A subprocessor is a third-party company that processes data on our behalf so we can provide Asternoos. This is the complete list. We keep it current and publish changes here before they take effect.
Clinical platform (app.asternoos.com)
These providers may process patient data.
| Provider | Purpose | Data received | Processing location | Trains on your data? |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, audio file storage, backups | All platform data: account, audio, transcripts, notes, patient records | European Union (Frankfurt) | No |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | Speech-to-text (including live realtime from the browser) and clinical note generation | Consultation audio; transcript text; limited patient-chart fields used in the note prompt (e.g. name, bed, chart notes) | United States / European Union | No — excluded under API terms |
| Google Ireland Ltd (Gemini API) | Extracting structured fields from uploaded lab reports/images and from consultation text in extract flows | Uploaded image bytes (not retained by Asternoos after processing); consultation transcripts used in extract/parse flows; extracted text fields | United States / European Union | No — excluded under paid API terms |
| Plus Five Five, Inc. (Resend) | Transactional email: login/signup verification codes and service notices | Email address and the content of the message we send you | United States / European Union | No |
| Paddle.com Market Ltd | Payments, subscription billing, tax, invoicing, merchant of record | Name, email, country, tax status, payment details, subscription state. No clinical data. | United Kingdom / European Union | No |
| Langfuse GmbH (a ClickHouse company) | AI observability: monitoring AI service performance, latency, token usage and operational cost | Operational telemetry only: model name, token counts, cost, latency, error status, and pseudonymised account and patient reference codes. No transcripts, notes, patient names, diagnoses, MRNs, audio or images. | European Union (Ireland) | No |
Public website (asternoos.com)
These run on our marketing site only, load only after you accept cookies, and never receive clinical data.
| Provider | Purpose | Data received | Processing location |
|---|---|---|---|
| Google Ireland Ltd (Google Analytics 4) | Website traffic analytics | Pseudonymous usage events, page address, referrer, truncated IP, device type | European Union / United States |
| Meta Platforms Ireland Ltd (Meta Pixel) | Advertising measurement and conversion attribution | Pseudonymous usage events, page address, IP, device type | European Union / United States |
How we manage subprocessors
- Every subprocessor is bound by a data processing agreement with confidentiality, security, and deletion obligations.
- We select providers that offer EU data residency, business API terms excluding model training, minimal retention, and subprocessor transparency wherever available.
- Providers receive only the data needed for their specific function.
- Before adding or replacing a subprocessor that handles patient data, we update this page and give existing customers at least 30 days' notice by email. If you object on reasonable data protection grounds, contact us and we will work with you or you may cancel without penalty.
Requesting notifications
To be emailed whenever this list changes, write to privacy@asternoos.com with the subject "Subprocessor updates".
Related: Privacy Policy · Security & Compliance.