Sub-processors

Operating the NPG Pulse platform — application logic, integrations, and data processing on behalf of NPG.

Country

USA (Florida)

Data location

USA (contractual counterparty) + EU (primary storage at Supabase in Stockholm).

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-23

Primary sub-processor. SCCs Module 3 (Processor→Sub-processor) is signed between NPG and VS-LLC in a separate sub-processor agreement. TIA in the DPA's Annex D.

Primary application database (PostgreSQL) incl. authentication and auto-backup.

Country

USA (contractual counterparty)

Data location

Stockholm, Sweden (eu-north-1).

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-21

Data is stored physically in the EU; contractual counterparty is US-based, hence SCCs as transfer basis.

Application hosting (Next.js). EU edge regions preferred.

Country

USA

Data location

EU edge regions preferred; control plane in the USA.

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-21

File storage — clinic logos and any patient-data exports for DSARs.

Country

USA

Data location

EU regions.

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-22

Transactional email — delivery of NPS invitations (and later clinic-staff authentication emails) from the NPG Pulse database to recipients' inboxes. Canonical storage remains in the NPG Pulse database; Postmark receives only render-ready HTML/text plus recipient data at send time.

Country

USA

Data location

USA (Chicago + AWS US).

Transfer basis

SCCs + EU-US DPF

Engaged since

2026-05-04

Transactional email delivery for all patient surveys + clinic-owner invitations. Stream separation enforced: NPS invitations on the 'transactional' message stream; broadcast stream reserved for any future clinic-staff product notifications. No marketing email is sent via Postmark. DKIM + Return-Path verified on vekst.dk.

AI inference for clinic-aggregated feedback insights. The model receives feedback text but not direct patient identifiers (email / name).

Country

USA

Data location

USA (model-provider dependent).

Transfer basis

SCCs (EU Standard Contractual Clauses)

Engaged since

2026-04-17

Not trained on our prompts (zero-data-retention configured at OpenRouter). Pseudonymisation: identifiers are removed before text is sent to the model.

Collection of publicly available Google and Facebook reviews for clinic visibility analytics.

Country

EU/EEA

Data location

EU

Transfer basis

Intra-EEA (no specific transfer mechanism required)

Engaged since

2026-04-15

Processes only publicly available reviews. NPG acts as Controller (not Processor) for visibility data — this service therefore does NOT appear in the clinic DPA's Annex B, but in NPG's privacy policy.