Subprocessors
Version 2026-08-11 - maintained by Karri AB, org. no. 559250-7700
The following subprocessors process personal data on behalf of customer organisations using WorkMyHealth. We notify customers at least 30 days before adding or replacing a subprocessor, and customers may object on reasonable data-protection grounds. This page forms Annex 4 to the data processing agreement.
| Subprocessor | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Lovable Cloud managed database, authentication and file storage (Supabase technology on Amazon Web Services) | Hosting of the application database, user authentication and uploaded images | Account data, activity and training data, photos, audit logs | AWS eu-central-1 (Frankfurt, Germany) | Production data is stored in the EU. Support, operations or diagnostic access from outside the EU cannot be ruled out and is covered by EU standard contractual clauses. |
| Cloudflare (application hosting and CDN) | Serving the web application, edge runtime for server functions, DDoS protection | Request metadata, IP address, session tokens in transit | Global edge network; the closest edge location handles the request, which may be outside the EU | EU standard contractual clauses |
| Lovable (platform operations) | Build, deployment and operation of the application, delivery of transactional and authentication email, and routing of AI requests through the platform AI gateway | Deployment metadata, email recipient address and message content, text submitted to AI features | EU and US. The platform may use further providers of its own for email delivery and model hosting; we do not control that chain and describe it here as operated by the platform. | EU standard contractual clauses |
| Stripe Payments Europe, Ltd. | Subscription payments and invoicing for paid plans | Billing contact, company name, payment metadata (no card data reaches WorkMyHealth) | EU (Ireland), with group transfers | EU standard contractual clauses |
| Google (Gemini models, reached through the platform AI gateway) | Generation and translation of knowledge-centre content and editorial suggestions | Only the text submitted to the AI feature by an administrator or editor. Member identities, activity entries and health-related values are not sent | EU and US, determined by the platform gateway rather than by us | EU standard contractual clauses via the platform |
To request notification of changes, or the underlying data-processing terms of a specific subprocessor, contact info@upzdownz.com.