Sub-processors
Last updated: 26 October 2026
Authorised sub-processors for RehabPilot cloud services (Art. 28 GDPR). The DPA is the binding contract; this list is for transparency.
| Provider | Purpose | Location / notes |
|---|---|---|
| Amazon Web Services EMEA SARL | Application hosting, databases, key management | Frankfurt, Germany (eu-central-1) |
| Cloudflare, Inc. | Encrypted media storage (Western Europe), CDN, website protection | EU storage; US company |
| Amazon Web Services EMEA SARL (Amazon SES) | Transactional email (invites, login codes, week-plan PDFs) | EU sending region (Frankfurt) |
| Google Ireland Ltd. / Google LLC | Push notifications (Firebase Cloud Messaging), neutral text only; Google Sign-In when used | May involve transfers outside the EEA |
| Apple Inc. | Sign in with Apple when used | May involve transfers outside the EEA |
| Stripe, Inc. | Clinic subscription billing (no therapy content) | May involve transfers outside the EEA |
Website hosting (not a sub-processor for practice or patient data of the app): Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — hosting of the website rehabpilot.org.
Changes are announced under Section 6 of the DPA. Questions: [email protected].