This is a technical-operational template. It requires legal review and customisation before use in any contractual context.
DPA structure
- Parties (Controller and Processor).
- Subject matter and purposes of processing.
- Duration, categories of data, and data subjects.
- Documented instructions from the Controller.
- Obligations of the Processor.
- Sub-processors and extra-EEA/UK transfers.
- Security measures and data breach procedures.
- Data subject rights, audit rights, and termination.
Key technical measures
- Role-based access control and least-privilege principle.
- Encryption in transit (TLS) and at rest where applicable.
- Environment segregation: development / staging / production.
- Operational and AI audit logs.
- Backup, recovery, and continuous monitoring.
- Secret management via dedicated secret manager.
Current sub-processors
PappAI relies on the following sub-processors to deliver the Service. Each entry indicates the primary purpose, the country of processing and the legal basis for any data transfer outside the EU/EEA. The list is kept up to date and any material change will be notified in advance to Controllers.
| Provider | Purpose | Processing country | Data categories | Transfer / safeguards |
|---|---|---|---|---|
| Google Cloud Platform (Google LLC) | Cloud hosting (Cloud Run, Cloud SQL), object storage (GCS), logging and monitoring. | EU regions (europe-west1), corporate USA | All Service data: clinical, account, billing, operational logs. | EU SCC + DPA |
| Google Vertex AI (Google LLC) | Generative AI inference for diet plan drafting and clinical analysis support. | EU multi-region, corporate USA | Input pseudonymised as a rule; exceptions: photos/scanned PDFs imported after the professional's confirmation, patient names in the support assistant, meal photos; no training opt-in. | EU SCC + DPA · no training opt-in |
| Google Workspace (Calendar, Meet) | Tele-consultations: calendar event and Google Meet link in PappAI's Workspace account. | EU + edge USA | Patient name and email, appointment date and notes. | EU SCC + DPA Workspace |
| Firebase (Google LLC) | Authentication (identity tokens), push notification delivery (FCM/APNs) and app crash reports (Crashlytics). | USA, multi-region | User identity (email, phone), device push token, notification text (including the preview of the professional's messages), technical crash data without a user identifier. | EU SCC + DPA |
| Stripe Payments Europe Ltd | Subscription billing, invoicing, payment processing. | Ireland (EU) | Account and billing data, transaction history. No clinical data. | Intra-EU |
| Brevo (Sendinblue SAS) | Transactional email (account, billing notifications, professional's templates) and lifecycle automations towards professionals. | France (EU) | Recipient email, message content, delivery status. | Intra-EU |
| Twilio Ireland Ltd | SMS delivery: OTP codes, consent signing links, appointment reminders, payment links and messages from the professional. | Ireland (EU), corporate USA | Recipient phone number, message content, delivery metadata. | EU SCC + DPA |
| Meta Platforms Ireland Ltd | WhatsApp Business Cloud API for templated patient communications. | Ireland (EU), corporate USA | Recipient phone number, template variables, delivery metadata. | EU SCC + DPA |
| Google Analytics 4 (Google LLC) | Aggregated usage analytics on the public site only, subject to consent. | USA, corporate | Pseudonymous identifiers, page views, interaction events. No clinical data. | EU SCC + DPA · consent-gated |
| Microsoft Clarity (Microsoft Corporation) | Anonymised UX analytics (heatmaps, session replays). | USA, corporate | Pseudonymous identifiers, interaction events. No clinical data; sensitive fields masked. | EU SCC + DPA · consent-gated |
| ITALA Tecnologia Informatica S.r.l. | Italian e-invoicing (SDI) and transmission of healthcare expenses to the Sistema Tessera Sanitaria, for practitioners based in Italy. | Italy (EU) | Fiscal data of practitioner and patient (name, tax code, amounts, service date). No clinical data. | Intra-EU |
| OpenAI Ireland Ltd (ChatGPT Ads) | ChatGPT Ads conversion pixel on the public site only, subject to marketing consent. | Ireland (EU), corporate USA | Pseudonymous identifiers and conversion events. No account or clinical data. | EU SCC + DPA · consent-gated |
| SumUp | Patient → professional payments (payment links and card reader) on the SumUp account connected by the professional. | EU/UK | Amount, invoice reference, patient email. No clinical data. | SumUp terms (+ UK adequacy / SCC) |
| Apple Inc. (APNs) | Delivery of push notifications to the iOS apps (Apple Push Notification service). | USA | Device push token and notification text. | EU SCC |
All listed sub-processors process data under written agreements containing GDPR-compliant safeguards (DPAs, EU SCCs where applicable). Patient clinical data is never used to train, fine-tune, or evaluate AI models by any sub-processor.
Planned annexes
- Annex A: processing detail (Art. 28(3) GDPR).
- Annex B: current sub-processor list.
- Annex C: technical and organisational measures (TOMs).