Legal · Sub-processors
Sub-processors
Last updated: 2026-07-22
This list is maintained per GDPR Article 28. Clinics are notified of additions at least 30 days before they take effect. The controller-processor agreement governing this list is Replyion's standard Data Processing Addendum (DPA). International transfers, where applicable, rely on EU Standard Contractual Clauses. Vendors marked "Planned" are not active and process no data until activated and notified.
| Sub-processor | Purpose | Patient data | Data location | Status |
|---|---|---|---|---|
| Supabase Inc | Database and storage (conversations, patient records; phone numbers pseudonymised) | Yes | EU · Frankfurt | Active · DPA in place |
| Anthropic PBC | LLM inference (Claude); message content only, phone numbers minimised out | Yes | USA | Active · DPA in place · SCCs in signature |
| Vercel Inc | Hosting and edge network (requests transit; no patient data stored) | Transit only | EU regions preferred | Active · DPA in place |
| 360dialog GmbH | WhatsApp Business API (BSP) — message transport | Yes | Germany | Active · DPA in place |
| Meta Platforms (WhatsApp) | Messaging platform operated under the clinic's own WhatsApp Business Account | Yes (transport) | Clinic-owned WABA | Active · Meta WhatsApp Business terms; the clinic owns the WABA |
| Upstash Inc | Redis (rate limiting and de-duplication) — operational metadata only, no message bodies | No | EU region | Active · DPA confirmation in progress |
| Telegram FZ-LLC | Operator alerts only — alert text never contains patient identity or message content | No | UAE | Active · no patient data routed |
| Resend Inc | Transactional email (reports, fallback alerts) — no patient content | No | EU region | Planned · not yet active |
| Twilio Inc | SMS staff paging (third-channel escalation) — no patient content | No | EU numbers planned | Planned · not yet active |
| OpenAI LLC (Whisper) | Voice-note transcription — only if voice processing is enabled | Only if enabled | USA | Not enabled in v1 · pending counsel review |
To subscribe to sub-processor change notifications, email hello@replyion.com.