Sub-processors
Last updated · Version 1.1
What changed in version 1.1: Adewumi Studio, which builds and maintains the software and helps us run it, is added as a sub-processor.
On this page
In short
- Four sub-processors handle clinic data for Stator: Adewumi Studio builds the software and helps us run it, HostAfrica runs our server in Nigeria, Cloudflare stores uploaded files and encrypted backups, and Resend delivers the app's email.
- No other provider receives patient records from us.
- We give clinics 14 days' notice before we add or replace one.
- This page is annex B to the Data Processing Agreement.
1. Sub-processors for the Stator app
| Provider | What it does for Stator | Where | Clinic data it receives |
|---|---|---|---|
| Adewumi Studio | Builds and maintains the Stator software, and helps us run the service: deployments, server upkeep, backups and restores, and fixing problems | Nigeria | Can reach all data in Stator when that work needs it, on our instructions and under the confidentiality duty in section 7 of the Data Processing Agreement. |
| HostAfrica | Runs the virtual server that hosts the Stator app, its database and the most recent 14 days of encrypted backups | Nigeria | All data in Stator. Database backups on the server are encrypted. |
| Cloudflare, Inc. (R2 object storage) | Stores the files uploaded to Stator, and keeps encrypted copies of the database backups for 90 days | Outside Nigeria | Uploaded files: patient documents, completed intake forms, home-visit signatures, the clinic's logo and documents, and exercise pictures and videos. Encrypted database backups, which Cloudflare can't read. |
| Resend | Delivers the email the app sends for clinics that use the Stator Health sender | EU region | The content of each email (for example sign-in and invitation links, appointment and visit messages, and notices to staff), and the recipient's address. |
Annex C of the Data Processing Agreement explains how each transfer outside Nigeria is protected. Uploaded files are encrypted at rest by Cloudflare but not encrypted by Stator before upload; database backups are encrypted by Stator before they leave the server.
2. Services a clinic chooses to connect
These receive data only if the clinic connects its own account. They work under the clinic's own agreement with the provider, so they are the clinic's providers, not our sub-processors.
| Service | When it is used | What it receives |
|---|---|---|
| The clinic's own email account (Google Workspace, Microsoft 365, Zoho Mail, Resend or another email provider) | When the clinic's admin connects it under Settings, Email, so the app's email goes out from the clinic's own address | The email the app sends for that clinic |
| Google Calendar | When the clinic connects its calendar under Settings, Google Calendar | Stator reads events from that calendar to match them to appointments, and can write appointments to it. Google then holds those appointment details in the clinic's calendar. |
3. Other services you may notice
- YouTube. Exercise videos play inside the app in YouTube's privacy-enhanced player (youtube-nocookie.com). The viewer's browser connects to YouTube to play the video. Stator doesn't send patient records to YouTube.
- WhatsApp. "Share on WhatsApp" opens the staff member's own WhatsApp with a message ready to send. Stator doesn't send anything to WhatsApp itself.
- Let's Encrypt issues the certificates that keep connections to the app encrypted. It receives the app's web addresses, never patient data.
We don't use an outside error-tracking, analytics or advertising service in the Stator app, and no payment provider receives patient data.
4. The website
The statorhealth.com website is separate from the Stator app. Cloudflare hosts it and runs its contact form, and Resend delivers the form's messages to us. Our Privacy Notice covers both.
5. Changes to this list
Before we add or replace a sub-processor, we update this page and email each clinic's admin at least 14 days in advance. A clinic may object under section 9 of the Data Processing Agreement. Questions go to hello@statorhealth.com, with "Privacy" in the subject.
Questions about this page: hello@statorhealth.com, with "Privacy" in the subject.