Legal

List of Sub-processors

Reference document

Referenced by the Privacy Policy for patients and by the Data Processing Agreement for dentists and clinics.

Last updated: 4 August 2026

1. Sub-processors

For the provision of the Services, Perioskoup SRL uses the following sub-processors, with access strictly limited to the data necessary for the role of each:

Sub-processor	Role	Data categories	Processing location	Transfer safeguards
Hetzner Online GmbH	dedicated server and database hosting	all platform data	Helsinki, Finland (EU)	processing within the EU
Google Ireland Ltd. (Firebase)	authentication and push notifications	e-mail, authentication tokens, device identifiers	EU, with possible transfers to Google LLC (USA)	Standard Contractual Clauses, EU-US Data Privacy Framework certification
PostHog	analysis of application usage	pseudonymised usage data	Frankfurt, Germany (EU)	processing within the EU
Amazon Web Services (AWS)	generation of recommendations, processing of text documents, audio transcription	pseudonymised text, image and audio content	Frankfurt, Germany (EU)	processing within the EU
Google LLC (Gemini)	AI-assisted analysis of images, document processing and generation of recommendations	pseudonymised text, image and audio content	EU, with possible transfer to the USA	Standard Contractual Clauses, contractual prohibition on training
Sentry	monitoring of technical errors	technical and diagnostic data, with personal data filtered out	EU, with possible transfer to the USA	Standard Contractual Clauses

2. Independent controllers

The following providers process data in the capacity of independent controllers, in accordance with their own privacy policies, and are not sub-processors: Stripe, for payment processing, as well as Apple and Google, for the distribution of the application and the management of subscriptions through the app stores.

3. Updating the list and right of objection

The addition or replacement of a sub-processor is notified to professional clients by e-mail or through the Services at least 10 days in advance. Clients may raise reasoned objections within 7 days of the notification, in accordance with section 7 of the DPA. The change history of this page is available on request.