Who we are
NextHealth Technologies LLC ("NextHealth", "we", "us") is a healthcare software company licensed in Abu Dhabi, United Arab Emirates, under commercial licence CN-4659514, and part of Alpha Health Group. We run this website, nxhone.com, and build the NextHealth software: NextHealth Care, NextHealth Engage, NextHealth Flow and NextHealth One.
For anything in this policy, write to in@nxhone.com. Our office is on Othman Bin Affan Street, Central District, Al Ain, Abu Dhabi, United Arab Emirates.
What this policy covers
We handle personal information in two different roles, and this policy says which one applies where.
- Controller: our website visitors and our customers. When you browse nxhone.com or send us an enquiry, and when we deal with the people at our customers who buy, administer and pay for NextHealth (their names, work contact details, user accounts and billing records), we decide how that information is used. We are the controller.
- Processor: our customers' patients. When a hospital, clinic or other healthcare provider ("customer") uses NextHealth, it decides what information goes in and why, including patient records and the WhatsApp messages it exchanges with patients. The customer is the controller, and we process that information only on its instructions, as its processor, under our data processing agreement with it.
If you are a patient, your healthcare provider is responsible for your records and is the first place to go with a question about them. We help them answer you.
Information we collect on this website
What you give us
Our enquiry forms (book a demo, request a trial and contact us) ask for your name and email address, and may ask for your phone number, organisation, job title, country, type of facility, the product and modules you are interested in, a preferred demo date and a message. We record that you agreed to be contacted, and when. We use only what you choose to give us, and we ask you not to include patient or other health information in a message.
What we record automatically
- How you reached the form. The campaign tags in the link you followed, the website that referred you and the last page you read here. This stays in your browsing session and is saved only if you send a form.
- A coded form of your IP address. We do not store your IP address with your enquiry. We store a one way code made from it with a secret key, which lets us recognise repeated automated submissions. This is still personal information, and we treat it as such.
- Server logs. Like any website, our web server records each request, including the IP address, the page, the time and the browser. We use these logs only to keep the site running and secure.
We do not use analytics, advertising or social media tracking on this website, and we do not build profiles of visitors.
How we use it and why we are allowed to
| What we do | Legal ground |
|---|---|
| Answer your enquiry, arrange the demo or trial you asked for, and follow up on it | Steps you asked for before a possible contract, and your consent to be contacted |
| Record the enquiry in our customer relationship system so the right person follows it up | Our legitimate interest in answering enquiries properly |
| Protect the website and our forms from spam, abuse and attack | Our legitimate interest in keeping the website safe and working |
| Set up and run a subscription, manage customer user accounts, give support and send invoices | The contract with your organisation, and our legitimate interest in managing it |
| Keep records the law requires, and deal with legal claims | Legal obligation, and our legitimate interest in defending claims |
We do not send you marketing you did not ask for, and an enquiry is not consent to a newsletter. We make no decisions about you by automated means alone. You do not have to give us any information, but we cannot answer an enquiry without a way to reach you.
Cookies
This website stores two cookies, both needed for it to work, so they do not need your consent:
- a session cookie, which keeps your visit together while you move between pages, and ends shortly after your last page;
- XSRF-TOKEN, which proves a form was sent from this website and not from a site pretending to be it.
Where a page shows Trustpilot reviews, the review widget is loaded from Trustpilot and may set its own cookies under Trustpilot's privacy policy. Before we add any cookie that is not strictly necessary, we will update this policy and ask for your consent where the law requires it.
Information inside NextHealth software
Customers use NextHealth Care, Engage and Flow to hold patient records, appointments, billing, staff records, quality and incident records, and messages with patients. That information belongs to the customer. We use it only to provide, secure and support the software for that customer, as our agreement with them sets out. We do not sell it, use it for advertising, combine it across customers, or use it to train artificial intelligence models.
Our support staff reach a customer's data only when the customer asks for help or when it is needed to keep the service secure and working, and every access is recorded.
WhatsApp messaging through NextHealth Engage
A healthcare provider using NextHealth Engage can connect its own WhatsApp Business account, through the WhatsApp Business Platform provided by Meta, to message its patients and enquirers from Engage. When it does:
What we receive
- the provider's WhatsApp Business account and phone number identifiers, its message templates, and the access token Meta issues for the connection;
- for each person who messages the provider, or whom the provider messages: their WhatsApp phone number and profile name, the content of messages and any files sent, and the time and delivery status of each message (sent, delivered, read or failed);
- whether the person has agreed to receive messages from the provider, and any request to stop.
How it is used
Only to send and receive that provider's messages, show the conversation to its authorised staff in Engage, link it to the right patient or enquiry record when the provider chooses to, and keep the service secure. We act on the provider's instructions as its processor. We do not use WhatsApp data for advertising, sell it, share it with other customers, use it to contact anyone for our own purposes, or use it to train artificial intelligence models. We use Meta platform data in line with Meta's Platform Terms and the WhatsApp Business policies.
Your choices
The provider is responsible for getting your agreement before it sends you messages. You can stop them at any time by replying STOP, by blocking the business in WhatsApp, or by telling the provider. Messages pass through Meta's systems, which handle them under the WhatsApp privacy policy and Meta's terms for businesses.
How long it is kept
WhatsApp messages are kept in Engage for as long as the provider keeps them in its records, under the rules for medical and patient records that apply to it. When a provider disconnects its WhatsApp account, we delete the access token and stop receiving its messages straight away. When its subscription ends, we delete its WhatsApp data within 90 days, unless the provider or the law requires us to keep it longer.
Who we share information with
We share personal information only where we need to, and only with:
- Microsoft Azure, which hosts this website, our customer relationship system and our software, as our processor;
- Resend, which delivers the email alert that tells our team about a new enquiry, as our processor;
- Meta, for WhatsApp messages a customer sends or receives through Engage, as described above;
- Trustpilot, only where a page shows its review widget;
- our professional advisers, and regulators, courts or authorities where the law requires it;
- a buyer or successor, under the same protections, if all or part of our business is ever sold or reorganised.
Our customer relationship system is our own software, run by us. Every processor works under a written agreement that limits it to our instructions and requires it to keep the information secure. We never sell or rent personal information.
Where information is kept
This website and our customer relationship system are hosted on Microsoft Azure in the United Arab Emirates. Health information of UAE healthcare providers is stored and processed in the United Arab Emirates, as UAE Federal Law No. 2 of 2019 on the use of information and communications technology in health fields requires. Customers outside the UAE are hosted in the region agreed with them.
A few services reach outside the UAE: Resend delivers our enquiry alerts from the United States, and Meta processes WhatsApp messages on its own infrastructure. Where personal information leaves the UAE or the European Economic Area, we rely on the safeguards the law recognises, such as the European Commission's standard contractual clauses in our providers' data processing terms, and we send only what the service needs.
How long we keep it
- Website enquiries, including suspected spam: 12 months after we were last in touch about them, then deleted automatically.
- An enquiry that becomes a customer relationship: for as long as that relationship lasts, and then for as long as the law requires us to keep business records.
- Server and security logs: up to 14 days, unless we need them longer to investigate a specific security incident.
- Information inside our software, including WhatsApp messages: as the customer decides and our agreement with them sets out, and deleted after the subscription ends as described above.
Security and the standards we work to
We design how we protect information against the frameworks our customers are measured by:
- ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard of the Department of Health, Abu Dhabi;
- the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and Federal Law No. 2 of 2019 on health data;
- the EU and UK General Data Protection Regulation (GDPR), where it applies;
- HIPAA-aligned safeguards for customers that require them.
In practice that means: access by role, limited to what each person needs; two-factor sign-in; an audit trail of who viewed and changed a record; encryption in transit (TLS) and on stored disks; health data kept in the region its law requires; staff bound by confidentiality; and a plan for responding to security incidents. A customer remains responsible for its own obligations under these frameworks, and our controls and records support it in meeting them.
If a personal data breach affects you, we will tell you and the relevant authority where the law requires, without undue delay. If it affects a customer's data, we tell the customer without undue delay, so it can meet its own duties, including those under ADHICS and to the Department of Health.
Your rights
Depending on the law that applies to you, including the UAE Personal Data Protection Law and the GDPR, you can ask us to:
- tell you whether we hold information about you, and give you a copy;
- correct information that is wrong or incomplete;
- delete it;
- restrict how we use it, or object to our using it on the ground of legitimate interest;
- give it to you, or to someone else, in a common machine readable format;
- stop using it where we rely on your consent. Withdrawing consent does not affect what we did before.
Email in@nxhone.com. We may ask you to confirm your identity before acting, we do not charge for a reasonable request, and we answer within one month, or tell you within that month if we need longer. Where the information is held for a healthcare provider, including WhatsApp messages and patient records, we pass your request to that provider and help it answer you.
You can also complain to a data protection authority: in the UAE, the UAE Data Office; for health information in Abu Dhabi, the Department of Health; in the European Union, the authority where you live or work; in the United Kingdom, the Information Commissioner's Office. We would like the chance to put things right first.
How to delete your data
To have your personal information deleted:
- Email in@nxhone.com with the subject "Delete my data".
- Tell us the email address or WhatsApp phone number you used, and, if it was a WhatsApp conversation, the name of the healthcare provider you messaged.
- We confirm we received your request within 3 working days, and may ask you to confirm the address or number is yours.
- We delete what we hold as controller within 30 days and confirm when it is done. For information we hold for a healthcare provider, such as WhatsApp messages, we pass the request to that provider the same week and delete it on its instruction. A provider may have to keep part of a medical record by law, and will tell you if so.
You can also stop WhatsApp messages from a provider at once by replying STOP or blocking the business in WhatsApp, and you can remove a business's access to your chats in WhatsApp's own settings.
Children
This website is for healthcare organisations and the people who work in them. It is not meant for anyone under 18, and we do not knowingly collect information from children through it. Information about children held inside our software belongs to the healthcare provider and is protected like every other patient record.
Changes to this policy
When we change this policy, we update the date at the top of the page. If a change materially affects how we use information we already hold, we will tell the people affected before it takes effect.
Contact us
NextHealth Technologies LLC, commercial licence CN-4659514, Othman Bin Affan Street, Central District, Al Ain, Abu Dhabi, United Arab Emirates. Email in@nxhone.com.
NXH Flow