Sub-processors of customer personal data
This list reproduces Annex III of our Data Processing Agreement, version 2.5. It identifies the service, processing location and transfer mechanism. Contracting entity confirmations are identified where still pending.
The following Sub-Processors are authorised by the Customer in accordance with Clause 7. CalorieScience will publish the current list on its website and provide it on request.
|
Sub-Processor |
Service |
Processing Location |
Transfer Mechanism |
|---|---|---|---|
|
Amazon Web Services EMEA SARL (AWS) |
Cloud hosting of the production environment: compute (Lambda, API Gateway), storage of uploaded lab reports (S3, KMS-encrypted), content delivery (CloudFront) and logging (CloudWatch) |
Germany (eu-central-1, Frankfurt); CloudFront and WAF operate at AWS's global edge |
AWS Data Processing Addendum with EU SCCs |
|
Amazon Web Services EMEA SARL (Amazon SES) |
Transactional email: sign-in codes, questionnaire reminders and invoice notices to End Clients (End Client name and invoice details; no clinical content) |
Germany (eu-central-1, Frankfurt) |
AWS Data Processing Addendum with EU SCCs |
|
MongoDB Limited (MongoDB Atlas) |
Primary database for End Client records, identity vault, audit records and backups |
Germany (EU_CENTRAL_1, Frankfurt) |
MongoDB Data Processing Agreement (accepted) |
|
Google Cloud EMEA Limited (Vertex AI, Gemini) |
Biomarker extraction from uploaded lab reports: receives the full report file (PDF or image) and extracts values and the End Client's name; caching disabled |
EU, UK and Switzerland: europe-west3 (Frankfurt) in production; configured fallbacks europe-west4, europe-west1, europe-west2 (London) and europe-west6 (Zurich) |
Google Cloud Data Processing Addendum (accepted) |
|
OpenAI (contracting entity confirmation pending) |
AI meal-plan and recipe generation, recipe and ingredient tag classification, and the Practitioner-facing cohort intake chat. Receives only pseudonymised, allow-listed planning data (for example nutrition targets, allergies, medical-condition names, age, BMI); never names, contact details, dates of birth, record identifiers, lab values or client free text. Requests are sent with store: false and are not used for model training. |
United States |
EU SCCs and UK Addendum in OpenAI's Data Processing Addendum, signed under OpenAI's enterprise terms; zero data retention applies |
|
Google (Firebase Cloud Messaging) (contracting entity confirmation pending) |
Push notifications to Practitioner and End Client devices; invoice-event payloads carry invoice number, counterpart name and amount; no clinical content |
Google's global infrastructure, including the United States |
Google's data processing terms for Firebase, with standard contractual clauses or the EU-US Data Privacy Framework |
|
Google (Google Workspace: Calendar and Meet) (contracting entity confirmation pending) |
Appointment sync: a CalorieScience service account creates calendar events whose title or attendees may include the End Client's name and email; Google Meet for video consultations |
Google's global infrastructure, including the United States |
Google Workspace data processing terms (accepted), with standard contractual clauses or the EU-US Data Privacy Framework |
|
CS India (CalorieScience Healthtech Private Limited) |
Engineering and support: access to the production environment by named operators under the controls in clause 8.4 |
India (remote access to data hosted in Frankfurt) |
Intercompany agreement with EU SCCs Module 3 and UK Addendum, signed; Transfer Impact Assessment available on request |
Tools used only for CalorieScience's internal operations that do not process Customer Personal Data are not listed above. Whether Read.ai or any similar meeting tool is used, and remains strictly internal, is to be confirmed.
Not Sub-Processors of Customer Personal Data: Stripe (Practitioner subscription billing only; no End Client data); Google Analytics 4, Google Tag Manager, Microsoft Clarity, Google Ads, Meta Pixel and LinkedIn Insight (website analytics and advertising after consent); Mixpanel (product analytics on Practitioner accounts); Zoho CRM and Zigment.ai (planned for Practitioner leads; not yet integrated); Slack (internal alerts with no End Client data); and Spoonacular (recipe lookups, no personal data). CalorieScience uses these as an independent controller, or they receive no personal data, and they are described in the Website Privacy Notice and the Platform Privacy Notice .
Analytics currently also run on logged-in Practitioner pages after consent, and Microsoft Clarity session replay or Mixpanel could capture End Client data on screen. CalorieScience will restrict analytics to marketing pages or apply strict masking. Client packages sold by Practitioners with payment through Stripe are planned, not live, and will be assessed before launch.
CalorieScience will notify Customers of additions or replacements of Sub-Processors in accordance with clause 7.2: at least 7 days' prior written notice by email and on the published list, or at least 72 hours' notice for urgent security, availability, regulatory or business-continuity changes. A new Sub-Processor does not process Customer Personal Data before the notice period ends, and Customers may object on reasonable data-protection grounds within the notice period.