List of subprocessors

This list is annex III of the data processing agreement: it sets out the providers (subprocessors) that Oclivo engages to deliver the service and that may process clinics' data. Version 0.10, 29 October 2026 (version 0.10 adds LabsMobile, for text messages, and Meta, for the WhatsApp that each clinic hires directly; version 0.9 was the first one published: it brings together the clinics' subprocessors, the providers of Oclivo as controller and the third parties that receive data as independent controllers). This is a courtesy translation: if it differs from the Spanish text, the Spanish text prevails.

All clinics' data are hosted in the European Union. Where a provider is established outside the European Economic Area or may access the data from outside it, the Chapter V GDPR safeguard for the transfer is stated. Any addition or replacement is notified to clinics 30 days in advance, with the right to object (clause 6 of the data processing agreement).

1. Subprocessors that process data on behalf of the clinics

Hetzner Online GmbH

• Service: hosting of the application, its databases, files and backups.
• Data: all the platform's data, on encrypted disks; clinical notes, transcriptions, files and other sensitive data are additionally encrypted by the application with per-clinic keys.
• Location: Germany (European Union). Registered office: Industriestr. 25, 91710 Gunzenhausen, Germany.
• Safeguards: Hetzner's data processing agreement. There is no international transfer.

Cloudflare, Inc.

• Service: protection network in front of the application: firewall, protection against denial-of-service attacks and rate limits. It does not cache or store the content.
• Data: the application's traffic in transit, decrypted in its network to inspect it; technical logs with the IP address, browser and page address (addresses carry no patient data).
• Location: global network. Registered office in the United States (101 Townsend St., San Francisco, CA 94107).
• Safeguards: data processing agreement included in its terms of service; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795).

Language model providers (artificial intelligence)

• Service: the models used by the consultation scribe, the assistants and document reading, directly or through a model access gateway.
• Data: the text of the consultation or document, after the Oclivo server has replaced the data that identify the patient.
• Location: with real data, processing takes place only in the European Union.
• Safeguards: data processing agreement with zero data retention and no use to train models. If the contracting entity is established outside the European Economic Area (such as the access gateway), the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). No real health data are sent to providers in countries without an adequacy decision or Chapter V GDPR safeguards.

Speech transcription provider (artificial intelligence)

• Service: turning into text, on the fly, the consultation audio the professional dictates.
• Data: the consultation audio, which is not kept, and the transcribed text it returns.
• Location: access point and processing in the European Union.
• Safeguards: data processing agreement with no retention of the audio and no use to improve its models. If the contracting entity is established outside the European Economic Area, the Commission's standard contractual clauses.

Resend, Inc.

• Service: sending the clinic's emails to its patients and guardians (reminders, notices and access codes to the patient portal) and the platform's emails to staff.
• Data: email address, clinic name, date and time of the appointment, links and codes. Never health data or attachments.
• Location: sent from the European Union; the content and the logs of the emails are stored mainly in the United States.
• Safeguards: the Commission's standard contractual clauses, incorporated into its data processing agreement; Resend, Inc. is also certified under the EU-US Data Privacy Framework.

LabsMobile

• Service: sending the clinic's text messages to its patients and guardians (reminders, notices, "SÍ", "NO" and "BAJA" replies and access codes to the patient portal) and receiving the delivery notices and the replies.
• Data: the patient's phone number, the text of the message (clinic name, date and time, link or code; never health data), the delivery state and the text of the replies. The telephone operators the message passes through carry it.
• Location: Spain (European Union).
• Safeguards: data processing agreement (article 28 GDPR) with LabsMobile. There is no international transfer on its side.

The identity of the artificial intelligence and transcription providers is given to any clinic that asks for it, under a duty of confidentiality.

2. Providers that each clinic hires directly

They are not subprocessors of Oclivo: the clinic hires them on its own and Oclivo acts as a technology provider, sending on its behalf with the credential the clinic grants it. They are listed here so that the clinic knows what happens to its patients' data. If Oclivo ever hired them (for example, with the credit line of a Meta partner), their role would be reviewed and clinics would be notified 30 days in advance.

Meta Platforms Ireland Limited (WhatsApp)

• Service: WhatsApp Business: sending the clinic's messages to its patients and receiving the delivery states and the replies, with the clinic's own number and WhatsApp Business account. The clinic accepts Meta's terms and adds its payment method in Meta's Embedded Signup window, from "Settings › Communications › Channels".
• Data: the patient's phone number, first name and the text of the template (date, time, site, clinic, professional, clinic phone number and link; never health data), delivery states and replies. From the clinic's account, the identifiers of its account and number, the display name, the quality, the sending limit and the state of its templates. Oclivo does not ask for the chat history or the phone's contacts.
• Location: Ireland; Meta Platforms Ireland may process the data in Meta Platforms, Inc. (United States). For new numbers local storage in Germany is requested: the content of a message may pass through Meta data centres outside that region for up to 60 minutes and is then stored only in Germany. The number of the WhatsApp Business app has no local storage.
• Safeguards: the WhatsApp Business terms and their data processing terms, under which Meta acts as processor of the clinic; the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and the standard contractual clauses of those terms. The clinic's credential is stored encrypted with its key and Meta's notifications are only accepted with their signature verified.

3. Providers of Oclivo as controller (no patient data)

These providers process data for which Oclivo is the controller, never patient data. They are listed so that the clinic knows what happens to its staff's data.

HubSpot Ireland Limited

• Service: commercial management (CRM), for commercial purposes only.
• Data: the contact of whoever requests a demo or signs up the clinic, the sign-up answers and commercial consents. Never patient data or clinical data.
• Location: European Union data centre. Registered office: One Sir John Rogerson's Quay, Dublin 2, Ireland; parent HubSpot, Inc., in the United States.
• Safeguards: HubSpot's data processing agreement; for any access by the parent, HubSpot, Inc. is certified under the EU-US Data Privacy Framework.

PostHog, Inc.

• Service: analytics of how staff use the application, only for those who accept it: screens, clicks, surveys and session recordings.
• Data: a code that does not identify the person or the clinic, the role, the approximate size of the clinic and its plan; recordings show everything typed, patient data and clinical areas masked. No names, emails or IP address. Never patient data.
• Location: its European Union cloud (Frankfurt, Germany). Registered office in the United States.
• Safeguards: PostHog's data processing agreement; for any access from outside the European Economic Area, the Commission's standard contractual clauses.

Resend, Inc.

• Service: account emails (sign-in, invitations, security and legal document notices).
• Data: the user's email and name. Never patient data.
• Safeguards: those of section 1.

4. Third parties that receive data as independent controllers

They are not subprocessors: they receive a datum to provide their own service and process it under their own responsibility. Oclivo passes it to them on the clinic's instruction (annex IV of the data processing agreement) or because the user chooses so.

Google (Google Ireland Limited and Google LLC)

• Address suggestions: only the text typed in an address field, a random search identifier and the clinic's province, sent from the Oclivo server, without any name or identifier or the IP address of the device.
• Sign-in with Google: only the identity of the user who chooses it (Google account identifier, email and name). Never patient or clinic data.
• The clinic's Google profile, if the clinic connects it: the review replies the clinic writes and confirms and the reading of its profile. Never patient data.
• Map of the site and "Directions": only the public address of the site; loaded when the person clicks "See map" or the link.
• Location and safeguards: United States; Google LLC is certified under the EU-US Data Privacy Framework.

CartoCiudad (Spanish National Geographic Institute)

• Service: address suggestions when Google is not enabled.
• Data: the text typed in the address field and the clinic's province.
• Location: Spain.

5. Changes to this list

Each new version is published on this page and in the application. If it adds or replaces a subprocessor of section 1, the owner of each clinic is notified 30 days before its effective date, in the application and by email, and the clinic may object on reasoned grounds within that period.