Sub-processors
Last updated: May 2026
GDPR Article 28 requires us to list every sub-processor that handles personal data on Thea Klara's behalf. This page is the full list, with the role of each provider, what data they receive, and the region in which the processing takes place.
Six sub-processors are part of the service. Only two — Supabase and Vercel — handle health data (GDPR Article 9). The others see only IP addresses, or handle payments and email without symptom content.
Role
Database, authentication, and row-level security (RLS)
Region
EU — Frankfurt
What they receive
Email, password hash, user ID, symptom responses (health data), session tokens, doctor directory entries
Health data (Article 9)
Yes
Data Processing Agreement
Role
Hosting the Next.js app, serverless functions (including PDF generation), scheduled deletion jobs
Region
EU-region
What they receive
All request and response traffic. PDFs are streamed in memory and are never written to disk.
Health data (Article 9)
Yes
Data Processing Agreement
Role
Card and Swish payment processing, webhook delivery, subscription billing for membership
Region
EU — Irland
What they receive
Card details (Stripe handles the card — we never see it), email, billing address, transaction records
Health data (Article 9)
No
Data Processing Agreement
Role
Transactional email — PDF download links, account emails, payment confirmations
Region
EU
What they receive
Email address, subject line, email body. No symptom data or health information is ever included in the email itself.
Health data (Article 9)
Conditional — see note
Data Processing Agreement
Role
Bot mitigation (Turnstile) on the PDF endpoint. Verifies that requests come from human users.
Region
EU edge
What they receive
IP address, user-agent, browser signals collected by Turnstile. Cloudflare never sees survey content.
Health data (Article 9)
No
Data Processing Agreement
Role
Serverless Redis used as the rate-limit store for the PDF endpoint
Region
EU
What they receive
IP address only (rate-limit key + counter + TTL). Upstash never sees survey content.
Health data (Article 9)
No
Data Processing Agreement
Related
For details on how your rights, retention, and consent work — see our privacy policy.
This page is updated whenever we add, change, or remove a sub-processor. We notify registered users by email at least 14 days before a new sub-processor begins processing data.