1. Who we are

Nerium Intelligence Limited

Company Registration Office (Ireland) Number: 799094

Registered Address: County Roscommon, Ireland

Email (data protection queries): privacy@nerium.ie

Email (operational): info@nerium.ie

Phone: +353 (83) 066-8358

We are the data controller for personal data collected through nerium.ie and our commercial relationship with prospective + existing business clients.

For personal data of our clients' end-customers (e.g. patients of a clinic using NeriumCore), we act as data processor on behalf of each client, governed by our Master Services Agreement and Data Processing Agreement (including the Compliance Addendum 2026-05 incorporating Standard Contractual Clauses Module 2 where applicable).

2. What personal data we collect

2.1 Via nerium.ie and related websites

• Contact form / newsletter signup: name, email, business name, phone (optional)
• Cookies and analytics: technical identifiers, IP address, browser metadata, page interactions (see Cookie Policy)
• Cloudflare Access authenticated portals (admin.nerium.ie, sales.nerium.ie, support.nerium.ie): Google Workspace identity, IP address, device fingerprint, session metadata

2.2 In the course of delivering services

• Business contact information for client representatives (Piotr, Gabriel, and your authorised team)
• Correspondence (email, voice call recordings, meeting notes)
• Billing information (via Stripe)
• Electronic signatures (via PandaDoc)
• Engagement metrics (hours logged, tickets raised)

2.3 What we do NOT collect

• Clinical records, medical diagnoses, treatment plans, or prescription data of your customers (this is explicitly excluded from our Platform per MSA clause 5.3)
• Special category health data about you personally unless you voluntarily provide it
• Cross-site tracking identifiers for advertising profiles

3. Lawful bases for processing

4. How we use artificial intelligence (AI Act Article 50)

We use AI systems internally (JARVIS — our AI execution engine) and in client services. When you interact with any AI system we operate:

• AI voice reception (Retell AI): you will be told at the start of every call that you are speaking with an AI assistant and you can request a human at any time.
• AI-composed messaging (WhatsApp via Kapso): automated messages are labelled and include an opt-out to a human.
• AI-assisted bookings (Cal.com): confirmation emails for AI-assisted bookings include a clear notice.

These measures implement our obligations under Article 50 of Regulation (EU) 2024/1689 (the EU AI Act), effective 2 August 2026. We deploy them from 1 May 2026.

5. Who we share personal data with

We use carefully selected sub-processors to deliver services. A current list is maintained in our Sub-processor Register (07_GOVERNANCE/legal/SUB_PROCESSOR_REGISTER.md) and is available on request. Categories include:

• Cloud hosting (Vercel, Cloudflare, European VPS providers)
• Productivity + analytics (Google Ireland — Workspace, GA4, GSC)
• Payment processing (Stripe Ireland)
• Voice reception (Retell AI — United States — governed by Standard Contractual Clauses Module 2)
• Messaging (Kapso + Meta Ireland)
• AI model routing (OpenRouter, Anthropic, Google Vertex AI)
• E-signature (PandaDoc)
• Database (Supabase — Frankfurt region)

Where a sub-processor is based outside the EU/EEA without an adequacy decision, we rely on Standard Contractual Clauses Module 2 (Commission Implementing Decision (EU) 2021/914).

We do not sell personal data. We do not share personal data with third parties for advertising purposes.

6. International transfers

Where we transfer personal data outside the European Economic Area, we apply one of:

• an adequacy decision of the European Commission;
• Standard Contractual Clauses Module 2 (controller-to-processor);
• binding corporate rules of the recipient (e.g. Google);
• your explicit consent for specific transfers.

Our primary data residency is within the EU (Supabase Frankfurt, Vercel Frankfurt, Cloudflare EU POPs, European VPS). Voice AI processing by Retell AI is currently US-based with Module 2 safeguards; a GDPR-residency migration path (Telnyx Paris) is in progress.

7. How long we retain personal data

After the retention period, data is securely deleted or anonymised.

8. Your rights

Under the GDPR you have the right to:

• Access your personal data (Art 15) — provided within 30 days at no charge
• Rectify incorrect data (Art 16)
• Erasure (Art 17) — subject to legal retention requirements
• Restrict processing (Art 18)
• Data portability (Art 20)
• Object to processing based on legitimate interests (Art 21)
• Withdraw consent at any time (Art 7) — opt-out link in every marketing email
• Not be subject to automated decision-making with legal or similarly significant effects (Art 22). We do not use such decision-making on you personally.

To exercise any right, email privacy@nerium.ie. We respond within 30 calendar days (or 90 for complex requests, with notification).

9. How to complain

If you believe we have not handled your data properly, you may complain to the Data Protection Commission (Ireland):

Data Protection Commission

21 Fitzwilliam Square South, Dublin 2, D02 RD28

+353 (0)761 104 800 · info@dataprotection.ie · www.dataprotection.ie

10. Security

We maintain:

• TLS 1.3 encryption in transit
• Encryption at rest for all databases
• Multi-factor authentication + hardware security keys for operator accounts (YubiKey programme in rollout)
• Role-based access control
• 24-hour + 72-hour breach notification per Art 33/34 GDPR
• Annual security audit (NIS2 readiness)
• Supabase row-level security with per-client schema isolation

11. Changes to this policy

We review this policy at least annually. Material changes are communicated via email (for existing clients) and on the privacy page with a new effective date. Continued use after a published change constitutes acceptance.

12. Contact

Data Protection Officer / Privacy Contact:

privacy@nerium.ie

General:

info@nerium.ie

Post:

Nerium Intelligence Limited

[REGISTERED ADDRESS — POPULATE FROM CRO]

County Roscommon, Ireland

Effective 1 May 2026. Nerium Intelligence Limited (CRO 799094). © 2026 Nerium Intelligence Limited.