Sub-processors

Operating the NPG Puls platform — application logic, integrations, and data processing on behalf of NPG.

Country

USA (Florida)

Data location

USA (contractual counterparty) + EU (primary storage at Supabase in Stockholm).

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-23

Primary sub-processor. SCCs Module 3 (Processor→Sub-processor) is signed between NPG and VS-LLC in a separate sub-processor agreement. TIA in the DPA's Annex D.

Primary application database (PostgreSQL) incl. authentication and auto-backup.

Country

USA (contractual counterparty)

Data location

Stockholm, Sweden (eu-north-1).

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-21

Data is stored physically in the EU; contractual counterparty is US-based, hence SCCs as transfer basis.

Application hosting (Next.js). EU edge regions preferred.

Country

USA

Data location

EU edge regions preferred; control plane in the USA.

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-21

File storage — clinic logos and any patient-data exports for DSARs.

Country

USA

Data location

EU regions.

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-22

Transactional email — delivery of NPS invitations (and later clinic-staff authentication emails) from the NPG Puls database to recipients' inboxes. Canonical storage remains in the NPG Puls database; Postmark receives only render-ready HTML/text plus recipient data at send time.

Country

USA

Data location

USA (Chicago + AWS US).

Transfer basis

SCCs + EU-US DPF

Engaged since

2026-05-04

Transactional email delivery for all patient surveys + clinic-owner invitations. Stream separation enforced: NPS invitations on the 'transactional' message stream; broadcast stream reserved for any future clinic-staff product notifications. No marketing email is sent via Postmark. DKIM + Return-Path verified on nordicpatientgroup.dk.

AI inference for feedback insights, reply drafts to reviews and comments, posts based on reviews, follow-up drafts to patients, and improving reply drafts for each clinic or chain. From patient data the model receives feedback text and NPS score, for a follow-up draft also the patient's first name, but never e-mail, phone number or surname; from public reviews it receives the reviewer's public name, rating and text, and from comments the comment text, or for a comment that is only a sticker or GIF, the image. For a reply draft it also receives the clinic staff's note and the clinic's wishes, and for the improvement earlier drafts, published replies and notes, with the reviewer's name and recognised treatment words hidden.

Country

USA

Data location

USA (model-provider dependent).

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-17

Not trained on our prompts (zero-data-retention configured at OpenRouter). Data minimisation: of a patient at most the first name is passed along, never e-mail, phone number or surname.

Collection of publicly available Google reviews for clinic visibility analytics.

Country

EU/EEA

Data location

EU and USA (AWS).

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-15

Processes only publicly available reviews. NPG acts as Controller (not Processor) for visibility data — this service therefore does NOT appear in the clinic DPA's Annex B, but in NPG's privacy policy.

Clinic website scraping as part of the partner create-clinic wizard (slice #47). Public clinic URL → Markdown content → discarded after extraction. No patient PII.

Country

USA

Data location

USA (AWS us-east-1).

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-05-05

Firecrawl logs request URLs in their service for billing; we don't pass them PII. Scraping is limited to publicly accessible clinic websites.

The booking form behind the "Book Demo" button on the front page. The form and its script load only when the button is pressed, and HighLevel receives only what the visitor types into the form: name, e-mail, phone number, preferred time and any message. No patient data.

Country

USA

Data location

USA

Transfer basis

SCCs + EU-US DPF

Engaged since

2026-06-09

Used only to schedule demo meetings with interested clinics. Processes no patient data and therefore does not appear in the clinic DPA's Annex B, but in NPG's privacy policy (section 4).