This Privacy Policy explains what personal data Nexora collects, why it is used, the legal bases for processing, who it may be shared with, how it is protected and what rights users may have.
1. Who we are
Nexora is a digital platform for managing state, energy, recovery and long-term wellbeing through personalised recommendations, protocols, educational materials, AI personalisation, online events and community features.
Nexora is a brand and platform operated by the legal entity identified in the “Operator Details / Данные оператора” section at the end of this document. In this Policy, “Nexora”, “we”, “us” or “our” means the operator of the Nexora service, and “user”, “you” or “your” means the person using the website, tests, materials, protocols, account, community, events or other Nexora features.
2. Scope of this Policy
This Policy applies to the Nexora website, registration and contact forms, tests, onboarding, account area, protocols, educational materials, online events, community, newsletters, support and related digital services.
Nexora may process data about state, habits, sleep, nutrition, activity, recovery, goals and subjective wellbeing. Such data may be sensitive and, in some cases, may qualify as special category personal data. We process such data only where we have an appropriate legal basis, including explicit consent where required by applicable law.
3. Data we may collect
Account data: name, email, phone number, login, language, country, profile settings and authentication data.
Contact data: website requests, contact forms, messenger communications and support requests.
Test and onboarding data: answers about goals, routine, sleep, energy, stress, recovery, nutrition, activity, limitations and current state.
Health/lifestyle data: information about wellbeing, sleep, nutrition, physical activity, recovery, weight, habits, symptoms, goals, state dynamics and other parameters voluntarily provided by the user.
Progress data: protocol completion, check-ins, metrics, journals, State Score or other calculated indices, and recommendation history.
Payment data: information about plan, payment, invoice, refund and access status. Full card data is usually processed by the payment provider, not by Nexora.
Technical data: IP address, device type, browser, operating system, language, cookie identifiers, website pages and actions, access date and time, and security logs.
Communications and community data: messages, comments, questions, reactions, event participation and other materials submitted or posted within the service.
Integration data: data from wearables, health apps, calendars, activity trackers or other services if the user connects such integrations and grants the required permissions.
4. Purposes of processing
creating and maintaining the user account;
running tests, onboarding and initial goal segmentation;
generating personalised routes, protocols, recommendations, educational materials and reminders;
adapting the interface, content and communications to user goals, language and preferences;
providing access to online events, protocols, community and expert support;
processing payments, subscriptions, invoices, refunds and billing requests;
supporting users and responding to requests;
analytics, product improvement, hypothesis testing, bug fixing and feature development;
security, prevention of abuse, fraud and unauthorised access;
compliance with legal, accounting, tax and regulatory obligations;
marketing communications where the user has consented or where permitted by applicable law.
5. Legal bases for processing
Depending on the context, we rely on one or more of the following legal bases:
Contract or pre-contractual steps: where data is needed to provide access to the service, plan, event, protocols, support or account area.
Consent: where the user voluntarily provides data, consents to cookies, marketing, optional features or integrations.
Explicit consent: where data may qualify as special category personal data, including health or state-related data.
Legitimate interests: for security, abuse prevention, product improvement, internal analytics and protection of the rights of Nexora and users, provided such interests are not overridden by user rights.
Legal obligation: where we must retain or disclose certain data under the law, including accounting, tax or legal records.
6. State, health and sensitive data
Nexora does not require users to disclose medical diagnoses. However, users may voluntarily provide data that directly or indirectly reflects health, stress, sleep, energy, recovery, nutrition, activity, wellbeing, lifestyle or other sensitive aspects.
We use such data only for Nexora-related purposes: personalising routes, recommendations, protocols, state analytics, user support and service improvement. We do not sell health/lifestyle data and do not share it with employers, insurers or advertisers for their own independent use without a separate lawful basis.
Users may withdraw consent to health/lifestyle data processing. Withdrawal does not affect processing carried out before withdrawal, but it may limit the availability of personalised Nexora features.
7. AI personalisation and automated processing
Nexora may use algorithms, AI models and segmentation rules to analyse data entered by the user, calculate state indices, and select routes, protocols, materials, prompts and recommendations.
AI-personalised results are informational and educational. They are not a medical diagnosis, treatment prescription, substitute for a physician, clinical decision or emergency medical service. Nexora does not provide emergency, diagnostic, therapeutic or clinical decision-making services and does not make clinical decisions for the user or a doctor.
Nexora does not use automated processing to make decisions that, by themselves, produce legal or similarly significant effects for the user, unless this is specifically disclosed and permitted by applicable law.
If the user believes a personalised recommendation is incorrect, the user should stop applying it and contact a qualified professional or Nexora support. In case of acute symptoms, deterioration or health risk, the user should seek medical help immediately.
8. Cookies, analytics and similar technologies
We may use cookies, pixels, SDKs, local storage and similar technologies for website operation, security, preference storage, analytics, product improvement and marketing.
Strictly necessary cookies: required for website operation, authentication, security and saved preferences.
Analytics cookies: help us understand how users use the website and which functions should be improved.
Marketing cookies: may be used to measure advertising performance and show relevant messages where the user has consented and where consent is required.
Users can manage cookies through the consent banner, website settings or browser settings. Disabling some cookies may affect certain features. Non-essential cookies should be placed only after user consent where required by applicable law.
9. Who we may share data with
We may share data only to the extent necessary for the purposes described in this Policy:
hosting, cloud infrastructure, database, analytics, email, CRM, payment, support, video conferencing, security and product management providers;
experts, consultants, contractors and moderators who help provide the service and are bound by confidentiality obligations;
payment providers and banks for payment, invoice and refund processing;
public authorities, courts, regulators or other persons where required by law or necessary to protect rights, safety and legitimate interests;
in connection with business reorganisation, sale of assets, investment or transfer of the project, subject to reasonable data protection measures.
We do not sell personal data. If Nexora uses external AI, analytics or cloud services, we aim to apply contractual, technical and organisational safeguards to protect personal data and limit the provider’s use of it.
10. International data transfers
Nexora may use providers and infrastructure in different countries. If data is transferred outside the user’s country or outside a jurisdiction with specific personal data protection rules, we apply reasonable legal and technical safeguards, including contractual commitments, standard contractual clauses or other mechanisms where required by applicable law.
11. Retention
We keep personal data only for as long as necessary for processing purposes, service provision, contract performance, legal compliance, dispute resolution, rights protection and security.
account data — while the account is active and for a reasonable period after closure where retention is needed for records, security or rights protection;
test, progress and health/lifestyle data — while the user uses personalised features, until account deletion, consent withdrawal or expiry of a reasonable retention period, unless otherwise required by law;
payment, accounting and tax data — for the periods required by applicable law;
technical logs and security data — for a reasonable period needed for security, diagnostics and abuse prevention;
marketing data — until unsubscribe, consent withdrawal or termination of the relevant campaign.
12. Security
We apply reasonable technical and organisational measures to protect data against unauthorised access, loss, alteration, disclosure or destruction. Measures may include access controls, permission management, encryption, backups, logging, security monitoring and contractor confidentiality.
No method of transmission or storage is absolutely secure. Users are responsible for protecting their account credentials and should notify Nexora of any suspected unauthorised access.
13. User rights
Depending on applicable law, users may have the right to:
access their personal data;
correct inaccurate or incomplete data;
delete data or the account;
restrict processing;
object to certain processing;
receive data in a structured format;
withdraw consent;
unsubscribe from marketing communications;
lodge a complaint with a competent data protection authority.
To exercise rights, users can contact us using the email address in the “Operator Details / Данные оператора” section. We may request additional information to verify identity and protect user data.
14. Children and minors
Nexora is not intended for children. Unless expressly stated otherwise, the service may be used by persons aged 18 or older. If a user is under 18, the user may use Nexora only with permission from a parent or legal guardian and only where permitted by applicable law.
15. Marketing communications
We may send news, materials, offers and Nexora-related messages where the user has consented or where permitted by law. Users may opt out through an unsubscribe link, account settings or support request. Service and transactional messages may continue where required for service operation, payment, security or legal notices.
16. Changes to this Policy
We may update this Policy. The updated version will be posted on the Nexora website with the effective date. If changes are material, we will try to notify users in a reasonable way, such as through the website, email or service interface.
17. Contact
For privacy, personal data, cookies or user rights requests, please contact us using the email address in the “Operator Details / Данные оператора” section.