Sub-Processor

In accordance with our Privacy Policy and our General Terms and Conditions, we employ subprocessors to provide our services. This page lists the primary subprocessors who potentially have access to our customers' personal data or operate systems where such data could be processed or stored in the course of service delivery. We select our subprocessors carefully and ensure they adhere to appropriate data protection and security standards.

As of: June 3, 2026

Google Cloud EMEA Limited (Google Cloud Platform)

Purpose: Hosting of our backend infrastructure and databases; AI-powered processing of medical content (documents, transcripts, clinical texts) via Google Vertex AI (Gemini and the Anthropic Claude models provided via Vertex; data remains within the Google environment); address geocoding via the Google Maps Platform (address auto-completion and conversion of entered addresses into structured address data/coordinates).

Data categories: Core application and patient data (hosting/Vertex AI); entered address data (Maps Platform).

Processing location: Hosting and Vertex AI in Germany (Frankfurt europe-west3, Berlin europe-west10).

Legal basis: DPA (Data Processing Agreement).

Vercel Inc.

Purpose: Hosting and delivery of the web frontend; delivery of static content via a global CDN; serverless functions.

Data categories: Technical connection data (IP addresses); user and backend requests (EU-only).

Processing location: Static content via global CDN; serverless functions exclusively in the Frankfurt region (fra1, EU).

Legal basis: EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Amazon Web Services EMEA SARL (Amazon Simple Email Service)

Purpose: Sending transactional and system-related emails (notifications, invoices, and status emails) as well as processing delivery, bounce, and complaint events.

Data categories: Email addresses, email content, delivery metadata.

Processing location: EU (Frankfurt region).

Legal basis: DPA (Data Processing Agreement).

ElevenLabs, Inc.

Purpose: Operation of the AI telephone and voice assistant (speech synthesis and conversational AI for inbound and outbound calls).

Data categories: Voice/audio data, call metadata, health data potentially contained within the conversation content.

Processing location: Contractually agreed EU region; provider based in the USA.

Legal basis: DPA; additionally EU-U.S. Data Privacy Framework / Standard Contractual Clauses.

Speechmatics Ltd.

Purpose: Conversion of speech to text (real-time and batch transcription of dictations and conversations).

Data categories: Voice/audio data and transcripts generated from them, health data where applicable.

Processing location: EU region; company headquarters in the United Kingdom.

Legal basis: DPA; data transfer based on the EU adequacy decision for the United Kingdom (no additional third-country basis required).

Tryvital, Inc. (Vital)

Purpose: Aggregation and synchronization of wearable/vital data from health and fitness devices.

Data categories: Health/vital data, device and account identifiers.

Processing location: Contractually agreed EU region; provider based in the USA.

Legal basis: DPA; additionally EU-U.S. Data Privacy Framework / Standard Contractual Clauses.

Intercom R&D Unlimited Company

Purpose: In-app support and customer communication (chat, help, and service messages).

Data categories: Contact and user data, communication content, IP address.

Processing location: EU region; Irish contracting entity.

Legal basis: DPA (processing within the EU).