Sub-processors
These are the third parties that can access data processed through Seneca on a clinic's behalf. Schedule 3 of the processing agreement each clinic accepts before opening a case treats this page as the authoritative list, and clinics can download that agreement from inside the app at any time. We give 30 days' notice before adding or replacing anyone here, and a clinic can object. See also our privacy notice.
Sub-processors of clinical data
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Supabase | Database, authentication, file storage, and transactional account email | All Controller personal data at restFor the life of the data we store there; deletion is ours to trigger. When the Supabase agreement ends we have thirty days to ask for a copy, and once that window closes Supabase deletes every copy it holds. Supabase keeps its own platform logs for one day on the Free plan, which is the plan this project was on when the account was last read. | Ireland (eu-west-1) |
| Vercel | Application hosting and compute | Controller personal data in transit during a requestController personal data in transit only; none of it at rest. Seneca's own server logs are held to the same line: no client name, case detail or document content is written into Vercel's runtime logs. Visit counting on the public marketing pages is separate, holds no Controller personal data, and is listed under controller-side processors below. Vercel keeps runtime logs of requests for one day on the plan this account is on. When the agreement ends Vercel deletes all customer data within a commercially reasonable time; it states no fixed number of days. | Dublin (dub1) |
| Anthropic | Automated drafting of report sections | The minimum extract of clinical data needed to draft the requested sectionAPI inputs and outputs retained by Anthropic for 30 days, then deleted. Not used to train models: Anthropic's Commercial Terms state they may not train on customer inputs or outputs. Anthropic's published exception is content a customer voluntarily submits as feedback, which Seneca does not do and cannot do from the API. Content flagged by trust-and-safety systems may be kept up to 2 years. | United States |
| Brevo | Transactional email — sign-in codes, password resets, invitations and account notices | Clinician name and email address. Never clinical content.Managing how long the data we send is kept is our job, not Brevo's (Appendix 3, cl. 4.3). If our contract with Brevo ends, Brevo destroys the data within three months of us asking, and confirms it in writing if we ask (cl. 5.3, Brevo Terms of Service dated 1 October 2025). | European Union (France) |
| OpenAI | Transcription of assessment session audio, where session recording is used | Session audio, and the transcript returned. On live transcription the audio streams from the clinician's browser directly to OpenAI and does not pass through Seneca's own servers at all.Not used for training. Live transcription (the realtime endpoint) retains audio for 30 days for abuse monitoring and nothing for application state. Uploaded and non-live audio (the file transcription endpoint) retains neither audio nor transcript. EU-region processing available only on OpenAI approval. | United States (contracting entity: OpenAI Ireland Ltd) |
Where a provider is marked approved, not yet in use, it is listed here in advance and receives nothing until the service is switched on. We list them early so that turning one on is not a change a clinic has to be notified about after the fact.
Our own service providers
These process data about the clinician's own account, where we are the controller rather than a processor. They never receive clinical data, which is why they are not in the processing agreement's schedule.
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Vercel Web Analytics | Counting page views on the public marketing site | Page address, referrer, country/region/city, browser, OS and device type for visits to public pages. Never clinical data, and never a page behind the login. | United States (Vercel Inc.) |
| Stripe | Payment processing and subscription billing | Clinician name, email and payment identifiers. Never clinical data. | Ireland / United States |
Transfers outside the EU
Clinical records are stored and served in Ireland. Two of the sub-processors above are in the United States, because the drafting and transcription happen there. Those transfers rely on a European Commission adequacy decision where one covers the recipient, and otherwise on the standard contractual clauses with a transfer impact assessment, which we will send to any clinic that asks.
We do not permit any sub-processor to use a clinic's data for its own purposes, and specifically not to train, fine-tune or evaluate any machine learning model. That is clause 4(b) of the processing agreement, and it binds us to obtain the same commitment from every sub-processor before their service touches a clinic's data.
Last updated 2026-09-02. Questions: hello@senecadocs.com.