Sub-processors

This page lists every outside company (a “sub-processor”) that handles personal data for VitaMedas (operated by VitaMedas, Inc., commercial name VitaMedas). For each one it says what the company does, what data it receives, where it is, and the legal basis for sending data to it.

The list covers both of our services: the Vita app (iPhone, Apple Watch and Android) and vitamedas.com (the Health records vault, doctor links and intake links). It is also the list referred to in our Data Processing Agreement.

A sub-processor is any third party (a “sub-veri işleyen” in KVKK terminology) that VitaMedas engages to process personal data on behalf of a controller-customer, where VitaMedas itself acts as processor. The concept is defined in Article 28(2)–(4) GDPR and elaborated by EDPB Guidelines 07/2020. Under KVKK Article 12, our equivalent obligation is to ensure that anyone we engage to handle personal data on our behalf has signed sufficient technical and organisational measures (TOMs). For the Vita app, where we are the controller, we use the same word for the companies that process data for us.

The distinction we maintain on this page:

Sub-processor

A third party we engage to process personal data for us or on a customer's behalf (Article 28 GDPR). Listed in Section 5. Subject to advance notification and right of objection.

Independent controller

A third party that, by virtue of its role, determines its own purposes and means and is not a VitaMedas sub-processor. App Store / Google Play payment processing is a classic example. Listed in Section 5.1 for transparency but excluded from the formal Article 28 chain.

Source you connect

A service you choose to connect so that Vita can read your own records, such as Apple Health or Medicare. It sends data to you; we do not send your data to it for processing. Listed in Section 5.2.

Tool / vendor (no personal data)

Software we use internally where the vendor neither stores nor processes personal data of users (for example our source-code repository, which stays on our own machines). Not listed here.

Before we use a company that will receive personal data, we look at:

• whether it offers a written processing agreement with obligations equivalent to those in Article 28(3) GDPR;
• its technical and organisational measures (Article 32 GDPR / Article 12 KVKK), including encryption, access controls, logging and breach notification;
• certifications or attestations where they exist (ISO/IEC 27001, SOC 2 Type II, etc.);
• where it stores data, and a lawful transfer mechanism where data leaves the EEA, the UK or Türkiye (Standard Contractual Clauses, an adequacy decision, the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum);
• its record of public security incidents.

Where a company does not offer a processing agreement, we say so in the table below and limit what we send to it.

The following sub-processors are engaged as of the effective date above. This list is binding on VitaMedas and is the “list” referenced in the Data Processing Agreement.

Where a sub-processor is located outside the European Economic Area, the United Kingdom or Türkiye, we rely on one or more of the following lawful transfer mechanisms, supported by a Transfer Impact Assessment carried out in light of Schrems II (CJEU C-311/18) and the EDPB Recommendations 01/2020:

• EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3 — processor to sub-processor), incorporated by reference into the sub-processor’s DPA;
• UK International Data Transfer Addendum issued by the ICO under section 119A DPA 2018, for transfers subject to UK GDPR;
• EU-US Data Privacy Framework certification by the recipient, where in force and not invalidated;
• KVKK Article 9 safeguards for transfers outside Türkiye (taahhütname / signed undertaking framework, or an adequacy decision by the Personal Data Protection Board);
• Supplementary measures as appropriate. For the vault, end-to-end encryption (libsodium) means recipients get ciphertext only. This does not apply to Vita assistant data sent to Google Gemini, which must be readable to write an answer. For that transfer we rely on the mechanisms above and send only what each answer needs.

Our Transfer Impact Assessments are reviewed at least annually and on every change of law, regulator guidance or material incident affecting a recipient jurisdiction.

We will give at least thirty (30) days’ advance notice before engaging a new sub-processor or replacing an existing one. Notice will be given by:

• updating this page (the version and effective date will change);
• posting an entry to the change log at the bottom of this page;
• for B2B customers under an executed Data Processing Agreement, sending an email to the data-protection contact on file.

You may subscribe to changes by sending an email to privacy@vitamedas.com with the subject “Subscribe sub-processor updates”. We may give shorter notice (including post-hoc notice) where the change is required for the security of the Service or by applicable law.

B2B customers under a Data Processing Agreement may object on reasonable, documented data-protection grounds to a proposed new sub-processor by sending written notice to privacy@vitamedas.com within thirty (30) days of our notice. We will work with you in good faith to provide a commercially reasonable alternative — which may include retaining a different sub-processor for your tenant, restricting affected functionality, or providing an alternative configuration. Where no such alternative is commercially or technically feasible within sixty (60) days, you may terminate the affected portion of the Service for that customer tenant and receive a pro-rata refund of any pre-paid fees attributable to the unused remainder of the affected subscription period.

Consumer Users may withdraw consent or close their account at any time through Settings; objection rights to specific sub-processors are not contractually granted to consumer Users, but you remain free to vote with your feet.

VitaMedas remains liable to its customers for the acts and omissions of its sub-processors to the extent required by Article 28(4) GDPR, namely as if the acts or omissions were our own. Nothing on this page expands VitaMedas’s overall liability beyond the caps set out in the Terms of Service and the Data Processing Agreement. To the maximum extent permitted by law, VitaMedas’s aggregate liability arising out of or relating to sub-processors shall be subject to the overall liability cap in the applicable Terms of Service, and VitaMedas excludes liability for indirect, consequential, special, incidental, exemplary or punitive damages, including loss of revenue, loss of profits, loss of goodwill and loss of data, except where such exclusion is prohibited by mandatory law.

Every change to this list is recorded in our version history with its date and the exact wording that changed. The change log below summarises each change. Earlier versions of the full text are available on request.

Data-protection enquiries about this list, including diligence documentation requests from B2B customers, may be sent to privacy@vitamedas.com. Diligence packages (DPAs, SOC 2 reports, ISO certificates, TIAs) for our sub-processors are released under NDA to contracted customers on request.

This page is governed by the laws of the State of Delaware, United States, without prejudice to any mandatory data-protection rights of data subjects in their country of habitual residence. The English version is the binding version; any translation is provided for convenience only.