Subprocessor and Provider List

Version 1.11 — effective 28 October 2026

Scope

This list describes providers that may process data for IMORAY. The precise contracting entity within a provider group is the entity identified in the applicable SYNRADX account and agreement. Actual use depends on the enabled feature.

Google Cloud

• Services: Cloud Run, Cloud SQL, Cloud Storage, Artifact Registry, Secret Manager, Cloud Build, observability and related services.
• Purpose: hosting, execution, databases, technical storage, secrets, build, backup and security.
• Configured primary location: europe-west1 — Belgium, for managed runtime and database.
• Data: account, user-requested content, operational metadata and backups depending on the service.
• Transfers: under the Google Cloud DPA and mechanisms applicable to the account.

Google Gemini API

• Service: paid Gemini Developer API and enabled features, including URL Context or Google Search Grounding only in publicly described workflows.
• Purpose: transcription, drafting, revision, templates, Pathology Summary and Xira.
• Data: minimum request content and necessary technical metadata.
• Retention: under the applicable plan and terms; Google Search Grounding retains the prompt, context and result for 30 days at the provider.
• Model improvement: for paid services, Google states that inputs and outputs are not used to improve its products.
• Location: global; Google may store data transiently or cache it in any country where it has facilities.

Google Identity and Google Workspace

• Services: Google OAuth sign-in and Google Workspace organisational email for account verification, access recovery, security notices, team invitations and support or operational communications, only in enabled flows.
• Purpose: user-requested authentication and delivery of account-required or requested communications.
• Data: authorised Google account identifiers, email address, message type, unique link where needed, authentication state, delivery metadata and user-sent communication content; clinical content is not intentionally included in email.
• Selected provider: Google Workspace is the current transactional and operational email provider. Resend is not selected, has no runtime-mounted credentials and is not an active subprocessor; any provider change requires an update to this list and the applicable contractual review.

Meta — Facebook and Instagram

• Services: Meta Graph API and webhooks for the company Facebook Page and Instagram Professional assets; organic publishing and replies are prepared capabilities, while Marketing API/Ads remains separately disabled.
• Purpose: controlled receipt of public events for company assets, technical monitoring and, only after separate activation and approval, publication of the exact approved material or exact approved reply. Meta also operates its public platforms under its applicable role and terms; inclusion here does not state that Meta is a processor for every Facebook or Instagram user activity.
• Data: Page/Instagram identifiers, identifiers and metadata for public posts, comments or accounts, public text, caption, approved media, approved reply and technical delivery status. Clinical content and direct patient identifiers are prohibited from this flow.
• Current state: not used by the production service; activation requires a prior update of this list.

Cloudflare

• Services: registrar and authoritative DNS for the company domains.
• Purpose: domain administration, DNS resolution and DNS-configuration security.
• Current path: application mappings to Google Cloud use DNS-only records; Cloudflare Tunnel, Cloudflare HTTP proxying and Cloudflare WAF are not part of the hosted application path.
• Data: provider-level technical DNS-query metadata; the application does not intentionally send clinical or account content to Cloudflare through this DNS-only path.
• Changes: future enablement of a proxy, tunnel or WAF on the application path requires review of the contract, transfers and retention, followed by an update to this list and the Privacy Notice before enablement.

Stripe

• Service: Stripe Payments, Billing, Checkout, Customer Portal, Tax or related functions, only when enabled for the applicable plan and market.
• Purpose: payments, subscriptions, issuance of SYNRADX invoices and corrective documents, payment evidence, fraud prevention, disputes and financial obligations.
• Data: customer identity, B2C/B2B capacity needed for billing, billing details, plan, transactions and payment-method data. Full card details are collected by Stripe, not IMORAY. Detailed legal evidence of the immediate-performance request and withdrawal remains in IMORAY and is not sent in Stripe metadata unless strictly necessary and documented.
• Link: for orders sold through Link (“Sold through Link, LLC”, the Stripe Managed Payments service), Link is the seller (merchant of record) and processes the buyer's payment and billing data as a controller.

Keez

• Service: the Keez platform supplied by the entity identified in the applicable agreement, to which an authorised administrator manually uploads the package prepared in Control Center. The current workflow does not use the Keez API to send documents.
• Purpose: receiving and administering documents already issued through Stripe, reconciling payment information and accounting. The import does not issue a second invoice for the same sale; applicable fiscal formalities are handled separately by authorised personnel.
• Data: customer billing identity and address, B2C/B2B type, tax identifier where applicable, plan and period, invoice items, quantity, price, discount, currency, taxes, payment reference and evidence, original and corrective documents, fee and payout reports and reconciliation data strictly needed for accounting. Clinical content is not intentionally sent.
• Role: Keez's role for each operation is determined by the applicable agreement and law; it may include processing on SYNRADX's instructions and its own duties for fiscal or accounting records. Manual upload does not remove duties concerning confidentiality, security, retention or timely completion of applicable formalities.

Authorised personnel and advisers

Support, security, audit, legal and accounting providers may receive limited access only where necessary, under confidentiality and documented instructions. They do not receive general access to customer content.

Authorisation and changes

The customer grants general authorisation for subprocessors needed for the service. We will publish updates and, for a new subprocessor handling customer content, give reasonable prior notice, ordinarily 30 days where practical.

A customer may make a reasoned data-protection objection at privacy@imoray.app. We will consider reasonable measures; if no solution is available, the parties may terminate the affected component under the contract.