Sub-processors
These are the third parties that can access data processed through Seneca on a clinic's behalf. Schedule 3 of the processing agreement each clinic accepts before opening a case treats this page as the authoritative list, and clinics can download that agreement from inside the app at any time. We give 30 days' notice before adding or replacing anyone here, and a clinic can object. See also our privacy notice.
Sub-processors of clinical data
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Supabase | Database, authentication, file storage, and transactional account email | All Controller personal data at restFor the life of the data we store there; deletion is ours to trigger. When the Supabase agreement ends we have thirty days to ask for a copy, and once that window closes Supabase deletes every copy it holds. Supabase takes a daily backup of the database and keeps each for no more than 8 days, and keeps its own platform logs for 7 days, on the Pro plan this account has been on since 2026-10-10. | Ireland (eu-west-1) |
| Vercel | Application hosting and compute | Controller personal data in transit during a requestController personal data in transit only; none of it at rest. Seneca's own server logs are held to the same line: no client name, case detail or document content is written into Vercel's runtime logs. Visit counting on the public marketing pages is separate, holds no Controller personal data, and is listed under controller-side processors below. Vercel keeps runtime logs of requests for one day on the plan this account is on. When the agreement ends Vercel deletes all customer data within a commercially reasonable time; it states no fixed number of days. | Dublin (dub1) |
| Anthropic | Automated drafting of report sections, and reading the content of uploaded documents | For drafting, the case record. The assessed person's name and date of birth are replaced by placeholders; other names in the record are sent as written — the assessing clinicians, the GP, the school and teachers, parents, and any name in a transcript, note, form or document. For reading or extracting an uploaded document, that document as uploaded, including any names in it. For session summaries, the transcript, with the assessed person's name replaced.API inputs and outputs retained by Anthropic for 30 days, then deleted. Not used to train models: Anthropic's Commercial Terms state they may not train on customer inputs or outputs. Anthropic's published exception is content a customer voluntarily submits as feedback, which Seneca does not do and cannot do from the API. Content flagged by trust-and-safety systems may be kept up to 2 years. | United States (contracting entity: Anthropic Ireland, Limited) |
| Brevo | Transactional email — sign-in codes, password resets, invitations and account notices | Clinician name and email address. Never clinical content.Managing how long the data we send is kept is our job, not Brevo's (Appendix 3, cl. 4.3). If our contract with Brevo ends, Brevo destroys the data within three months of us asking, and confirms it in writing if we ask (cl. 5.3, Brevo Terms of Service dated 1 October 2025). | European Union — France and Belgium (hosting), with Brevo group support access from Germany, France and Belgium. Brevo's own content-delivery and support providers (Cloudflare, Zendesk) hold United States server locations, and Brevo group companies in the United States and India hold support access. Every non-EU element is covered by the EU-US Data Privacy Framework and/or standard contractual clauses. |
| OpenAI | Transcription of assessment session audio, where session recording is used | Session audio, and the transcript returned. On live transcription the audio streams from the clinician's browser directly to OpenAI and does not pass through Seneca's own servers at all.Not used for training. Live transcription (the realtime endpoint) retains audio for 30 days for abuse monitoring and nothing for application state. Uploaded and non-live audio (the file transcription endpoint) retains neither audio nor transcript. EU-region processing available only on OpenAI approval. | United States (contracting entity: OpenAI Ireland Ltd; a UK clinic's data goes to OpenAI OpCo, LLC) |
Where a provider is marked approved, not yet in use, it is listed here in advance and receives nothing until the service is switched on. We list them early so that turning one on is not a change a clinic has to be notified about after the fact.
Our own service providers
These process data about the clinician's own account, where we are the controller rather than a processor. They never receive clinical data, which is why they are not in the processing agreement's schedule.
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Vercel Web Analytics | Counting page views on the public marketing site | Page address, referrer, country/region/city, browser, OS and device type for visits to public pages. Never clinical data, and never a page behind the login. | United States (Vercel Inc.) |
| Stripe | Payment processing and subscription billing | Clinician name, email and payment identifiers. Never clinical data. | Ireland / United States |
Transfers outside the EU and the UK
Clinical records are stored and served in Ireland. Two of the sub-processors above process data outside the EU. Anthropic, which drafts reports and reads scanned documents, and OpenAI, which transcribes audio, both work in the United States. We contract with Anthropic Ireland, Limited and OpenAI Ireland Ltd. Those transfers rely on a European Commission adequacy decision where one covers the recipient, and otherwise on the standard contractual clauses with a transfer impact assessment, which we will send to any clinic that asks.
For a clinic in the United Kingdom, records pass from the UK to Ireland, which UK law recognises as protecting personal data adequately. OpenAI handles a UK clinic's audio through OpenAI OpCo, LLC, in the United States. Transfers of UK data to the United States rely on UK regulations approving transfers to the recipient where they apply, and otherwise on the standard contractual clauses with the UK's International Data Transfer Addendum.
We do not permit any sub-processor to use a clinic's data for its own purposes, and specifically not to train, fine-tune or evaluate any machine learning model. That is clause 4(b) of the processing agreement, and it binds us to obtain the same commitment from every sub-processor before their service touches a clinic's data.
Last updated 2026-10-19. Questions: daniel@senecadocs.com.