Subprocessor and service-provider list
About this document
| Field | Value |
|---|---|
| Version | 1.2 |
| Effective date | 1 September 2026 |
| Publication date | 1 September 2026 |
| Last reviewed | 26 August 2026 |
| Status | Approved public document |
Version history
| Version | Effective date | Change summary | How this version applies |
|---|---|---|---|
1.2 | 1 September 2026 | Changed the email and mobile push provider to Customer.io, and added routine personnel remote-access countries | The provider change takes effect after the Institution notice period. Later routine personnel-location changes follow the applicable Institution agreement |
1.1 | 12 August 2026 | Plain-language copy edit | No provider or processing change; Institution notice and objection terms remain unchanged |
1.0 | 1 August 2026 | Initial public version | Available publicly; Institution Customers receive notice and authorise changes as provided by their applicable DPA |
1. How to read this list
A subprocessor follows Alessia's instructions when it processes personal information to provide part of the Service. Some payment providers and app stores instead act as independent controllers for their own transaction, fraud, store-account or legal purposes. A provider's inclusion in this list does not mean that every customer uses every optional feature.
This is Alessia's authoritative public register of routine technology providers that process personal information. It also records the countries from which Authorised Alessia Personnel may routinely access Institution Customer Personal Data. The personnel section is separate from the provider register because those people act under Alessia's direct authority and are not subprocessors. Other public policies describe providers by function and link here for their current identities and material processing facts.
A service that handles only Alessia-authored static content and does not receive personal information is not listed as a subprocessor. Professional advisers, courts, regulators and law-enforcement bodies are not routine technology providers and are described by category in the Privacy Notice.
2. Alessia personnel remote-access locations
"Authorised Alessia Personnel" means Alessia's directors, employees and individual contractors who act under Alessia's direct authority in a role comparable to an employee, are bound by written confidentiality, security and data-protection obligations, and process Institution Customer Personal Data only through Alessia-controlled accounts and systems and in accordance with Alessia's instructions. It does not include a contractor business, affiliate or other separate organisation providing an independently managed service.
The following countries are approved for routine access by Authorised Alessia Personnel where the applicable Institution agreement permits that access:
| Country | Usual purpose | Safeguards and transfer position |
|---|---|---|
| United Kingdom | Contract administration, privacy, security, development and support | Access is limited to what the work requires. Transfers from the EEA may rely on the European Commission's UK adequacy decision while it remains valid |
| Australia | Development, support, security and incident response | Access is subject to a documented privacy and security assessment and the controls described below |
| New Zealand | Development, support, security and incident response | Access is limited to what the work requires. Transfers from the EEA may rely on New Zealand's adequacy decision while it remains valid |
Remote access must be approved, encrypted in transit, limited by least privilege to the time and information needed, and appropriately logged. Institution Customer Personal Data must not be stored on the remote endpoint. A remote-access location does not change the hosting or data-residency region agreed with an Institution.
Alessia may add a routine country after documenting why access is needed, assessing the privacy and security risks and putting appropriate safeguards in place. Alessia will give an Institution Customer at least 30 days' notice before routine access begins from a new country where its agreement provides for that notice. The Institution may object during that period on reasonable data-protection grounds under its Data Processing Addendum.
A country does not need to be added to this list when an Authorised Alessia Personnel member is there temporarily for fewer than eight consecutive weeks and it is not their regular or recurring working location. Alessia must approve the access in advance and apply the safeguards above. If the country becomes a regular or recurring working location, Alessia will add it to this list and follow the applicable notice process.
3. Subprocessors
| Provider and legal entity | Purpose | Personal information | Processing and storage locations | Transfer safeguards | Retention and material terms | Optional? |
|---|---|---|---|---|---|---|
| Microsoft Azure - Microsoft Ireland Operations Limited (MIOL) | Cloud hosting, database, object storage, networking, backup and infrastructure | Account holders, Institution contacts, supervisors and assessors; account, authentication, portfolio and other content stored for the Service; prohibited information only if submitted contrary to policy | Primary application databases and object storage are hosted in UK South, or another Azure region agreed with an Institution. Microsoft personnel and approved subprocessors may have restricted, logged access from other countries where necessary for support, security and service operations | Microsoft Customer Agreement and the applicable Microsoft Products and Services Data Protection Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, together with applicable adequacy arrangements | Microsoft product terms and Alessia's configured retention; consumer rolling backups up to 35 days and Institution backup periods as stated in the applicable Order Document, subject to mandatory deletion law | No |
| Webflow, Inc., 398 11th Street, Floor 2, San Francisco, California 94103, USA | Hosting and delivery of the Alessia marketing website | Website connection and interaction information, including IP address, browser and operating-system details, and content Alessia publishes through Webflow. Contact-form content is forwarded directly to Alessia by email and is not retained as a stored Webflow form submission | Webflow stores Customer and End User information in the USA and uses subprocessors in the USA and other locations identified on its current subprocessor list | Webflow's DPA, including the EU Standard Contractual Clauses, UK International Data Transfer Addendum and applicable Data Privacy Framework participation | Customer Personal Information is retained during Alessia's agreement with Webflow and deleted after termination unless applicable law prevents deletion. Technical request and security information follows Webflow's applicable service practices | No for visitors to the marketing website |
| Logto Cloud - Silverhand Inc., 2810 North Church Street, Wilmington, Delaware 19802, USA | Identity, authentication, credential and session management, token issuance and access logging | Email; name and avatar where supplied by a connected sign-in provider; Logto subject identifier, authentication events, IP/device/access records and token metadata | Alessia's EU tenant is hosted through Microsoft Azure in the selected EU region. Cloudflare provides global edge delivery and network protection and receives limited metadata such as IP addresses and request headers | EU Standard Contractual Clauses and the UK International Data Transfer Addendum under Logto's DPA | Authentication and access logs are retained for 14 days. Production identity records are retained while the account remains active unless removed. On termination, customer data is deleted or returned under Logto's DPA unless retention is legally required | No |
| PostHog Inc., 2261 Market Street #4008, San Francisco, California 94114, USA | Product onboarding, marketing measurement, product analytics, diagnostics and feature usage | Email, optional name, account/device identifiers and allowlisted usage or interaction events. Clinical, portfolio and AI content is excluded. Raw IP addresses are configured not to be retained; geolocation enrichment and session replay are disabled | PostHog Cloud EU stores analytics data in Frankfurt, Germany. Authorised personnel and subprocessors may access or process it from other countries where necessary to provide, secure and support the service under PostHog's DPA | EU Standard Contractual Clauses and the UK International Data Transfer Addendum under PostHog's DPA | Identifiable event and profile data is retained for no more than 365 days. Deletion is processed asynchronously. Product and Model Development use is disabled | Partly - marketing-site analytics requires consent; app analytics follows the consent or opt-out control applicable to the user |
| Customer.io - Peaberry Software, Inc. d/b/a Customer.io, 9450 SW Gemini Dr., Suite 43920, Beaverton, Oregon 97008-7105, USA | Transactional account, security, legal, billing and support email; optional onboarding and marketing email; registration and delivery of generic mobile push notifications | Recipient email, optional name, Alessia member public ID, Customer.io profile identifier, device or push token, platform, last-used and delivery status, minimum message content, subject, delivery, bounce, complaint and permitted marketing-click information. Clinical, patient, portfolio and AI content is excluded | Customer.io stores profile data in the region selected for Alessia's account, either its EU region based in Belgium or its US region. Customer.io and its authorised infrastructure and communications subprocessors may process in the EU and USA. Apple and Google also process device push delivery through their platform services | Customer.io's DPA, including the EU Standard Contractual Clauses and UK International Data Transfer Addendum, together with applicable EU-US Data Privacy Framework and UK Extension participation | Customer.io retains profile data for the agreement term unless Alessia deletes it sooner. Alessia deletes profiles and device tokens under the Retention Schedule and valid deletion instructions. Before processing begins, Alessia will disable open tracking, transactional link tracking, optional Customer.io AI and unapproved data integrations. Marketing links will be tracked only where permitted and disclosed. Alessia will not use the mobile SDK for in-app messages, location, screen or lifecycle tracking, or custom product events | Partly - essential service email is required; marketing email, permitted marketing-link measurement and mobile push notifications are optional |
| RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, Florida 33511, USA | Subscription and purchase-status processing, app-store and direct-web entitlement management, and subscription-management links | Alessia member/app-user identifier; product, entitlement, store, transaction and subscription identifiers; dates, price, currency, country, trial, renewal and environment data; and limited device/app technical information. Alessia does not set email or profile attributes for Apple or Google subscription tracking. Email is provided only where needed for direct-web checkout, receipts or subscription servicing. Portfolio, clinical and AI content is excluded | RevenueCat is based in the USA and its current hosting, database, monitoring, analytics and content-delivery subprocessors for this service are listed in the USA | RevenueCat's DPA, including the EU Standard Contractual Clauses and UK International Data Transfer Addendum | Subscriber records are retained while needed to manage the subscription. Following an Alessia account-deletion request, Alessia cancels direct-web renewal where it controls the subscription and invokes RevenueCat customer deletion within three days; RevenueCat states that customer deletion clears the profile and purchase history. Deleting the RevenueCat record does not itself cancel Apple, Google or Stripe-managed subscriptions, which must follow their separate cancellation route. Provider backup, archive and legal-retention exceptions may apply under the DPA. Optional advertising, attribution, analytics and data-export integrations are not used | Yes - applicable only to consumer subscriptions |
| Anthropic - Anthropic Ireland, Limited | Optional AI-assisted summaries and competency suggestions | Content selected by the user for the request, such as text, notes or a transcript; request instructions; and generated output. Patient personal data is prohibited | Customer data is stored in the USA and may be processed in selected locations in the USA, Europe, Asia and Australia | Anthropic's DPA, incorporated into its Commercial Terms, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum | Standard API inputs and outputs are deleted within 30 days. Material flagged for Usage Policy enforcement may be retained for up to two years, and associated safety-classification scores for up to seven years. Longer retention may apply where legally required. Anthropic does not use API customer content to train its models | Yes - only when the user invokes an applicable AI-assisted feature |
| AssemblyAI - AssemblyAI Inc. | Optional audio transcription | Audio selected by the user, the secure audio-file URL, transcription settings and prompts, and the resulting transcript and timing/confidence data. Patient personal data is prohibited | Audio and transcription artifacts are submitted to AssemblyAI's EU server endpoint. AssemblyAI is a US provider, and account, usage and operational information may be processed in the USA or other authorised provider locations under its DPA | AssemblyAI's DPA, including the EU Standard Contractual Clauses and UK International Data Transfer Addendum | Alessia instructs AssemblyAI to delete the transcript and linked provider artifacts immediately after Alessia successfully retrieves the result. A one-hour provider time-to-live is configured as a backstop. Provider-side deletion processing may not complete instantly, and limited metadata may remain for logging and billing or where legally required. Files submitted through the EU server or under Alessia's training opt-out are not used for model training | Yes - only when the user requests transcription |
4. Independent controllers and distribution providers
These organisations may act as independent controllers for some or all of their activities. Their own privacy notices and user or store agreements also apply.
| Provider and legal entity | Role and purpose | Information Alessia receives | Optional or applicable channel |
|---|---|---|---|
| Apple App Store - Apple Inc.; Apple Canada Inc.; Apple Services LATAM LLC; Apple Services Pte. Ltd.; iTunes K.K.; Apple Pty Limited; or Apple Distribution International Ltd., according to the user's Home Country | Apple operates the App Store and independently determines how it processes Apple Account, store-payment, subscription, refund, fraud, tax and legal-compliance information. Apple may act as agent or merchant of record under the store terms while Alessia remains responsible for the app and Service | Product and entitlement, transaction/receipt and subscription identifiers and status, price/currency/country and refund or renewal status. Alessia does not receive the user's full store-payment details | Apple App Store purchases and subscriptions only |
| Google Play - Google LLC; Google Ireland Limited; Google Commerce Limited; Google Digital Inc.; and the applicable Google Payments entity, according to the user's country and purchase terms | Google operates Google Play and independently determines how it processes Google Account, store-payment, subscription, refund, fraud, tax and legal-compliance information. The applicable Google entity may sell or act as agent for content under the regional store terms while Alessia remains responsible for the app and Service | Product and entitlement, transaction/order and subscription identifiers and status, price/currency/country and refund or renewal status. Alessia does not receive the user's full store-payment details | Google Play purchases and subscriptions only |
| Stripe Managed Payments - Sold through Link, LLC, with other applicable Stripe group entities | Merchant of record for eligible direct-web transactions and provider of checkout, payment, receipt, transaction-tax, fraud, dispute, refund and order/subscription-management functions. Alessia remains the seller and provider of the Service. Stripe acts as a processor for activities performed only on Alessia's instructions and as an independent controller where it determines its own compliance, fraud, tax, Link/account or service purposes | Purchaser email where required; product, order, transaction and subscription identifiers and status; price, currency, country, tax, refund and dispute information. Alessia does not receive full card details | Eligible direct-web purchases only; the checkout identifies the applicable merchant and terms |
5. Provider and personnel-location changes
Alessia will update this list when a provider is added, replaced or materially changes its role. Where a change materially affects how personal information is used, an individual's rights or a consent choice, Alessia will provide any additional notice or obtain any new consent required by law.
Institution customers authorise subprocessors under their Data Processing Addendum. Alessia will send formal notice by email to the Institution's nominated privacy and contract contacts at least 30 days before a non-urgent new or replacement subprocessor begins processing Customer Personal Data. An urgent security or continuity replacement will be notified by email as soon as reasonably possible, with an explanation. Institution objections follow the Data Processing Addendum.
Alessia will also update the personnel section before routine access begins from a new country, subject to the notice process in section 2.
Individual users can review the current position on this page at any time. The version history and the change line below record changes since publication. We announce a change through the Service or by email if this section requires notice or consent.
Version 1.2 uses Customer.io for email and mobile push notifications from 1 September 2026. Customer.io will not process Institution Customer Personal Data before that date or before the applicable 30-day notice period has ended, whichever is later.
6. Contact
Questions about this list, a personnel location or an Institution subprocessor objection may be sent to privacy@alessiahq.com.