Service Providers and Subprocessors
Last Updated: August 8, 2026
This page lists the third parties involved in delivering the Ayadati platform, and the role each one plays. It is referenced by our Privacy Policy and by the Data Processing Agreement we enter into with each clinic.
The distinction matters. A subprocessor is engaged where we are ourselves acting as a processor for a clinic. A processor is engaged where we are the controller. An independent controller decides its own purposes and is not acting on our instructions at all.
1. Subprocessors for clinic and patient data
These process data held in a clinic workspace, on the clinic's instructions passed through us. The Article 28 notice and objection rights below apply to this table.
| Subprocessor | Legal entity | What it processes | Where |
|---|---|---|---|
| Microsoft Azure (compute, Cosmos DB, Blob Storage) | Microsoft Ireland Operations Limited | All platform data, including clinic and patient records, documents and account data | European Union |
| Azure Communication Services | Microsoft Ireland Operations Limited | Video consultation sessions, in-app chat, SMS and WhatsApp messages, and recipient phone numbers | Microsoft EU Data Boundary (EU and EFTA). Messages to recipients outside the boundary are delivered through external carrier networks. |
| Azure OpenAI Service | Microsoft Ireland Operations Limited | Text submitted for optional AI assistance inside a clinic workspace, such as drafting or summarising | Sweden Central, a regional deployment inside the European Union |
| Azure AI Document Intelligence | Microsoft Ireland Operations Limited | Documents uploaded to a patient record, to extract their contents. Microsoft holds submitted documents and results briefly, normally up to 24 hours, to return the result. | Sweden Central, European Union |
| Azure AI Speech | Microsoft Ireland Operations Limited | Dictated audio, where a clinic uses dictation, to produce text | Sweden Central, European Union |
2. Processors and independent controllers for our own data
We are the controller for the data below, so these are not subprocessors of clinic data.
| Provider | Legal entity | Role | What it processes | Where |
|---|---|---|---|---|
| Google Analytics | Google Ireland Limited | Our processor | Public website and booking page usage, only after the visitor consents, and never on the patient portal or clinic dashboard | European Union, with onward transfers to the United States |
| Whish | WHISH MONEY S.A.L. | Independent controller | Payment transactions for subscriptions. Whish determines its own purposes for the payment data it holds, under its own terms and privacy notice. | Lebanon |
Lebanon is not covered by a European Commission adequacy decision. Personal data transferred to WHISH MONEY S.A.L. for payment processing therefore relies on an appropriate Chapter V transfer mechanism, together with a transfer assessment and any additional measures that assessment requires. Clinics can request details at support@ayadati.org.
3. Transfers outside the EU or EEA
Where a provider transfers personal data outside the EU or EEA, the transfer relies on an adequacy decision by the European Commission or on the Commission's Standard Contractual Clauses, together with any additional technical measures the specific transfer requires. Clinics can request the safeguard applicable to a particular transfer by emailing support@ayadati.org.
4. Changes to subprocessors
Before adding or replacing a subprocessor in section 1, we will update this page and notify clinic account holders, so that a clinic has an opportunity to object before the change takes effect.
Questions about this page should go to support@ayadati.org.