Subprocessors
The companies that process customer data on behalf of Docdemic (Avidemic AB), what they do and where.
Last updated:
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Hostup | Server hosting: the application, its PostgreSQL database and private file storage for recordings and documents. | All customer data: account details, recordings, transcripts, notes, patient details, check-in answers. | Sweden (EU) |
| Bunny StorageBunnyWay d.o.o. (Slovenia) | Off-site storage of nightly backups. Backups are encrypted on our server before upload, so the provider cannot read them. | Encrypted backup files of the database and file storage, kept for up to 35 days. | Stockholm, Sweden (EU) |
| TensorX | AI text generation: clinical notes, letters, chat answers, summaries and research drafts. | The input needed for the task you ask for, such as a transcript, a template and patient context. Not used to train models. | Being confirmed; ask compliance@docdemic.com |
| Berget AI | Speech-to-text transcription (including Swedish and Norwegian models) and fallback AI text generation. | Audio of recorded visits; text input when it serves as the fallback for text generation. | Being confirmed; ask compliance@docdemic.com |
| LemonfoxFallback only | Fallback transcription through its EU endpoint, used only if the primary transcription service fails. | Audio of recorded visits. | EU endpoint |
| StaanOnly for chat answers with sources | Web search for regional clinical guidance when you ask the chat for sources. | A short search query. Patient names, references, contact details and long numbers are removed before it is sent. | Being confirmed; ask compliance@docdemic.com |
| Lettermint | Delivery of account and service emails: sign-in links, verification, invitations and receipts. | Recipient email address and name, and the email itself. No clinical content. | Being confirmed; ask compliance@docdemic.com |
| StripeStripe Payments Europe, Ltd. (Ireland)Paid plans only | Subscription billing and payments. | Billing contact, email address, payment details and invoices. Docdemic never sees full card numbers. No clinical content. | EU, with transfers to the US under Stripe’s safeguards |
None of these providers may use your data to train AI models. Each receives only what its task needs.
Other services
These are not subprocessors of customer data, but you may want to know about them.
PubMed (NCBI), Europe PMC, OpenAlex, Semantic Scholar
Public literature databases. They receive search terms for literature searches, never patient records; patient identifiers are removed from chat-generated queries.
Web Push (the patient’s browser vendor)
Check-in reminders travel through the push service of the patient’s own browser (for example Google, Apple or Mozilla). The message is end-to-end encrypted and holds only a generic reminder.
Microsoft, Google (single sign-on)
If you choose to sign in with Microsoft or Google, that provider confirms who you are. It receives no clinical data from Docdemic.
OpenPanel
Product statistics run on our own self-hosted OpenPanel server in the EU. It never receives clinical content.
Changes to this list
Before we add or replace a subprocessor we update this page, and customers with a Data Processing Agreement are notified by email in advance so they can object. To ask about this list, email compliance@docdemic.com.