Data Processing Agreement

Last updated: 7 September 2026

This agreement describes how NexMind AI (Variable Solutions) processes personal data on behalf of its users and business customers, including clinics and pharmacies using the WhatsApp agent.

1. Roles

NexMind AI acts as a processor for data submitted by users and business customers (the controllers), and as a controller for account data needed to operate the service.

2. What we process

3. Sub-processors

Each sub-processor is bound by its own terms and applicable law. We will notify you of material changes to sub-processors.

4. How long we keep data

Prompts and responses are retained for billing and abuse-prevention purposes and deleted when no longer needed. Conversation and booking records are kept while the business relationship is active. You may request deletion at any time.

5. Security

We apply appropriate technical and organisational measures: encrypted transport (HTTPS), bcrypt password hashing, signed session tokens, HMAC-signed service-to-service API auth, and least-privilege access to production data.

6. Your obligations

As a controller, you must ensure you have a lawful basis to share data with us (e.g. patient consent for the WhatsApp agent) and that your data collection complies with applicable law.

7. Data subject rights

We will assist you, within a reasonable time, with requests from data subjects to access, correct, export or delete their personal data. Contact hello@variablesolutions.co.zw.

8. Breach notification

We will notify you without undue delay if we become aware of a personal-data breach affecting data you control, and will provide reasonable assistance with any required notifications.

← Back to NexMind AI