Sub-processors
Sub-processors
A sub-processor is a company we engage to process personal information on our behalf in order to run SurgeonAI. This page lists every sub-processor we currently use, what it does, and where it processes data.
1. Current sub-processors
| Provider | Function | Processing region | Personal information involved |
|---|---|---|---|
| Supabase | Managed Postgres database, authentication (email/password and Google sign-in) and file storage — the primary store for accounts, learning data, and uploaded media | United States | all account, profile, learning, logbook, portfolio, and uploaded media data |
| Anthropic | AI inference for the tutor, question generation, feedback, and other AI features | United States | the text of your prompts and the retrieved study material sent with them; conversation content |
| Voyage AI | Text embeddings used to search our own study material (retrieval-augmented generation) | United States | search queries and passages of our study content; no account identifiers |
| ElevenLabs | Speech-to-text and text-to-speech for the AI tutor’s voice mode. This provider is switchable: a deployment may be configured to use OpenAI’s speech services instead, and this page will be updated if that becomes the default | United States | the audio you record in voice mode and the text spoken back to you |
| Stripe | Payment processing and subscription billing. Card details go to Stripe directly; SurgeonAI never sees or stores a full card number | United States, with global card-network processing | name, email, billing address, payment status, subscription and invoice records |
| Resend | Transactional email — sign-up confirmation, password reset, and account notices | United States | email address and the contents of the message sent to you |
| Zoom | Live community and teaching calls, where you choose to join one | United States | name, email address, and your participation in the call including any recording made with notice |
| NCBI (PubMed, US National Library of Medicine) | Literature search when the tutor looks up published evidence. We send only the search terms; this is a public API and is listed for completeness | United States | none — no personal information, account identifier, or user IP is sent |
| Google Ireland Limited (Google Analytics) | Website analytics — aggregate measurement of how the site is used. It is loaded only after you consent to analytics cookies, and never for advertising | Ireland (EU), with possible transfer to the United States under the EU–US Data Privacy Framework | a randomly generated analytics identifier held in the _ga cookies, an anonymised IP address, the pages you viewed, approximate location, and device and browser type |
We also use ordinary infrastructure services — application hosting, DNS, and content delivery — that transmit and cache the Service. Where such a provider processes personal information beyond routing traffic, we will add it to the table above.
Sign-in providers. If you choose “Continue with Google”, Google authenticates you and passes us the email address it has verified for you. Google processes your Google account under its own privacy policy as an independent controller, not as our sub-processor — a separate role from the analytics service listed in the table above; the sign-in exchange itself runs through Supabase’s authentication service, listed above.
2. Safeguards
Each sub-processor is engaged under a written contract that includes data-protection terms no less protective than our own commitments, and is given access only to the information it needs for its function. Where personal information is transferred out of the UK or EEA, we rely on the UK International Data Transfer Addendum or the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate.
We do not permit any sub-processor to use your personal information for its own purposes, to sell it, or to train a general-purpose AI model on identifiable SurgeonAI user content.
3. Changes and objections
We will update this page when we add, replace, or remove a sub-processor. Institutional customers under a signed Data Processing Addendum receive at least 30 days’ advance notice of a material new sub-processor and may object on reasonable data-protection grounds, as set out in that Addendum.
Questions about this list, or a request for the transfer safeguards relating to a particular provider, should go to privacy@surgeon.ai.