Subprocessors

Active in this deployment (4)

• Cloudflare, Inc.

  Redacted bill figures pass through in transit

  Purpose

  Hosting the website, the installable app and the stateless functions that run the checks

  Data received

  Requests in transit. When you run the checks on a bill, the redacted figures read from it (line items, amounts, dates, codes, provider name) pass through Cloudflare to our function, are processed in memory and are not written anywhere. Never the bill file, never a page image, never the patient’s name. Messages you send from the Support page pass through in transit to our email provider and are not stored by Cloudflare. Function logs carry request ids and error codes only.

  Processing location

  Global network: each request is handled in the Cloudflare location nearest to the visitor, which can be outside the European Union

  Transfer basis

  EU Standard Contractual Clauses under Cloudflare’s data processing addendum

  Data processing agreement

  Cloudflare’s customer data processing addendum

  Retention

  Transient. Nothing from a request body is stored; request logs per Cloudflare’s retention

• Stripe Payments Europe, Ltd.

  Purpose

  Taking payment for a single bill or a Pro subscription; hosting checkout and the billing portal; the only record of who has paid

  Data received

  Email address, payment method details you enter directly with Stripe, what you bought and when, subscription state. No bill contents, no health information. For a single-bill purchase Stripe also holds a hash of the redacted figures (so the receipt can be matched to that bill), which reveals nothing about the bill itself.

  Processing location

  Ireland and United States

  Transfer basis

  EU Standard Contractual Clauses under Stripe’s data processing agreement

  Data processing agreement

  Stripe’s DPA is incorporated in its services agreement

  Retention

  Per Stripe’s retention policy for payment records

• Brevo (Sendinblue SAS)

  Purpose

  Delivering the sign-in link a subscriber asks for on a new device, and the messages sent from the Support page to our support mailbox

  Data received

  The subscriber’s email address and the message containing the link; the text of a Support-page message and, if you gave it, the email you paid with. Never bill contents. Only subscribers are ever emailed.

  Processing location

  European Union (France)

  Transfer basis

  Processing within the EU; Brevo’s data processing agreement

  Data processing agreement

  Brevo’s DPA is incorporated in its terms of service

  Retention

  Short-lived delivery logs per Brevo’s policy

• Proton AG

  Purpose

  Hosting our support mailbox: it receives a copy of each message sent from the Support page, and any email you write to us

  Data received

  What you wrote in a message or an email, the topic you chose, the app version, and your email address if you gave it. We ask you not to include anything from your bill.

  Processing location

  Switzerland

  Transfer basis

  European Commission adequacy decision for Switzerland

  Data processing agreement

  Proton’s data processing agreement is part of its terms

  Retention

  As long as a message is useful, or until you ask us to delete yours

Not in use in this deployment

Supported by the software but not currently configured, so they receive nothing.

• SMTP email relay, as configured in this deploymentDelivering the sign-in link a subscriber asks for on a new device (a relay other than Brevo is configured)
• ResendAlternative email provider for sign-in links (not used in production)
• Functional Software, Inc. (Sentry)Error tracking (optional)