Here you can see which suppliers we use when we run FlowDule for you. For each supplier, it states what it does, which information it receives, where the processing takes place and what the status is today. The list belongs together with the Data Processing Agreement, and we update it whenever we add or replace a supplier.
1. How to read the list
#| Category | Meaning |
|---|---|
| Sub-processor | Processes your personal data on our behalf and on your instructions. We have a data processing agreement with the party, the party has equivalent agreements with its own sub-suppliers, and you approve the party through the Data Processing Agreement. We follow up on the supplier on an ongoing basis. |
| Recipient or independent controller | Determines all or part of the purpose itself. The party is therefore not our sub-processor, a different basis may apply, and you may have to inform your clients separately. |
| Technical supplier without personal data | Supplies technology to the platform without receiving personal data. |
2. What we require of a supplier
#Before a supplier processes personal data for you, we agree in writing with it which role it has, what the information may be used for, which information and which persons are involved, which technical configuration is used, which countries the processing and any remote access take place from, which sub-suppliers there are, how long the information is kept, how it is secured, what the basis is for any transfer outside the EU and the EEA, and how we exit the agreement again. If that is not in place, we do not put the supplier to use for the task. The list shows the suppliers we actually use.
3. Hosting and central infrastructure
#We run production at Kinsta (Sevalla) in Google Cloud data centres. This covers the api, the database and the booking sites, and the database is located in Frankfurt. The web app is a static site at Sevalla. Cloudflare sits in front of all Sevalla apps and provides object storage of media and database backups in Cloudflare R2 as well as protection against bots.
| Supplier and service | Purpose and data | Region/transfer | Status |
|---|---|---|---|
| Kinsta (Sevalla) with Google Cloud data centres as sub-supplier | Hosting of the api, the database and the booking sites, and the web app as a static site; customer data may include journal/health data. | Google Cloud data centres; the database is located in the region europe-west3 (Frankfurt). Any transfer outside the EU/EEA takes place under the supplier’s contractual terms. | Active. Core production. The database is backed up daily to Cloudflare R2 with 30 days’ rotation. |
| Cloudflare, Inc., USA | Three roles: edge and TLS in front of all Sevalla apps (IP, request and traffic data); R2 object storage for media (images, dictation audio, exports) and database backups; Turnstile bot check on public forms (IP and browser signals). | Global network for edge and Turnstile; transfer basis per the supplier’s contractual terms. | Active. Turnstile is loaded only on the forms that require bot protection (booking, event registration, the contact form and the back-in-stock notification in the webshop). Cloudflare sets the security cookies __cf_bm and cf_clearance on the booking sites. |
Our contracting party at Amazon Web Services is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, together with the AWS group entities covered by the applicable contractual framework. We use these AWS services in the EU:
| Service | Purpose and data | Region | Status |
|---|---|---|---|
| Cognito | Sign-in and user management: name, e-mail, telephone, credentials/tokens. | EU | Active. |
| SES | E-mail: contact details, recipient, metadata and message content. | EU | Active. Data-minimised content only. |
| Amazon Bedrock with Anthropic Claude | Generative documentation assistance and translation of journal, catalogue and text content; prompt, journal text and output. | EU inference profile | Active. The AI features in the journal follow the journal module. The practitioner is responsible for reading and correcting AI documentation drafts; there is no separate approval step. |
| Amazon Transcribe | Dictation; audio and transcripts, which may be health data. The audio is processed through one dedicated transcription bucket. | EU | Active when the chain uses dictation. |
| Amazon Textract | OCR; document images and text, which may be health data. | EU | Active when the chain uses OCR. |
| AWS KMS | Key management for field encryption of journal data. KMS receives encryption keys, not journal text. | EU | Active. |
| Amazon Translate | Translation of support tickets and platform broadcasts; the text of the ticket or broadcast. | EU | Active only for support tickets and platform broadcasts. Journal, catalogue and other text is translated through Bedrock. |
4. Other sub-processors and processing suppliers
#| Supplier/legal entity | Role, purpose and data | Countries/transfer | Current status |
|---|---|---|---|
| GatewayAPI / ONLINECITY.IO ApS, CVR 27364276, Denmark | Sub-processor for SMS; telephone number, sender and message text. | The supplier’s .com platform, where message data is kept in the EU (Google, Belgium). | SMS is active. The message content follows the chain’s message templates; the chain can choose neutral messages without client or service names. |
| LiveKit Incorporated, USA | Video infrastructure; session ID, pseudonymous participant ID, display name, audio/video and any chat in transit. No recording, egress, agents or inference is used. | USA. LiveKit Cloud routes each session to the nearest server; processing is not bound to the EU. Transfer basis under LiveKit’s data processing addendum (part of LiveKit’s terms): the EU-US Data Privacy Framework where LiveKit is certified, otherwise the EU Standard Contractual Clauses. | Active for chains that switch the video module on. |
| 650 Industries, Inc. / Expo, USA | Push delivery; device token, platform, device name and notification. Onward delivery via Apple/Google. | USA/global delivery chain. | Push is switched off in production; no push messages are sent. |
| Stripe Payments Europe, Limited / Stripe Technology Europe, Limited, Ireland | FlowDule subscriptions are processed separately on the platform account. The customer’s client payments are direct charges on the customer’s Stripe Express connected account; the customer is the merchant. Data: contact details, amount, status and transaction reference; no journal text. | Ireland; any support/onward chain per Stripe’s contractual basis. | Active. Stripe.js loads on the payment steps. Separate signed platform/Connect webhooks and refunds with proportional reversal of the application fee have been implemented. |
| Postcode.nl B.V. (Postcode.eu), the Netherlands | Address suggestions in administration; business, location and event address fragments, not journal data. | The Netherlands. | Lookups go through FlowDule’s own proxy behind sign-in. |
5. Recipients that are not FlowDule’s sub-processors
#| Service | Role and data | Status/action |
|---|---|---|
| Stripe in the customer’s client payment | The customer is normally the merchant/contracting party for its own Stripe account; Stripe may be the customer’s processor or may have its own statutory purposes. FlowDule is a technical intermediary. | The role and the contractual flow are shown in onboarding. The customer must have its own agreement and its own information. |
| CARTO/CartoDB | Map tiles may give the recipient the visitor’s IP and browser data; the party may have independent purposes. | Maps load only after the visitor’s active click (click-to-load), and attribution is shown. |
| Nominatim/OpenStreetMap Foundation | Geocoding may send the clinic address, IP and technical data to an external recipient. | Geocoding goes through FlowDule’s own proxy; the browser does not call the service directly. |
| Apple and Google in the push chain | The operating system’s push services receive the device token and the notification. Their precise role depends on the platform terms. | Push is switched off in production. |
| The European Central Bank | The public exchange rate feed is retrieved server-side without user data under the design described. | Processes no personal data about visitors. |
| Usercentrics (consent banner) | Shows the consent banner and stores the visitor’s choice on FlowDule’s own marketing site www.flowdule.com; IP and browser data and the consent choice. | Used only on www.flowdule.com and receives no customer data from the platform. A recipient for the marketing site, not a sub-processor for customer data. |
| Google Tag Manager (container GTM-5RCTVWXJ) | Loads tags on FlowDule’s own marketing site www.flowdule.com; IP and browser data. | Used only on www.flowdule.com and receives no customer data from the platform. A recipient for the marketing site, not a sub-processor for customer data. Non-necessary tags may only run after consent in the banner, see the Cookie Policy. |
6. Transfers outside the EU and the EEA
#Most of it stays in the EU and the EEA. The database is located in Frankfurt, and the AWS services run in the EU. Some processing nevertheless takes place outside the EU and the EEA:
- Video through LiveKit. Each session goes to the nearest server, and the processing is not bound to the EU. The basis is LiveKit’s data processing addendum: the EU-US Data Privacy Framework where LiveKit is certified, otherwise the EU Standard Contractual Clauses.
- Cloudflare’s edge and Turnstile. They run on a global network, and the basis follows Cloudflare’s contractual terms.
- Hosting at Kinsta (Sevalla). Any transfer takes place under the supplier’s contractual terms.
- Remote support and access from a supplier’s group or sub-suppliers. This may take place from a country outside the EU and the EEA, even where the information is stored here.
The basis for a transfer is either a decision by the European Commission that the country has an adequate level of protection, the EU-US Data Privacy Framework for the entity that is certified, or the EU Standard Contractual Clauses with a transfer impact assessment and the supplementary measures that are necessary.
Your own settings in the platform, together with the Data Processing Agreement, form your instructions to us, and they cover the transfers that follow from the modules you have switched on, including video through LiveKit.
7. The AI supplier chain
#We use Anthropic Claude through Amazon Bedrock in a configuration that processes only in EU regions (the EU inference profile). We therefore have no direct processor relationship with Anthropic, and it is Amazon Web Services we have the agreement with. Which information is sent is set out in the table in section 3.
The AI features in the record are part of the journal module and are available if you have switched the journal module on. There is no separate step where you switch each individual AI feature on. Most AI results are drafts that a competent user must review before they are stored in the record or shared. Some results are not approved individually, including the automatic note feedback to the practitioner and the machine translation of shared content for the client, see the AI information. We do not use AI for diagnosis, triage, treatment decisions or access to services, and your data is not used to train models and is not reused for other purposes.
8. Changes, notice and objection
#Through the Data Processing Agreement you give a general approval of the sub-processors stated in the version of this list that you have accepted. If we plan to add or replace a direct sub-processor, we give you at least 30 days’ notice before the change takes effect.
Before the deadline you can object at privacy@flowdule.com. The objection must be specific and objectively justified on data protection grounds. If we do not find a reasonable solution together, you can terminate the affected service under the Data Processing Agreement. We keep track of changes further down the chain, and we tell you about them when the change materially affects the processing, the risk, the regions or your instructions.
The Trust Center explains security and GDPR in plain language: Go to the Trust Center. Every document in force has a date and a version: See all documents.