Subprocessor Register
These are the providers that may process personal data to help us run Unpack. The register reflects how the service is built today, and is updated as the service changes.
We separate three different things deliberately. First, how the service is actually built — that we can verify from the code and configuration. Second, what a provider’s own published terms say — that we can locate at provider level. Third, whether those terms actually apply to Azimuth Associates LTD t/a Unpack’s arrangement, which for providers reached through a platform or gateway is a different question. Where the third is unresolved we say so plainly rather than borrowing the provider’s assurance.
Core platform and backend providers
These providers run the platform Unpack is built on. Lovable is the direct account and platform relationship. The others, including Supabase, are provisioned through that platform, so the contractual chain back to Azimuth Associates LTD is stated per provider rather than assumed. Adding or replacing one is handled under clause 6 of the Data Processing Agreement.
Lovable (application platform, hosting and AI Gateway)
Direct account and platform relationship — we hold this account
Builds, hosts and serves the Unpack web application and its server functions, and routes our AI requests to the underlying model providers through the Lovable AI Gateway.
- Data involved
- Content in transit through the application, request and technical logs, and the transcript, conversation text, prompts and generated outputs sent through the gateway.
- Note
- Known supplier governance item: the current Lovable Pro plan does not provide this account with the model-training opt-out available on Business. We state this plainly rather than claiming a contractual training exclusion we do not hold.
Verified from the current codebase.
Lovable Pro, confirmed by the account owner.
Located at provider level. Lovable’s published DPA states it acts as processor for UK personal data and incorporates the EU standard contractual clauses as amended by the UK Addendum for transfers out of the UK, with general subprocessor authorisation and notice. Lovable states that DPA inclusion applies to Business or Enterprise plans, so we do not claim those terms apply to this Pro account.
Unresolved. Because the account is on Pro rather than Business or Enterprise, we do not assert that Lovable’s formal DPA protections apply to us. The Article 28 contractual position needs to be resolved before routine production use involving patient special-category data.
Not verified directly by us; no UK-only processing is claimed. Lovable’s terms state it does not guarantee that AI Gateway data is processed or stored in a particular country unless expressly agreed.
Provider mechanism identified (SCCs plus UK Addendum); applicability to our arrangement is not verified directly by us, given the Pro plan position above.
Not available to this account. Lovable states that Business and Enterprise data is not used to train models and that Free and Pro plans can opt out; on the current Unpack Pro account the opt-out control is not available, confirmed by the account owner. We therefore do not state that Unpack has opted out. We do not submit content for the purpose of training models, but we cannot claim a contractual training exclusion on this plan.
Provider-level terms identified; gateway and log retention periods for our arrangement are not verified directly by us.
Supabase
Core backend infrastructure — provisioned through the Lovable platform, not under a direct Azimuth Associates LTD account
Managed database, authentication and file storage. Holds accounts, transcripts, analyses, uploaded content and application records.
- Data involved
- Account and profile data, audio files, transcripts, conversation content, generated analyses, application logs.
Verified from the current codebase.
Located at provider level. Supabase’s current DPA provides for regional storage and primary processing where the customer directs a specific region, with general subprocessor authorisation and equivalent obligations flowed down.
Not verified directly by us. The Supabase project is provisioned and managed through the Lovable platform rather than under a Supabase account we contract with directly, so which terms bind us, and through whom, is not something we have verified directly.
Verified from the project connection configuration: the project runs in the AWS eu-central-1 region (Frankfurt, Germany). It is not London-hosted, and we do not claim UK-only hosting.
Provider mechanism identified; applicability to our arrangement is not verified directly by us. Germany is covered by the UK’s adequacy regulations for the EEA, so this is an EEA transfer rather than a restricted transfer to a third country, but the contractual route to us still is not something we have verified directly.
Supabase is a storage and database provider; content is not sent to it for model training. Backup retention and log rotation periods are not verified by us against provider terms.
Providers reached through the platform and gateway chain
These providers process content or traffic, but we reach them through the Lovable platform and AI Gateway rather than under our own account with them. Their published terms are useful evidence, but we are not presenting ourselves as a direct party to them.
OpenAI (speech-to-text and chat)
Reached through the Lovable AI Gateway — not a direct Azimuth Associates LTD account
Speech-to-text transcription of recorded and imported audio; answering Ask Unpack questions; patient conversation preparation and suggested Ask starters. Reached via the Lovable AI Gateway, only after the user has agreed on the “How Unpack uses AI” screen.
- Data involved
- Audio submitted for transcription and the resulting text; typed or spoken Ask questions with relevant conversation history, analyses and profile context; earlier linked conversations used for preparation.
- Note
- Models currently used: gpt-4o-mini-transcribe (transcription) and gpt-6-astra (Ask, preparation, starters).
Verified from the current codebase.
Located at provider level. OpenAI’s current data-processing addendum, effective 1 January 2026, states that UK data is processed subject to the standard contractual clauses as amended by the UK Addendum, and OpenAI maintains a published subprocessor list.
Not verified directly by us. We call OpenAI through the Lovable AI Gateway, not under a direct OpenAI account. We are not presenting Azimuth Associates LTD as a party to OpenAI’s DPA. What matters for us is whether Lovable’s own arrangement passes equivalent protections through, and we have not verified that directly.
Not verified directly by us; determined by the gateway’s routing rather than by us.
Provider mechanism identified; applicability to our arrangement is not verified directly by us.
Provider-level API terms identified; gateway applicability is not verified directly by us. We have not opted into any training programme.
Google (Gemini models)
Reached through the Lovable AI Gateway — not a direct Azimuth Associates LTD account
Analysis, structuring and coaching outputs generated from transcripts and conversation content, reached via the Lovable AI Gateway.
- Data involved
- Transcript and conversation text, prompts and generated outputs.
- Note
- Models currently used: Gemini Flash family.
Verified from the current codebase.
Located at provider level. Google Cloud’s current service terms state that Google will not use customer data to train or fine-tune AI/ML models without prior permission or instruction.
Not verified directly by us. Calls are made through the Lovable AI Gateway rather than under a Google Cloud account we hold, so those direct terms are provider-level evidence rather than terms we are party to.
Not verified directly by us. Without a specific data-location commitment, processing may occur globally.
Provider mechanism identified; applicability to our arrangement is not verified directly by us.
Provider-level no-training term identified; gateway applicability is not verified directly by us.
Cloudflare
Downstream infrastructure identified through the provider chain — not a separate Azimuth Associates LTD contract
Edge delivery, network and application-layer routing for the hosted application, provided as part of the Lovable hosting platform.
- Data involved
- Traffic in transit, connection metadata, IP addresses.
Verified: the application is served through Cloudflare infrastructure as part of Lovable’s hosting.
Held by Lovable as Cloudflare’s customer, under Lovable’s subprocessor arrangements rather than ours.
Indirect. Our route to assurance is Lovable’s DPA and subprocessor flow-down, which we have not verified directly.
Edge delivery is by nature globally distributed; the specific position is not verified directly by us.
Google Firebase Cloud Messaging
Push delivery provider reached through the application’s notification chain
Delivery of push notifications to registered devices.
- Data involved
- Device push tokens and notification content such as titles and short summaries. Transcripts are not sent for processing; only the notification text itself is transmitted.
Verified from the current codebase.
Located at provider level. Firebase data-processing terms contain transfer provisions and SCC mechanisms for restricted European transfers, and note that data may be processed globally unless a data-location commitment applies.
Not verified directly by us against the Firebase project arrangement actually used for Unpack’s push delivery.
Provider mechanism identified; applicability to our arrangement is not verified directly by us.
Lovable Email (platform transactional email)
Lovable platform service and its downstream delivery chain — not a separate vendor relationship we hold
Sends account and service emails — sign-up confirmation, sign-in links, password reset, email change, re-authentication and invitations — from noreply@unpackhealth.co.uk using the sending domain notify.unpackhealth.co.uk. Lovable in turn uses its own delivery provider.
- Data involved
- Email addresses, names, message content and delivery metadata.
Verified from the current configuration.
Covered by the Lovable platform relationship rather than a separate contract of ours; the underlying delivery provider is Lovable’s subprocessor.
Not verified directly by us alongside the Lovable plan and DPA position.
Not verified directly by us.
Tools practices choose themselves
These are not our subprocessors. They are tools a practice may choose to send content into Unpack from. The practice’s relationship is with those providers directly, and the practice is responsible for its own arrangements with them.
Plaud (recording devices)
Chosen by the practice — not our subprocessor
A recorder some practices choose to use. Recordings reach Unpack through an inbound integration the practice sets up.
- Data involved
- Audio recordings and any metadata the practice’s own setup sends.
Verified: an inbound route exists for this.
The practice’s own contract with the provider, not ours.
Determined by the practice’s own arrangement with the provider.
Zapier
Chosen by the practice — not our subprocessor
An automation tool some practices use to forward recordings into Unpack via our inbound webhook.
- Data involved
- Whatever content the practice configures its automation to send.
Verified: an inbound webhook route exists for this.
The practice’s own contract with the provider, not ours.
Determined by the practice’s own arrangement with the provider.
The limits of this register
- Resolving the Article 28 contractual position with Lovable. The Unpack account is on the Lovable Pro plan, and Lovable states that DPA inclusion applies to Business or Enterprise plans, so we do not rely on that DPA or on a contractual no-training position today. The model-training opt-out available on Business is not available to this Pro account. This is recorded as a known supplier governance item to be reviewed before routine production use involving patient special-category data.
- Confirming the contractual chain for the AI Gateway — whether protections equivalent to OpenAI’s and Google’s direct terms flow through to us.
- Confirming the processing region for the AI Gateway and model providers. Lovable’s terms do not guarantee processing or storage in a particular country unless expressly agreed. The Supabase project region is confirmed as AWS eu-central-1 (Frankfurt).
- Confirming the transfer mechanism that applies to our own arrangement, rather than the mechanism each provider publishes for its direct customers.
- Confirming provider backup retention and log rotation periods for the Retention Schedule.
- Publishing a change-notification process for register updates.