Back to the home page

Security and privacy

Your clients' data, protected at every layer.

Clinical records are sensitive data. Nheva was built to comply with Brazil's LGPD and the Federal Council of Psychology's rules, with encryption, access control and an audit trail from the first line of code.

Multiple layers of protection

  1. 01

    Encryption in every field

    Client personal data, progress notes, documents, activities, answers, mood diary, scale results and WhatsApp contacts and messages are encrypted with AES-256-GCM before reaching the database, each value with its own key, bound to the practice and the field. Every connection uses HTTPS.

  2. 02

    Closed database

    No browser or app accesses the database directly: everything goes through Nheva's server, which checks the account, practice and permission on every request.

  3. 03

    Records only for the professional

    Each progress note is visible only to the responsible professional. Secretaries handle the schedule and charges without seeing records, and the Nheva team has no access to clinical records.

  4. 04

    Immutable records and access trail

    Signed notes and issued documents can't be changed, and every view, creation, signature and export of a record is logged.

  5. 05

    AI without identifiers

    Before any text goes to AI, the client's name, CPF, phone and e-mail are removed. AI prepares drafts that you review and sign, and Nheva doesn't use client data to train models.

  6. 06

    Protected payments

    Card details go straight to Stripe, which is PCI DSS certified, and never pass through Nheva. Payment links are digitally signed, and any change to payout details is announced to you.

The data is yours. Always.

Nheva doesn't sell data, doesn't use client data for advertising and doesn't use it to train AI models.

For client data, you are the controller and Nheva is the processor: we process the data only to provide the service, following your instructions and the Professional Agreement.

If you leave, clinical records remain kept for the period required by the Federal Council of Psychology and are delivered to you on request.

The LGPD in practice

Who is responsible for client data?

The professional (or practice) is the controller: they decide what to record and answer for the care. Nheva is the processor and processes the data only to provide the service, as set out in article 39 of the LGPD.

Does Nheva share data with third parties?

Only with the providers the service needs — sign-in, database, hosting, payments, e-mail, WhatsApp and, if you connect it, Google —, under contract and with security obligations. The full list is in the Privacy Policy.

Where is the data stored?

At Supabase (database) and Vercel (application), providers with SOC 2 certification. Some providers process data outside Brazil, with the safeguards provided for in the LGPD.

What happens to the data if I cancel?

You keep access until the end of the paid period. After that, clinical records are kept for the minimum period required by the Federal Council of Psychology and delivered to you on request; financial records, for the period required by tax law. Then they are deleted or anonymized.

How do clients exercise their rights?

Requests about care data are made to the professional, and Nheva helps them respond. Clients can also write to privacidade@nheva.com.br or request the deletion of their app account, as explained on the Account and Data Deletion page.

What if there is a security incident?

We investigate and contain the incident, notify the affected professionals and, when the law requires it, the ANPD and the data subjects.

Talk to us about security

Found a vulnerability? Write to seguranca@nheva.com.br with the details. We answer every good-faith report.

Privacy and data protection officer (DPO): privacidade@nheva.com.br.