Subprocessors

Managed Postgres database, authentication and encrypted object storage for reports and avatars.

Location:

European Union

Safeguard:

Hosted in the EEA/UK

Health data:

Yes

Data processing agreement:

In place

Edge hosting of the application, TLS termination, CDN and DDoS protection.

Location:

Global edge network

Safeguard:

Standard Contractual Clauses

Health data:

No

Data processing agreement:

In place

Health payloads transit the edge in transit only; no health data is cached at the edge.

Routes report-extraction and narrative-generation prompts to the underlying model providers.

Location:

European Union / United States

Safeguard:

Standard Contractual Clauses

Health data:

Yes

Data processing agreement:

In place

Prompts contain pseudonymised clinical values. No training on customer data.

Durable background job orchestration for report and plan generation.

Location:

United States

Safeguard:

Standard Contractual Clauses

Health data:

No

Data processing agreement:

In place

Event payloads carry record identifiers only, never clinical values.

Optional wearable integration: sleep, readiness and activity metrics imported at the user's request.

Location:

European Union

Safeguard:

Hosted in the EEA/UK

Health data:

Yes

Data processing agreement:

In place

Source controller for the data; user connects and disconnects at will.

Optional wearable integration (beta): recovery, sleep, strain and workout metrics.

Location:

United States

Safeguard:

Standard Contractual Clauses

Health data:

Yes

Data processing agreement:

Not yet signed

Beta flag only. Must not be enabled for production users until the DPA and UK IDTA addendum are signed.

Future import of genetic results at the user's request.

Location:

To be determined per provider

Safeguard:

Standard Contractual Clauses

Health data:

Yes

Data processing agreement:

Not yet signed

Genetic data is Art. 9 data with family-wide impact: requires a DPIA before any integration ships.

Future direct import of blood panel results from partner laboratories.

Location:

To be determined per laboratory

Safeguard:

Standard Contractual Clauses

Health data:

Yes

Data processing agreement:

Not yet signed

Laboratories are typically independent controllers; a controller-to-controller agreement is required.

Future image-based skin assessment.

Location:

To be determined per provider

Safeguard:

Standard Contractual Clauses

Health data:

Yes

Data processing agreement:

Not yet signed

Facial or skin imagery may constitute biometric data: DPIA and separate explicit consent required.