Sub-processor Register

Sub-processor register

This is Annex C of the Sync Server Data Processing Agreement, the Sync Server Business Associate Agreement and the POPIA operator schedule. It lists every third party that processes personal information on our behalf: the parties that host or carry practice data, and the merchant of record that takes payments. The installed software contacts none of them directly: clinical records live in an encrypted database on the practice's own devices, and the sync server stores only content that is encrypted before it reaches us and that we cannot read. No practice data ever reaches the payment processor.

How changes are notified

We give the practice's administrative contact 30 days' notice before a new sub-processor starts processing its data, with a right to object. If an objection cannot be resolved, the practice may end the affected service and retrieve its data under the portability floor in the Sync Server DPA §8. Every change is recorded in the change log at the end of this page.

Sub-processors

Sub-processor	Service it provides	What it can see	Where
Amazon Web Services	Infrastructure hosting for the sync server and the patient portal service (compute, storage, networking, key-management for our own service keys, monitoring)	End-to-end-encrypted content the operator cannot read, plus the service metadata inventoried in the Sync Server DPA Annex A.	The sync server and the portal: the United States (AWS us-east-1). The sync server's backup copies: a second region in the United States (AWS us-west-2, Oregon).
Apple Inc. — Apple Push Notification service	Delivery of push notifications to signed-in iPhones	The device's push token, a content-free notification payload (a fixed alert text, an opaque record identifier, and a count — never names or clinical content, enforced by automated test), and delivery metadata	Apple's infrastructure (United States)
Creem (Armitage Labs OÜ)	Merchant of record for purchases: the checkout page, payment processing, tax collection and invoicing, the billing portal and refunds	The buyer's name, email address and billing address, the edition, seat count and billing period bought, and the card details the buyer enters on Creem's own page (which never reach us). Never practice data	Estonia (EU), with its own sub-processors in the EU and the United States as listed in Creem's data-processing agreement

A server-side AI provider would appear here before any practice could opt into server-side inference; today every AI feature runs on the practice's own devices and no such provider exists.

Parties that are not sub-processors

These receive personal information for their own purposes or directly from your device, so they are disclosed in the Privacy Policy rather than listed as processors acting for us:

• Hugging Face — the download source your own device contacts directly for the optional on-device AI model.
• The platform app stores (Microsoft Store, Mac App Store, Apple App Store) — distributors of the apps under their own developer terms, including any store telemetry.

Change log

Date	Change
2026-09-08	First published version of the register.
2026-09-12	The sync server's hosting region stated: the United States (AWS us-east-1). The review notice at the top of the register was removed; the parties listed are unchanged.
2026-10-19	Words only: the sync server is called by its name, and the instruments this register annexes carry their new titles (Sync Server Data Processing Agreement, Sync Server Business Associate Agreement). The parties listed are unchanged.
2026-10-21	Creem (Armitage Labs OÜ) added as the merchant of record for purchases, replacing Paddle, which was listed as a party that is not a sub-processor: Creem processes the buyer's name, email and billing address for us under its data-processing agreement. It never receives practice data. Paddle is removed.
2026-10-25	The sync server's backup copies stated: a second region in the United States (AWS us-west-2, Oregon), so that a failure of one region loses nothing. The copies are encrypted just as the originals are, and both regions are in the United States. The parties listed are unchanged.
2026-10-26	The Cloud edition deleted: SideClick has two editions, Solo and Practice, so the register annexes the Sync Server Data Processing Agreement, the Sync Server Business Associate Agreement and the POPIA schedule only, and Amazon Web Services hosts the sync server and the patient portal alone. The parties listed are unchanged.

---

SideClick (Pty) Ltd · privacy@sideclick.io Version 1.5 · Published 2026-10-26