Nymo Clinic is committed to protecting your privacy and handling personal data securely, lawfully, and transparently. This Privacy Policy explains how we collect, use, store, and protect personal information when you visit our website, contact us, request a demo, use our services, or interact with our clinic management platform.
Nymo Clinic is a modern clinic management software platform designed for UK private clinics and healthcare providers.
For the purposes of UK data protection law, including the UK GDPR and the Data Protection Act 2018, NYMO HEALTH LTD may act as either:
We only process personal data where we have a lawful basis to do so. Depending on the circumstances, we may rely on one or more of the following lawful bases:
We may process personal data where it is necessary to provide our services, manage customer accounts, deliver support, or perform a contract with you or your organisation.
We may process personal data where it is necessary for our legitimate business interests, such as improving our services, responding to enquiries, securing our systems, managing business relationships, and developing our platform, provided those interests do not override your rights and freedoms.
We may rely on consent for certain types of marketing, cookies, or optional communications. Where we rely on consent, you can withdraw it at any time.
We may process personal data where required to comply with legal, tax, accounting, regulatory, or security obligations.
Where health-related or clinical data is processed through the platform, this may include special category data. Where Nymo Clinic acts as a processor, we process this data only on behalf of the clinic customer and in accordance with their instructions.
Nymo Clinic provides software tools to healthcare clinics and professionals. We do not usually decide why or how patient data is used by a clinic. The clinic using our platform is normally responsible for deciding how patient data is collected, used, retained, and shared.
If you are a patient of a clinic that uses Nymo Clinic, you should contact that clinic directly for information about how your personal and health data is handled, or to exercise your data protection rights.
Where we process patient or clinical data on behalf of a clinic, we apply appropriate security measures and process that data only under the clinic’s documented instructions.
Nymo Clinic may include AI-assisted features designed to help clinics reduce administrative work, draft clinical notes, support workflows, or extract useful insights.
AI-assisted features are intended to support healthcare professionals, not replace clinical judgement. Clinics remain responsible for reviewing, verifying, and approving any content, notes, or outputs created using AI-assisted tools.
Where AI-assisted features process personal or clinical data, this is handled in accordance with applicable data protection requirements, customer agreements, and security controls.
Google data accessed
When an authorised clinic user connects their Google account to Nymo Clinic, Nymo Clinic accesses Google Calendar data using the following OAuth permission:
https://www.googleapis.com/auth/calendar.events.owned
This permission allows Nymo Clinic to view, create, update and delete events on Google Calendars owned by the connected user.
The Google Calendar data accessed may include:
Nymo Clinic does not access Gmail messages, general Google Drive files, Google Meet recordings or Google Meet transcripts through this integration.
How Google data is used
Google user data is used only to provide the Google Calendar and Google Meet appointment functionality requested by the connected clinic user.
This includes:
Google user data is not used for advertising, targeted advertising, credit assessment, lending, data brokerage or any unrelated purpose.
Google data sharing and transfer
Nymo Clinic does not sell Google user data.
Google user data is not shared with advertisers, data brokers, information resellers or other unrelated third parties.
Google user data may be processed by service providers that support the secure hosting, infrastructure and operation of Nymo Clinic, but only where necessary to provide or maintain the user-facing functionality. Such providers are required to protect the data and process it only for the authorised purpose.
Appointment attendees may receive event and Google Meet information where the connected clinic user chooses to add them to an appointment.
Google data storage and protection
Nymo Clinic uses appropriate technical and organisational measures to protect Google user data against unauthorised access, disclosure, alteration, misuse or loss.
These measures include encrypted HTTPS connections during transmission, access controls, role-based permissions, secure hosting environments, logging and monitoring, and restricted access to authorised systems and personnel.
Google OAuth access and refresh tokens are stored securely and are not disclosed to patients, advertisers or unauthorised third parties.
Google data retention and deletion
Google Calendar event information and related identifiers are retained only for as long as necessary to provide the calendar integration, maintain the relevant appointment record, comply with applicable legal requirements or fulfil the clinic customer’s documented instructions.
A connected user may disconnect their Google account from Nymo Clinic. When the integration is disconnected, Nymo Clinic stops accessing the user’s Google account and deletes or invalidates the stored Google OAuth credentials in accordance with its data-retention procedures. Users may also request deletion of their Google integration data or Nymo Clinic account by contacting Nymo Clinic. Where applicable, data will be securely deleted or anonymised unless retention is required by law or under a valid contractual obligation.
Disconnecting Nymo Clinic does not automatically delete events that have already been created in the user’s Google Calendar unless the user or the applicable Nymo Clinic functionality separately deletes those events.
Google API Services User Data Policy
Nymo Clinic’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Raw, derived, aggregated or anonymised Google Workspace API user data is not used to develop, improve or train general-purpose or non-personalised artificial intelligence or machine-learning models.
Google Workspace API user data is not transferred to third-party artificial intelligence or machine-learning services for the purpose of developing, improving or training their models.
We may use your contact details to send relevant updates about our services, product features, offers, or educational content.
You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails or contacting us directly.
We will not sell your personal data to third parties.
Our website may use cookies and similar technologies to:
Some cookies are necessary for the website to function. Others, such as analytics or marketing cookies, may require your consent. You can manage or disable cookies through your browser settings or through any cookie preference tool provided on our website.
We may share personal data with trusted third parties where necessary, including:
Where third parties process personal data on our behalf, we require them to protect the data and use it only for the agreed purpose.
Some of our service providers or technology partners may process data outside the United Kingdom.
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, international data transfer agreements, or other lawful transfer mechanisms.
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.
These measures may include:
Although we take reasonable steps to protect personal data, no online system can be guaranteed to be completely secure.
We keep personal data only for as long as necessary for the purpose for which it was collected.
Retention periods may vary depending on the type of data and the reason for processing. For example:
When personal data is no longer required, we will securely delete, anonymise, or return it where appropriate.
Under UK data protection law, you may have the following rights:
To exercise your rights, please contact us using the details in this Privacy Policy.
If your request relates to patient or clinical data held by a clinic using Nymo Clinic, we may direct you to the relevant clinic because they are usually the data controller.
If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue.
You also have the right to complain to the UK Information Commissioner’s Office.
Our website may contain links to third-party websites, services, or integrations. We are not responsible for the privacy practices, content, or security of those third-party services.
We recommend reviewing the privacy policies of any third-party websites or services you use.
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or business operations.
The latest version will always be available on our website. Where changes are significant, we may take additional steps to notify users or customers.