The core platform (application, database, imaging archive, viewer, translation, transcription) is self-hosted on infrastructure we manage directly. These are the third parties that receive data in the course of the service.
Last updated: October 16, 2026
| Sub-processor | Purpose | Data disclosed | Location |
|---|---|---|---|
| Contabo | Physical hosting of our dedicated servers | All platform data resides on these servers | USA (primary); EU available |
| RunPod | GPU inference for AI-assisted analysis (when used) | The DICOM study being analyzed; processed in ephemeral workers, not retained after processing | USA |
| WhatsApp (Meta) | Message delivery when a center enables WhatsApp notifications | Phone number and message content (patient name, appointment/study details, secure portal link) | USA (global routing) |
| SMS gateway (per deployment configuration) | SMS message delivery | Phone number and message content | Varies by configured provider |
| Email delivery provider (per deployment configuration) | Transactional email | Recipient address, subject, message content | Varies by configured provider |
| Stripe / PayPal / Flutterwave / Paystack | Online payments and payouts (only where enabled) | Payer/radiologist name, email, amount, reference — no clinical data | USA / Nigeria / Ghana |
| GitHub | Off-site integrity archive of the audit trail | Redacted audit records (identifiers masked); private repository | USA |
The exact SMS and email providers depend on what is configured for each deployment; centers are informed of the providers applicable to them at onboarding.
Before adding or replacing a sub-processor that would process your patient data, we give affected centers notice (target: 30 days). A center may object on reasonable data-protection grounds; if the objection cannot be resolved, the center may terminate the affected service without penalty.
Questions about this list: privacy@clinicalris.com.