Sub-processors | Ask Brigid

Last updated: 29 September 2026

This working inventory identifies third-party routes found in the Brigid product family, including routes that are switched off, historical or awaiting evidence. Each row says whether its route is enabled or switched off. A provider's appearance here does not mean that it is enabled, contracted or approved for personal data.Brigid is the staff-facing product and MyBrigid is the patient product; they are product names, not legal entities. Processor: DJG Media Limited (trading as Brigid), CRO No. 762838, Coliemore House, Coliemore Road, Dalkey, Dublin, Ireland. The controlled register for an individual clinic must be attached to its executed Data Processing Agreement and limited to the routes actually authorised for that clinic under GDPR Article 28(2).

The clinic contract and DPA commit us to at least 30 days' written notice before adding or replacing a sub-processor that processes your data, with a written objection right and a termination remedy if an objection cannot reasonably be accommodated. The executed clinic contract and DPA control those rights; this webpage does not itself create them or authorise processing.

First-clinic status: not approved. The transfer-mechanism column records the safeguard required for a route, not proof that the safeguard has been executed. Before a route carrying personal data is enabled, its Article 28 terms, transfer basis, purpose, region, retention, training/logging settings and access controls must be present in the vendor evidence pack. Incomplete routes remain disabled or must be removed from production. A row that says instrument not yet captured means exactly that: the safeguard is named, but no copy of the operative text is on file in our Article 28 register.

AI & inference

Sub-processor	Purpose	Data processed	Location	Transfer mechanism
Google Vertex AI (Gemini)	Status: enabled. Note and letter drafting from the transcript, the clinician's own words and, when asked, the chart; and the administrative routes: pre-consultation chart summary, document-filing scan, mailbox triage and emailed-document filing, the onboarding assistant and the staff assistant. Every draft stays a draft until a clinician signs it. Clinical decision support (diagnosis, triage, urgency grading, treatment recommendations) is switched off. The Google Cloud CDPA is on file; each enabled purpose, project/account, service terms, logging, caching and retention must be verified.	Prompts and records used by the authorised workflow: transcripts, clinician notes, chart extracts, documents and emails. This can include identifiable health information and remains subject to health-data protections.	EU — Google Cloud Vertex AI in Frankfurt, Germany (europe-west3); embeddings in europe-west4 (the Netherlands)	EEA — no Art. 46 transfer for inference. The applicable Google Cloud terms cover support access and onward transfers
Google Cloud Speech-to-Text v2	Status: enabled. Consultation recording and dictation: raw speech-to-text (Chirp 3) on an EU endpoint, with no generative enhancement and no US fallback. The Cloud CDPA is captured; account/service coverage, logging and retention are verified per clinic.	Consultation audio and transcripts, including special-category health data. Original audio is deleted within 24 hours after the clinician accepts the note, and no later than seven days after it was recorded	EU regional endpoint	EEA — no Art. 46 transfer; the applicable Google Cloud terms cover support access and onward transfers
Google Cloud Document AI	Status: enabled, where a processor is configured, for the document-filing scan: OCR and form parsing of uploaded and emailed documents so they can be identified and filed. Service-specific contract, purpose and region evidence is verified per clinic	Document content (may include PHI)	EU	EEA — no Art. 46 transfer; the applicable Google Cloud terms cover support access and onward transfers
Google Cloud Platform — supporting services	Status: Maps & Places (address lookup) and reCAPTCHA Enterprise (sign-in protection) are in use. Cloud Healthcare API (FHIR), Healthcare Natural Language, Translation, DLP de-identification, Vision OCR, Text-to-Speech, BigQuery analytics and Contact Center AI Insights are switched off unless a service is individually classified and evidenced for the clinic	Clinical documents and text for the healthcare services; addresses and technical signals for the utility services	EU — “eu” multi-region / europe-west4	EEA — no Art. 46 transfer; the applicable Google Cloud terms cover support access and onward transfers
ElevenLabs	Status: switched off (both ElevenLabs launch switches are off). Historical speech-to-text and outbound voice-agent routes, excluded for patient and clinical content. The captured account review identified sensitive-data, retention and residency gaps.	Audio and outreach information if a route is used; excluded from the approved launch scope	Account-specific residency and access arrangements not approved	Acceptable sensitive-data terms and transfer safeguards remain outstanding; inventory inclusion does not authorise use

Telehealth, recording & meeting capture

Sub-processor	Purpose	Data processed	Location	Transfer mechanism
Daily.co	Telehealth video consultations, cloud recordings and transcription. Status: switched off by the telehealth launch boundary, pending executed terms and verified EU media, recording and transcript storage configuration; instrument not yet captured	Live video/audio of consultations, recordings and transcripts (special-category health data)	EU media routing; recordings are stored in the United States (us-west-2) unless an EU storage bucket is configured for your practice	Art. 28 DPA + SCCs required; instrument not yet captured — route disabled
Recall.ai	Status: switched off (the meeting-bot capture switch is off). Meeting bots and transcripts: excluded from launch pending purpose approval, applicable terms, configuration and verification of deployed restrictions.	Meeting audio, recordings and transcripts, potentially health data	EU route proposed; storage and access require service-specific evidence	Article 28 and any applicable transfer safeguards remain to be established before use

Infrastructure & data storage

Sub-processor	Purpose	Data processed	Location	Transfer mechanism
Supabase	Status: enabled. PostgreSQL database, authentication, file storage and edge functions hosting. Core route hosted in AWS Dublin (eu-west-1); the DPA and incorporated transfer terms are captured. Account/service coverage and current security, backup, access and logging evidence remain release conditions	All PHI/PII — patient records, clinical notes, voice recordings, audit logs	EU — Ireland (eu-west-1) for the database, file storage and server functions	Art. 46 SCCs — Module Three (processor to sub-processor), in force by incorporation. Data is stored in Ireland, but Supabase Pte. Ltd. is a Singapore company with administrative access, so Chapter V applies

Communications & messaging

Sub-processor	Purpose	Data processed	Location	Transfer mechanism
Twilio	Status: SMS reminders, campaigns and notifications are switched off. Twilio is still used to deliver sign-in codes by text to staff who chose that method. Live-account scope, terms, region, retention and webhook evidence are verified before SMS to patients is switched on	Phone numbers and one-time codes for staff sign-in by text; delivery metadata. No appointment or patient message content while SMS outreach is off	EU + US routing	Art. 28 DPA + SCCs + EU-US Data Privacy Framework
Resend	Status: enabled. Transactional email. The DPA is captured; verify the enabled message templates, account, retention and domain authentication for the clinic.	Recipient address, message content and delivery metadata; clinical content depends on the authorised template	United States — Resend stores email data in the United States	Art. 28 DPA (captured) + Art. 46 SCCs for the transfer to the United States; account/service evidence required
Healthmail (HSE)	Secure clinical email to the HSE Healthmail network (referrals, clinical letters) — sent only at your direction. Status: switched off; no Healthmail production authorisation or route evidence is on file	Clinical correspondence (special-category health data)	Ireland — HSE secure network	EEA — no Art. 46 transfer; controller-directed transmission
Microsoft (Graph / Outlook)	Status: in use, only for a practice that has connected a Microsoft 365 mailbox or calendar. Connected accounts sync, and the administrative mailbox triage reads them. A new connection is currently held pending role, contract and OAuth-scope review.	Connected mailbox/calendar content and metadata, potentially health data	EU data centres, depending on the connected account's Microsoft tenant	Art. 28 DPA + SCCs where applicable; instrument not yet captured — route enabled; capture in progress
Google Workspace APIs (Gmail / Calendar)	Status: in use, only for a practice that has connected a Gmail or Google Calendar account. Connected accounts sync, and the administrative mailbox triage reads them. A new connection is currently held while Google's Workspace data processing terms for this connection are accepted. A Cloud CDPA does not by itself establish coverage for Gmail or Calendar account access.	Connected mailbox/calendar content and metadata, potentially health data	EU or global, depending on the connected Google account	Art. 28 DPA + SCCs where applicable; instrument not yet captured — route enabled; capture in progress
Apple	Status: enabled. Push notifications (APNs) for the MyBrigid app and for the Ask Brigid clinician iPhone app, and optional read-only iCloud calendar sync (CalDAV) where a clinician connects it. Any identity service requires a separate assessment.	APNs device tokens and a notification category; payloads are kept minimal, and for MyBrigid never carry clinical detail. Calendar entries where iCloud sync is connected.	Global (Apple's push network)	Applicable Apple terms, roles and transfer safeguards; no blanket processor classification is assumed; instrument not yet captured — route enabled; capture required

Billing & identity

Sub-processor	Purpose	Data processed	Location	Transfer mechanism
Stripe	Status: enabled. Clinic subscription billing, payments, and Stripe Identity, the document-and-selfie check used to verify a MyBrigid account holder. The DPA is captured. Confirm service-specific roles, current account settings and the agreed order particulars.	Billing identity, payment tokens and metadata. For an identity check: an image of an identity document and a live selfie, processed as biometric data with the person's explicit consent on Stripe's own screen. We ask Stripe to delete the session after the check and keep only the outcome and a reference; Stripe keeps some verification data as an independent controller. Clinical details are excluded from payment descriptions.	EU contracting arrangements and global payment networks, depending on service	Service-specific controller/processor roles and applicable DPA/transfer terms; EU establishment does not settle all onward transfers

Support, monitoring & hosting

Sub-processor	Purpose	Data processed	Location	Transfer mechanism
Sentry	Status: enabled. Application error monitoring: health data and direct identifiers are scrubbed before an error report leaves the application. The DPA is captured; current account, retention, access and authenticated production scrubber evidence remain release conditions	Stack traces and error context — PHI scrubbed before transmission (`sendDefaultPii: false`, custom scrubber)	EU — Frankfurt (Sentry EU region)	Art. 28 DPA + SCCs Module Three + EU-US Data Privacy Framework. Errors are stored in the EU; the importer, Functional Software, Inc., is US-established
Slack	Internal support alerting. Status: switched off — the support notification route is off unless a deployment switch is set, and stays off pending executed terms and minimised-field configuration evidence; instrument not yet captured	Support ticket metadata — no clinical records	US + EU	Art. 28 DPA + SCCs + EU-US Data Privacy Framework required; instrument not yet captured — route disabled
Google Analytics 4	Provided by Google Ireland Limited and loaded through Google Tag Manager. Website analytics only — never loaded by the MyBrigid app, never loaded while someone is signed in to the clinic web app (page addresses there can contain a patient reference), and never before you opt in. Status: enabled on askbrigid.com from 22 September 2026 behind the cookie choice: nothing is requested from Google until you choose “Accept all” or switch on Analytics, and withdrawing the choice reloads the page without it. The signed-out pages of the clinic web app load Google Tag Manager only if an Analytics choice is recorded in that browser (Cookie Policy §2 and §6). Google Consent Mode v2 starts every signal as denied. No advertising, remarketing or audience feature is configured. The Google Ads Data Processing Terms (which govern Analytics) are accepted in the Analytics account; the capture of that acceptance is being added to the register	Website page views, the pages that led to a request, and Google’s analytics identifiers (`_ga`). No patient or clinical data; no page may be used to infer anyone’s health	EU entity; data may be processed in the United States	Art. 28 terms incorporated in the Google Ads Data Processing Terms; Art. 46 SCCs (Module Two) for any US processing; Google LLC is EU-US Data Privacy Framework certified
Lovable Technologies (connector gateway)	Intermediary through which the Slack support notification above is sent — so anything reaching Slack by that route passes through this gateway first. Status: switched off by the same source-level gate as the Slack route (`SUPPORT_SLACK_ENABLED` defaults off). Legal entity, terms, sub-processors, processing location and retention are not yet evidenced, and the route stays off until they are; instrument not yet captured	The same support-ticket metadata sent to Slack, plus connection metadata	Not yet evidenced	Art. 28 terms required (entity and location not yet evidenced, so the transfer module cannot yet be named); instrument not yet captured — route disabled
Vercel	Provided by Vercel Inc. Web hosting for the marketing site and the clinic and patient web apps. The apps are client-side: clinical data (PHI) is exchanged directly between the browser and Supabase (EU), not intentionally routed through Vercel. Vercel’s optional page counter (Vercel Analytics) is not in use. Status: hosting is in use, but deployment, access, WAF and log evidence must cover the intended clinic and clinic-linked adult patient release	App and page delivery and request metadata (IP, URL and timing). No clinical records are intended to be stored by Vercel; production route evidence must confirm that boundary	United States + EU edge nodes	Art. 28 DPA incorporated in the Vercel terms (17 March 2026 version); Art. 46 SCCs, Module Three
Mapbox	Status: enabled. Map display and place search in the MyBrigid clinic finder, and address and Eircode search in a clinic's public-listing settings. Provided by Mapbox, Inc.	The visitor's IP address and the map area being viewed; in a clinic's settings, the address or Eircode being placed on the map. No patient record is sent	United States	Art. 28 terms + SCCs required; instrument not yet captured — route enabled; capture required

Services that receive no personal data

Provider	Purpose	Data processed
DigiCert (Timestamping Authority)	RFC 3161 timestamp candidate for the audit chain. Status: not scheduled — the weekly anchor job is not on the production schedule and runs only after operational review; historical anchor records exist. No personal data leaves, so no Article 28 instrument is required; the provider's terms are not yet captured on file. Source and production proof required before any assurance claim	A cryptographic hash only — no personal data
Anthropic — not a sub-processor	None. Listed here because the question is a fair one: several endpoints and files in our system still carry Anthropic names from an earlier architecture — `secure-anthropic-proxy`, `anthropic-proxy` and two shared modules. Every one of them routes to Google Gemini; the names were kept so the front end did not have to redeploy in lockstep. Direct Anthropic processing was decommissioned on 2 June 2026. A continuous-integration test fails the build if any production file references the Anthropic API endpoint or its request headers, and our browser Content-Security-Policy does not permit a connection to it. Claude models are additionally available through Google Vertex AI in a single EU region, and the staff assistant and the document scan can call them where the deployment is configured for it. When that happens the processor is Google, with Anthropic appearing on Google’s own sub-processor list rather than on ours	No data of any kind is sent to Anthropic
OpenAI	Marketing blog hero-image generation (a fallback when Gemini image generation is unavailable) and administrator “AI connection test” diagnostics — never used for clinical processing. Status: the diagnostics route is disabled by the unclassified-AI launch boundary; the blog image fallback is enabled and scheduled with the blog generator. No personal data is sent, so no Article 28 instrument is required; the provider's terms are not yet captured on file	A synthetic test prompt and a blog image prompt — no patient or user data
Public medical reference services	Status: enabled. When staff ask the in-product assistant to look something up, it can query public services: NCBI PubMed and Europe PMC, US drug-label databases (openFDA, DailyMed), the US NPI registry, and SNOMED and ICD terminology servers. These are public services with no contract with us, so no Article 28 instrument applies. Patient identifiers are not authorised in a search	A search term only (a condition, a drug name or a code) — no patient record is sent

Retired routes

Providers we have stopped using. They are listed because a provider that once held data is part of your record even after the route closes, and silence would read as “never used”.

Provider	Former purpose	Retired
Anthropic (direct API)	Clinical reasoning and triage, before the move to Google	2 June 2026 — see the note in the table above
Wispr AI	Audio transcription, superseded by Google Speech-to-Text	8 May 2026
Composio	Third-party tool and OAuth bridge, and a WhatsApp route	24 August 2026 — the five former endpoints now return HTTP 410
Airtable	Support-ticket mirror	Retired; the endpoint is a tombstone and makes no vendor call
Vonage (formerly Nexmo)	Inbound SMS and voice webhooks, and WhatsApp messaging. It was never switched on for a practice: no message or call went through it. Text messages go through Twilio	29 September 2026 — the three former endpoints now return HTTP 410
Google AI Studio / Gemini Developer API	Global (US) transport for Gemini text, Live audio and transcription, before the move to Vertex AI in the EU	7 September 2026, as a transport for practice or patient data: the transport selector now resolves to Vertex AI (EU) unconditionally and every request builder refuses the Developer API. Two caveats, stated so that silence does not read as “gone”. The transcription bundles deployed on 28 August 2026 still carry the previous selector until the next deployment — their request builders already refuse the Developer API, so the path is dead there too. And one use that carries no personal data remains: the marketing blog's hero-image generator still calls the Developer API with a synthetic prompt about the article, on the blog schedule

Changes to this register

This is a working, version-controlled route inventory. Before approval, the controlled production schedule must be reconciled to the release fingerprint and attached to the executed clinic DPA. If you are a Brigid customer and would like to raise a concern about a proposed processor-route change, please email privacy@askbrigid.com. The notice period, objection procedure and any termination right are those in your executed clinic contract and DPA, not this public page.

Sub-Processor Register