1. What this notice covers
This notice explains how personal data is handled when you visit nelira.care and when you submit a request for access to the Nelira private beta.
It does not cover the Nelira product itself. No session recordings, transcripts or client information are processed at this stage. Before any participant runs a session in Nelira, a separate set of documents will be provided, including a product privacy notice, a data processing agreement, and a client consent template.
2. Who is responsible for your data
Nikita Lantel, an individual operating this project under the name “Nelira” (referred to below as “Nelira”, “we” or “us”), is the controller of the personal data described in this notice.
Contact for any privacy matter, including requests to exercise your rights: [email protected]
3. What we collect
| Data | Required? | Where it comes from |
|---|---|---|
| Email address | Required | You, via the beta request form |
| Your answer to “Which best describes you?” | Required | You, via the form |
| Your answer to “How many client sessions do you run per week?” | Required | You, via the form |
| Record of your marketing consent (date, time, and the wording you agreed to) | Only if you opt in | Generated when you tick the box |
| Correspondence you send us, and our replies | — | You |
| Technical request data used to keep the site available and block automated abuse (including IP address and browser metadata) | Automatic | Processed by our infrastructure provider; not retained by us in our own records |
The two questions help us understand the shape of the group we are onboarding.
What we do not collect
We do not ask for, and do not want, any information about your clients or patients. Please do not include client details, case descriptions or clinical material in the form or in emails to us. If we receive such information, we will delete it.
4. Why we process it, and on what legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Reviewing your request and contacting you about a beta invitation | Email, optional answers, correspondence | Legitimate interests, Art. 6(1)(f) — responding to a request you sent us on your own initiative |
| Understanding, in aggregate, the professional profile and workload of applicants, in order to plan the beta | Optional answers, aggregated | Legitimate interests, Art. 6(1)(f) — product planning; the data is aggregated and the underlying answers are voluntary |
| Sending you occasional project updates, if you asked for them | Email, consent record | Consent, Art. 6(1)(a) |
| Keeping the site available and protecting it from automated abuse | Technical request data | Legitimate interests, Art. 6(1)(f) — security |
You can object to any processing based on legitimate interests at any time (see section 9).
If you consented to updates, you can withdraw that consent at any time, by using the unsubscribe link in any message or by emailing us. Withdrawing consent does not affect messages already sent, and does not withdraw your beta application.
5. Who else has access
We use the following service providers, which process data on our behalf under written data processing terms:
- Cloudflare, Inc. (United States) — website hosting and delivery, storage of form submissions in Cloudflare Workers KV, bot protection, and privacy-preserving site analytics.
We do not sell personal data. We do not share it with advertisers, data brokers or social networks, and the site carries no advertising or third-party tracking pixels.
We may disclose data where we are legally required to do so.
6. Where your data is stored, and international transfers
Form submissions are stored in Cloudflare Workers KV, a globally distributed storage service. This means your data may be stored and replicated in Cloudflare data centres in a number of countries, including countries outside the European Economic Area and the United Kingdom.
Where data is transferred outside the EEA or the UK, the transfer is made under the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), as incorporated into our agreement with Cloudflare, together with the technical measures described in section 11.
You can request further information about the transfer mechanism by emailing us at the address in section 2.
7. How long we keep it
| Data | Retention |
|---|---|
| Your submission, if you are not invited to the beta | Deleted within 6 months of the decision |
| Your submission, if you are invited | Kept for the duration of the private beta, then deleted or migrated into your participant account, and in any case no longer than 24 months from submission |
| Aggregated statistics derived from the optional questions | Retained indefinitely in aggregated form, from which individuals cannot be identified. This is no longer personal data |
| Record of marketing consent | Kept while you are subscribed and for 3 years after you unsubscribe, as evidence that consent was given |
| Correspondence | 24 months from the last message |
Expiry is applied automatically at the storage level wherever possible, so that records are removed without requiring manual action.
You can ask us to delete your data earlier at any time (see section 9).
8. Cookies and analytics
We use only what is necessary to run the site securely:
- A bot management cookie set by Cloudflare (
__cf_bm), which expires after approximately 30 minutes and is used to distinguish human visitors from automated traffic. - Cloudflare Turnstile, to protect the form from automated submissions.
- Cloudflare Web Analytics, which measures aggregate page views without cookies, without fingerprinting and without tracking visitors across sites.
We do not use Google Analytics, advertising or conversion pixels, session recording, heat mapping, or embedded social media widgets. Because none of the above is used for advertising, profiling or cross-site tracking, no consent banner is presented.
9. Your rights
Regardless of where you are located, we apply the following rights to every applicant:
- Access — obtain a copy of the data we hold about you
- Rectification — have inaccurate data corrected
- Erasure — have your data deleted
- Restriction — have processing limited while a matter is resolved
- Objection — object to processing based on legitimate interests
- Portability — receive your data in a machine-readable format
- Withdrawal of consent — for project updates, at any time
To exercise any of these, email the address in section 2. We will respond within one month. We may ask you to confirm the email address the request relates to, so that we do not disclose data to the wrong person.
If you are in the EEA, the UK or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work.
10. Automated decision-making
We do not use automated decision-making or profiling. Beta invitations are decided by a person.
11. Security
Traffic to the site is encrypted in transit using TLS. Stored submissions are held in Cloudflare Workers KV, encrypted at rest by the provider. Access is limited to the controller named in section 2, through an account protected by multi-factor authentication. Data collection is deliberately kept to the minimum needed to run the waitlist.
No system is completely secure. If a breach affects your data and is likely to present a risk to you, we will notify you and the relevant authority as required by law.
12. Age
Nelira is intended for practising clinicians. The site and the beta are not directed at anyone under 18, and we do not knowingly collect data from minors.
13. Changes to this notice
If we change how we handle data, we will publish an updated version here with a new version number and effective date. If a change materially affects you and we hold your email address, we will tell you directly.
Version history
v1.0 — 26.07.2026 — first published