Overview
A sub-processor is a third party that processes personal data on Doctena's behalf in the course of delivering our service to you. Every sub-processor below is bound to Doctena by a contract that includes the Article 28 GDPR clauses, equivalent technical and organisational measures, and — where relevant — the European Commission's Standard Contractual Clauses for transfers outside the EU/EEA.
Internal-only suppliers (HR, accounting, hardware vendors, office services, internal collaboration tools that don't touch patient or customer data) are not listed here. They appear in our internal Suppliers Register and are subject to the same security review process.
Our commitments
- Doctena gives the controller 14 days' prior written notice before adding or changing a sub-processor that touches personal data.
- During the notice window the controller may object on reasonable grounds related to the protection of personal data.
- If the controller objects, Doctena either addresses the controller's concerns or, failing that, terminates the affected portion of the service at no penalty.
- The register on this page is refreshed at least monthly and within 14 days of any material change.
- Material changes are also recorded in our site changelog.
Current register
Cloud infrastructure
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Amazon Web Services Amazon Web Services EMEA SARL | Primary production hosting (compute, storage, databases) in eu-central-1 (Frankfurt). | EU | patientspractitioners | Privacy notice · DPA |
| Automat-IT Automat-IT Sp. z o.o. | AWS reseller and DevOps-as-a-Service partner operating Doctena’s AWS environment. | EU | patientspractitioners | Privacy notice |
| WP Engine WPEngine, Inc. | Managed WordPress hosting for the Doctena marketing website. | US (SCCs) | website visitors | Privacy notice |
| Webflow Webflow, Inc. | Website builder used to create Doctena Boost practitioner micro-sites. | US (SCCs) | practitionerswebsite visitors | Privacy notice |
| Median Median.co Inc. (formerly GoNative) | Builds and packages the native iOS / Android shells for the Doctena web applications. | EU | patientspractitioners | Privacy notice |
Networking & security
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Cloudflare Cloudflare, Inc. | Edge CDN, WAF, DDoS protection and authoritative DNS for Doctena applications. EU Data Localization Suite enabled. | Global (EU-localized) | patientspractitionerswebsite visitors | Privacy notice |
Messaging
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| CloudAMQP (84codes) 84codes AB | Managed RabbitMQ message broker for inter-service messaging. | EU | patientspractitioners | Privacy notice |
Media & maps
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Cloudinary Cloudinary Ltd. | Media management — image/video processing, malware scanning and delivery for content uploaded to the platform. | EU + US (SCCs) | patientspractitioners | Privacy notice |
| Mapbox Mapbox, Inc. | Interactive maps embedded on patient-facing pages for practitioner location search. | US (SCCs) | website visitorspatients | Privacy notice |
Communications
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Cronofy Cronofy Ltd. | Bidirectional calendar synchronization between Doctena and a practitioner’s external calendar (Outlook, Google). | EU | practitioners | Privacy notice |
| Whereby Whereby AS | End-to-end encrypted video infrastructure powering Doctena’s teleconsultation feature. | EU | patientspractitioners | Privacy notice |
| Spryng Spryng B.V. | SMS gateway — booking validation, appointment reminders and patient communications. | EU | patients | Privacy notice |
| SMSAPI (LINK Mobility Poland) LINK Mobility Poland Sp. z o.o. | Secondary SMS gateway for high-volume or country-specific routing. | EU | patientspractitioners | Privacy notice |
| Postmark ActiveCampaign, LLC (Postmark by Wildbit) | Transactional email delivery (booking confirmations, password resets, system notifications). | US (SCCs) | patientspractitioners | Privacy notice |
| Interfax Upland Software, Inc. | Mail-to-fax / fax-to-mail gateway (primarily Germany) for exchange of medical correspondence. | EU | practitionerspatients | Privacy notice |
Payments & billing
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Stripe Stripe Payments Europe Ltd. | PCI-DSS Level 1 payment processing for in-app paid bookings (when enabled by the practitioner). | EU + US (SCCs) | patientspractitioners | Privacy notice |
| GoCardless GoCardless SAS | SEPA Direct Debit collection for practitioner subscription payments. | EU | practitioners | Privacy notice |
| Zuora Zuora, Inc. | Subscription management and recurring-billing automation for practitioner customers. | EU | practitioners | Privacy notice |
Support
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Zendesk Zendesk International Ltd. | Customer support ticketing for practitioner inquiries; occasional patient escalations. | EU + US (SCCs) | practitionerspatients | Privacy notice |
| Aircall Aircall SAS | Cloud telephony for customer support and sales — captures inbound/outbound call metadata and recordings (where enabled). | EU | practitioners | Privacy notice |
Productivity
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Beamer Joincube Inc. | In-app product announcements and changelog notifications inside the customer-facing applications. | EU | practitionerspatients | Privacy notice |
| Dropbox Sign Dropbox International Unlimited Company | Authenticated e-signature for practitioner customer contracts, NDAs and pre-signed DPAs. | US (SCCs) | practitioners | Privacy notice |
Forms & consent
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| CookieFirst Digital Data Solutions B.V. | Cookie consent management banner and consent-record archive on Doctena public surfaces. | EU | website visitors | Privacy notice |
| Typeform Typeform SL | Hosts the public intake forms behind privacy.doctena.com and complaints.doctena.com. | EU | patientspractitionerswebsite visitors | Privacy notice |
Analytics
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Matomo InnoCraft Ltd. | Privacy-friendly web analytics on Doctena public websites (opt-in via CookieFirst). | EU | website visitors | Privacy notice |
Marketing & CRM
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| HubSpot HubSpot Ireland Ltd. | CRM and marketing automation for practitioner customer and prospect data. | EU + US (SCCs) | practitioners | Privacy notice |
| Brevo Sendinblue SAS (Brevo) | Email marketing automation to practitioner prospects and customers. | EU | practitioners | Privacy notice |
Observability
| Supplier | Purpose | Residency | Data subjects | Privacy |
|---|---|---|---|---|
| Datadog Datadog, Inc. | Application performance monitoring, log aggregation and security analytics. Logs may incidentally contain identifiers. | EU | patientspractitioners | Privacy notice |
Data residency at a glance
Of 28 listed sub-processors:
- EU18
- Global (EU-localized)1
- EU + US (SCCs)4
- US (SCCs)5
Recently decommissioned
The following suppliers have been removed from Doctena's production environment in the last 12 months. Where these suppliers held personal data, that data has been deleted or returned to Doctena per the relevant contract.
| Supplier | Was used for | Removed on |
|---|---|---|
| Userflow | In-app feature announcements | 2025-Q3 |
| Satismeter (Productboard) | CSAT surveys | 2025-Q2 |
| Ultimate AI | Automated chat assistant | 2025-Q4 |
| Mailcoach (Spatie) | Bulk customer emails | 2024-Q4 |
Subscribe to changes
Customers who want to be notified of every sub-processor change can subscribe via email. Send the practitioner or company name and the notification address to privacy@doctena.com and we will add you to the distribution list. An RSS feed is planned and will be linked here when available.
Register version 2.0.0 — refreshed monthly · source: internal Suppliers Register reviewed by Information Security and Legal.