NexaCore Ltd.
Privacy policy
Last updated: 20 October 2026
In line with the principles of lawfulness, fairness and transparency of Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Cap. 586 of the Laws of Malta), this policy explains how we process your personal data.
1. Who is the data controller?
| Owner | NexaCore Ltd. |
| Company registration (Malta) | C112713 |
| VAT number | MT32113512 |
| Registered office | Northlink Business Centre, Level 2, Triq Burmarrad, Naxxar NXR 6345, Malta |
| info@getnexacore.com | |
| Phone / WhatsApp | +356 7760 5042 |
| Website | www.getnexacore.com |
2. Why do we process your data?
| Data subjects | Purposes |
|---|---|
| Patients (online consultancy) | Managing the booking and payment; reviewing the clinical records you provide (X-rays, CBCT, reports); holding the video consultation; preparing and sending your report; invoicing. |
| Professionals (mentoring) | Managing the booking and payment; holding the mentoring session; invoicing. |
| Clients and prospective clients of Nexacore Studio and The Enamel Strategy | Handling your request and the discovery call; preparing proposals; performing the contract (website design and development, producing and publishing content on the client's behalf); invoicing; information about similar services to existing clients. |
| People who contact us by email or WhatsApp | Answering your enquiry. |
| Suppliers and partners | Managing the business or professional relationship. |
3. What is the legal basis?
| Data subjects | Legal basis |
|---|---|
| Patients | Art. 6(1)(b) GDPR (performance of the requested service) and Art. 9(2)(h) GDPR (healthcare provided by a professional bound by professional secrecy) for health data; Art. 9(2)(a) GDPR (explicit consent) when you send us clinical records; Art. 6(1)(c) GDPR (legal and tax obligations). |
| Professionals and clients | Art. 6(1)(b) GDPR (contract or pre-contractual steps at your request); Art. 6(1)(c) GDPR (tax obligations); Art. 6(1)(f) GDPR (legitimate interest in informing clients about similar services, which you can object to at any time). |
| Email or WhatsApp contacts | Art. 6(1)(a) GDPR (your consent when you write to us) and, where applicable, Art. 6(1)(b) GDPR. |
| Suppliers | Art. 6(1)(b) GDPR (performance of the contract). |
We only ask for the data needed to provide the service. You are not obliged to provide it, but without it we may not be able to help you.
4. How long do we keep your data?
For the duration of the relationship and afterwards for the periods required by applicable law (healthcare, commercial and tax) and for as long as needed to handle possible claims. Enquiries that do not lead to a relationship are deleted when no longer needed.
5. Who do we share your data with?
We do not sell or rent your data. It is only disclosed to public authorities where required by law and to banks or payment providers to collect payments. We also use service providers acting as processors under contract and with appropriate safeguards:
- Vercel Inc. – hosting of this website.
- Google (Google Workspace) – email, document storage and video calls.
- Calendly LLC – appointment booking and related payments (through its payment providers).
- WhatsApp (Meta) – messaging, when you choose to contact us that way.
- Zoom – webinars, when you register for one.
- For The Enamel Strategy clients: content production and publishing tools (e.g. Make, Cloudinary, Canva, CapCut) and artificial intelligence tools for writing and editing. The avatar platform (HeyGen) is contracted in the client's own name.
Artificial intelligence tools are only used with the content the client gives us for publication. We never enter patients' health data into them.
6. International transfers
Some providers (e.g. Vercel, Google, Calendly, Meta or Zoom) may process data outside the European Economic Area, in particular in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified or, otherwise, on the standard contractual clauses approved by the European Commission.
7. What are your rights?
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to info@getnexacore.com. If you believe your data has not been handled properly, you may lodge a complaint with the Information and Data Protection Commissioner of Malta (idpc.org.mt) or with the supervisory authority of your country of residence.
8. Security
We apply appropriate technical and organisational measures to protect your data, especially clinical records, which we only receive through secure channels and which only the professional conducting the consultation can access.
9. Minors
Our services are not aimed at people under 18. If a consultation concerns a minor, it must be requested by their legal representative.
10. Changes to this policy
We may update this policy to reflect legal changes or changes to our services. The date of the latest update is shown at the top.