Section 8(2) · Section 16
Processors and transfers
Processors are companies that process personal data for us, only on our instructions. This page lists the ones our service uses, what they do, and where they process data.
Last updated: 28 October 2026
Our processors
| Processor | What it does for us | Processing region | Status |
|---|---|---|---|
| Supabase | Database, authentication and file storage for the whole service | Not yet recorded | Agreement and region pending |
| Amazon Web Services | Backend application hosting | ap-south-1 (Mumbai), per deployment configuration | Agreement and region pending |
| Railway | Application hosting (alternative deployment) | Not yet recorded | Agreement and region pending |
| Vercel | Web application hosting | Not yet recorded | Agreement and region pending |
| Cloudflare | Network edge, TLS termination and protection | Not yet recorded | Agreement and region pending |
| Google (Gemini) | AI drafting and clinical decision support for clinicians (drafts only) | Not yet recorded | Agreement and region pending |
| Google (Firebase Cloud Messaging) | Push notification delivery | Not yet recorded | Agreement and region pending |
| Razorpay | Payment processing | Not yet recorded | Agreement and region pending |
| SMS relay | Delivery of verification and approved notice SMS | Not yet recorded | Agreement and region pending |
| OpenStreetMap (Nominatim) | Address lookup from location | Not yet recorded | Agreement and region pending |
| Have I Been Pwned | Checking passwords against breached-password lists (k-anonymity hash prefix only) | Not yet recorded | Agreement and region pending |
| ABDM gateway (National Health Authority) | ABHA creation, verification, record linking and consent-based sharing | India | Agreement and region pending |
| Amazon SES (email) | Email delivery of approved incident notices and generic incident alerts | ap-south-1 (Mumbai), per deployment configuration | Agreement and region pending |
| Google Fonts | Font files downloaded by the patient and doctor apps | Not yet recorded | Agreement and region pending |
Built-in list of the services our code integrates with. Regions and agreements will be shown here once they are recorded in our processor register.
Who else receives your data
- Doctors, labs, pharmacies and hospitals that you choose or that treat you, within the consent and care relationships described on the consent page.
- The Ayushman Bharat Digital Mission (National Health Authority), when you link ABHA or share records through it.
- Your data download from the Privacy Centre lists every recipient of your data, including these processors.
Transfers outside India
Our database runs in AWS's Mumbai region (ap-south-1) and our backend is hosted in the same region. Some providers may process data outside India. In particular, the AI service we use (Google Gemini) currently runs on Google's global service, which can process data outside India; moving it to Google's Mumbai region is planned. Location lookups go to OpenStreetMap servers outside India, with rounded coordinates only and no account details.
The Act allows transfer outside India except to countries the Government restricts by notification. We will not transfer personal data to a restricted country.