Sub-processors
Version 1.0 · Last updated 16 September 2026
The companies that process customer data on our behalf so that we can provide HeraIQ. Care providers authorise them under our data processing agreement.
Current sub-processors
Our database is hosted in London. Some sub-processors process or store data elsewhere, as the table shows, together with the safeguard that covers any transfer outside the United Kingdom.
| Sub-processor | What it does | Data | Location | Transfer safeguard | Source |
|---|---|---|---|---|---|
| Supabase Pte. Ltd | Database, sign-in and file storage. | Everything held in a customer's account, account details and uploaded files. | London, United Kingdom (AWS eu-west-2). Supabase may process some data, such as logs and metrics, outside that region where needed to provide the service. | EU Standard Contractual Clauses with the UK Addendum. | Supabase DPA |
| Vercel Inc. | Hosting for the website, the app and its server functions. | Requests to the website and app as they are handled, and request logs. | Server functions run in London, United Kingdom (lhr1). Vercel's primary processing facilities are in the United States. | UK International Data Transfer Addendum (IDTA). | Vercel DPA |
| OpenAI OpCo, LLC | AI processing: chat, realtime voice sent straight from the browser, transcription, reading documents (including identity documents and DBS certificates), speech, image generation and embeddings. | The text, audio, images and documents a request needs, which can include care record details. | OpenAI's standard infrastructure, not a UK or EU data residency region. OpenAI keeps abuse-monitoring logs for up to 30 days, and does not use API data to train its models by default. | EU Standard Contractual Clauses with the UK Addendum. | OpenAI DPA |
| LangChain, Inc. (LangSmith) | Monitoring Hera's AI so that we can find and fix problems: a record of each AI request, the steps and tools it used, and its answer. | What an AI request contained and returned, including the records Hera looked up, which can include care record details. | LangSmith's EU region, hosted on Google Cloud in the European Union. If HeraIQ is ever pointed at LangSmith anywhere else, this monitoring switches itself off. Records are kept for up to 400 days. | EU Standard Contractual Clauses with the UK Addendum. | LangChain DPA |
| Plus Five Five, Inc. (Resend) | Sending transactional email. | Recipient email addresses, the emails we send and delivery logs. | United States. | EU Standard Contractual Clauses with the UK Addendum. | Resend DPA |
| 650 Industries, Inc. (Expo) | Delivering push notifications to the HeraIQ Care app, passed on to Apple Push Notification service and Firebase Cloud Messaging. | A device push token and generic notification text, such as "You have a new message." No care content. | United States. | UK Extension to the EU-U.S. Data Privacy Framework. | Expo privacy policy |
How we tell you about changes
This list names the sub-processors we engage directly. Before we add or replace one of them, we email every customer organisation at least 30 days in advance. The email goes to the person who accepted our terms for the organisation, or to another address the organisation has given us in writing. It says who the sub-processor is, what it will do and where it will process data, and we update this page on the same day.
Our sub-processors may use other companies in turn, and may change them at shorter notice than we give you. When a sub-processor tells us about such a change, we pass it on to you by email without undue delay.
If you object to either kind of change on reasonable data protection grounds, email hello@heraiq.io within 30 days of our email. If we cannot resolve the objection, you may end your subscription. The sub-processor clause of the data processing agreement sets out the full terms.
PostHog is not on this list
PostHog is not a sub-processor. We use it for our own purposes, to measure visits to our public website, and only after you accept analytics cookies. It never runs in the signed-in product. Its data is held on PostHog's EU cloud in Frankfurt, Germany.
The cookie policy explains what it records and how to refuse it.
Change history
First published on 16 September 2026. There have been no changes since.