use records for advertising, commercial patient profiling or model training.

The administrative panel is separated from clinical content and has no ordinary access to patients or clinical information.

3. Data and purposes

• Account and profile: name, email, professional profile and internal identifiers to create and maintain an account.
• Authentication and security: credentials, Google OAuth identity, session tokens, IP address, User-Agent, timestamps, routes and technical events to authenticate, protect accounts and prevent abuse.
• Service communications: email, name and account events for transactional authentication, security and operational messages.
• Support: information included in a support request to answer questions and solve problems. Do not send unnecessary clinical data by email.
• Subscriptions and payments: email, plan, subscription status and Stripe operational identifiers. Stripe processes card data; NeuraClinic does not store PAN or CVV.
• Clinical information: processed on the professional’s behalf to provide requested features.
• Public-site analytics: when the visitor authorizes it, Google Analytics 4 measures traffic, sessions, visited pages, interactions, acquisition source, general device and browser information, and approximate location to analyze public-site operation, understand useful content, and improve the experience.

4. Bases and professional decisions

Account creation and operation relate to service delivery and security, subject to final legal review. For clinical information, the professional determines the purposes, authorizations, consents and other applicable legal bases, especially for sensitive data or minors.

5. Providers and transfers

Technology providers may process information from other countries: Amazon Web Services (infrastructure, database, storage, secrets, DNS and transactional email), Stripe (payments), Google (user-requested sign-in and optional public-site Google Analytics 4) and Zoho Mail (support). Production AWS infrastructure uses us-east-1. We do not state that all data remains in Mexico.

Google LLC provides Google Analytics 4 when a visitor accepts optional analytics. The browser may communicate technical information needed to provide measurement. NeuraClinic does not configure Analytics to send names, emails, patient data, notes, assessments, or other clinical information. See Google's information about data from partner sites.

Facebook Login is technically implemented but not active in production and is not presented as an active provider. Optional analytics can be rejected and the choice can be changed through “Manage cookies”; it is separate from essential authentication cookies.

6. Retention and deletion

Data is retained while the relationship exists or while needed for service delivery, requests, security, payments or applicable obligations. The currently available closure operation logically deactivates an account; it must not be understood as immediate physical deletion of all clinical data, files, backups or versions.

Complete deletion, in-account deletion and definitive technical periods are pending implementation and verification. Contact support@neuraclinic.app for instructions about your information.

7. Rights

You may request access, correction, cancellation or opposition using the contact above. Requests will be handled within the periods established by applicable law. We may request reasonable information to verify the requester’s identity.

8. Security

NeuraClinic applies administrative and technical measures intended to protect information, including HTTPS/TLS, authentication and authorization, service separation, private file storage, restricted credential management, backups and at-rest encryption for clinical files stored in the applicable infrastructure. These measures are not an absolute guarantee.

9. Minors

NeuraClinic is not directed to minors as professional users. Professionals may record information about minor patients where relevant to their practice and must have the required authorizations, consents and other legal bases.

10. Incidents

If a security breach significantly affects data subjects’ rights, NeuraClinic will take necessary measures and make communications required by applicable law.

11. Changes

Changes will appear on this page through the last-updated date. Where appropriate, material changes may be communicated by email to registered users.

Read the Cookie and Similar Technologies Policy.