Sub-processor List
Last updated: draft, 20 October 2026
What this list is
Clinicians use The Exercise Database to hold their patients' information. For that information, the clinician is the controller and we are their processor. A sub-processor is a company we use to provide the service that also handles patients' information.
This page lists every one of them. Each is bound by a contract to use the data only to provide its service to us, and to keep it secure.
Sub-processors
| Company | What it does | Where the data is | Patient data it handles |
|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database and sign-in | Frankfurt, Germany | Everything recorded about a patient |
| Vercel Inc. (United States) | Runs the website and the service | Frankfurt, Germany | Everything, while it is being processed |
| Plus Five Five, Inc., trading as Resend (United States) | Sends patient portal emails | United States | Patient's first name, email address and patient portal link |
| Google LLC (United States) | Stores our backups | Google's data centres | Encrypted backups only. Google cannot read them, because the key is never given to it |
How data leaving the UK is protected
| Company | Protection |
|---|---|
| Supabase | Data stays in Germany, which UK law treats as giving equal protection. Access from outside it is covered by the UK's approved data transfer clauses in Supabase's contract |
| Vercel | Data is processed in Germany. Access from outside it is covered by the UK's approved data transfer clauses in Vercel's contract, and Vercel is certified under the UK–US data bridge |
| Resend | The UK's approved data transfer clauses in Resend's contract, and Resend is certified under the UK–US data bridge |
| The backups are encrypted before they leave our systems, and the key is kept only by us |
What is not on this list, and why
- Vercel Web Analytics, which counts page views. It receives no patient data: identifying parts of page addresses are removed before anything is sent
- YouTube, which hosts exercise videos. We send it no patient data. A patient's own browser loads video previews from it, as the patient notice explains
- Stripe, for payments, when we start taking them. It will only handle clinicians' billing details, never patients'
Changes to this list
We will email every clinician at least 30 days before adding or replacing a sub-processor, saying who it is, what it will do and where. A clinician who objects can tell us within that time. If we cannot address the objection, they can leave the service and take their patients' records with them before the change takes effect.