Nemo Smile Generation

GDPR overview

Implementation is concrete and current. The privacy policy of the NemoSG microsite is built on the GDPR and names its legal bases per category of data subject: consent (art. 6.1.a), contract and pre-contractual measures (art. 6.1.b) and legitimate interest (art. 6.1.f). It lists the full set of rights, namely access, rectification, erasure, restriction, objection, portability and the right not to be subject to automated decision-making, exercisable by letter to the registered office or at pd@nemotec.com. The Spanish supervisory authority is named, the Agencia Española de Protección de Datos (www.aepd.es). Retention is described only as the minimum time necessary, with no figure. As the publisher is established in Spain, no Article 27 representative is required and none is appointed. One gap: the general conditions PDF still relies on the repealed LOPD 15/1999 and Royal Decree 1720/2007, both pre-GDPR.

Who owns the data?

The general conditions published by Nemotec are explicit: “the personal data of the patients will become part of a file owned by the Client, who is responsible for the file”. The practice, not the vendor, owns and controls the patient record. Nemotec may process that data only as a processor acting on the Client's behalf, and at the end of the contract the data is returned to the Client or destroyed, at the Client's choice, save for what must legally be kept. The software goes the other way: the EULA licenses it rather than selling it, and Nemotec and its licensors retain ownership. One caveat, neither contract ever names NemoSG, so this framework would apply to it by deduction.

Reuse rights

Because the practice owns the patient file, it uses that data freely within its own clinical activity; the published constraints run in the other direction and limit what the vendor may do. Under the general conditions, Nemotec must process data strictly in line with the Client's instructions and for no purpose other than performing the service, must not pass it to third parties beyond the employees, collaborators and subcontracted companies needed for that service, and must apply the high-level security measures required by the Spanish data protection implementing regulation. Data collected from website visitors falls under a separate set of purposes stated in the privacy policy: the commercial relationship, sending requested information, recruitment and browsing data. Software Nemotec states there that it will not disclose visitor data to any third party unless expressly informed, with communications to banks and public authorities reserved. One silence deserves to be named: neither the site nor the EULA nor the general conditions ever addresses whether patient data is used to train AI models, even though the product is sold as an AI.

Data retention & training

Hosting summary

Nemotec publishes nothing about where NemoSG data is hosted. No country, no region and no hosting provider appears on the product page, in the privacy policy or in the contractual documents. The NemoStudio ecosystem refers to a Cloud and to an online service called NemoBox without stating where either runs, and the login portal sits on a nemocloud-services.com subdomain, which says nothing about jurisdiction. The showcase website itself resolves to an IP address in Belgium operated by Combell, but that is the hosting of the website only and must not be read as the location of patient data. What can be stated with confidence is the legal frame rather than the geography: the publisher, Software Nemotec, is established in Spain, is therefore subject to the GDPR, and names the Agencia Española de Protección de Datos as its supervisory authority. The company also holds ISO/IEC 27001 certification in its 2013 and 2022 versions, issued through RINA and ACCREDIA, covering its information security management system. Any buyer with a data residency requirement will have to obtain the answer directly from Nemotec, because it is not documented publicly.