What to ask about EU-hosted longevity clinic software in 2026
If your clinic treats patients in the EU, you need to know where patient data is stored and where AI tools process it. Not every vendor says. This guide lists the questions to ask and what each vendor states on its own site.
Ask for the answers in writing. A sales call can say "EU hosted" and still leave out where backups, email or AI processing run.
Why hosting location matters
Health data is special category data under the GDPR (Article 9). A clinic may use it only on one of the grounds the law lists, and must protect it to match the higher risk. Patients also ask where their data lives. A vendor that names its regions makes that answer simple. A vendor that does not name them leaves you to ask.
An AI tool adds one more question. When an AI agent books an appointment or drafts a follow-up, it works on clinic records, so where the AI runs matters as much as where the database is.
Questions to ask any vendor
- Where are databases and files stored, and in which country?
- Where do the application servers run?
- Where does AI processing run, and does the AI provider store prompts or train on them?
- Which supporting services, such as email delivery, sit outside the EU, and what protects that data?
- Is there a Data Processing Agreement and a public subprocessor list?
- How much notice do you get before a subprocessor changes?
What Neogenic states
| Area | What the Neogenic site states |
|---|---|
| Databases and files | Stockholm, Sweden |
| Application servers | Frankfurt, Germany |
| Neo | Runs on Amazon Bedrock in the EU when switched on. Bedrock writes no prompt or response to lasting storage, apart from one narrow exception described on our subprocessor list, and keeps only a short-lived cache to answer faster. The model's maker never receives them, and they are never used to train models |
| Outside the EU | A few supporting services, such as email delivery, use providers outside the EU. They never receive the health data stored where the Terms allow. Standard Contractual Clauses apply where a provider can access data from outside the EU |
| Roles | The clinic is the controller, and Scality Ltd, the company behind Neogenic, is its processor under Article 28. When the clinic releases a report to the patient portal, the clinic and Scality Ltd are joint controllers of that hand-over |
| Subprocessor changes | At least 14 days' notice, with a right to object |
| Breach notice | Without undue delay and within 48 hours of becoming aware |
Read the GDPR page, the Data Processing Agreement and the subprocessor list for the full terms. The longevity clinic software overview shows what runs on that hosting.
How we compared
We read each vendor's own security, privacy and sub-processor pages on 26 October 2026 and wrote down only the regions they name. We did not ask vendors for more, and we did not test their systems.
What other vendors state
| Vendor | Hosting region stated on its own site |
|---|---|
| Healthie | United States, per its privacy policy[1] |
| Pabau | Application data in London with a Singapore region. Files and backups on AWS in London. Other regions on request[2] |
| Reya.ai | Not stated. Its Advanced plan lists multi-cloud and domiciling options[3] |
| Semble | UK and EU (Ireland) data centres, per its security page and sub-processor list[4][5] |
| LongevAI | In the clinic's region. AI processing in the EU, Singapore, the UAE or the US[6][7] |
| OptiMantra | AWS named, region not stated[8] |
| Cerbo | A private dedicated cloud server per practice, in US data centres per a Cerbo article[9][10] |
| Heads Up Health | US and other countries, per its privacy notice. Data Residency listed on every plan[11][12] |
Watch out for the parts outside the EU on our side too. A few supporting services Neogenic uses, such as email delivery, run with providers outside the EU, under Standard Contractual Clauses.
A missing statement does not mean data is stored outside the EU. It means the vendor's site does not say so on the pages we read. Ask the vendor.
An EU region is not the whole answer
Hosting in the EU does not make a clinic compliant by itself. Roles, contracts, access controls and patient rights matter too. Use our GDPR checklist for longevity clinic software to cover them.
Frequently asked questions
Does EU hosting mean data never leaves the EU?
Not always. Neogenic's GDPR page says a few supporting services, such as email delivery, use providers outside the EU. They never receive the health data stored where the Terms allow, and Standard Contractual Clauses apply where a provider can access data from outside the EU.
Is Neo hosted in the EU?
Yes. When Neo is switched on, it runs on Amazon Bedrock in the EU.
Does Neo train on our data?
No. Prompts and Neo's responses are never used to train models, and the model's maker never receives them.
What if a vendor does not state its hosting region?
Ask in writing where databases, files, application servers and AI processing run. Ask for the Data Processing Agreement and the subprocessor list too. If the vendor cannot answer in writing, treat that as part of your decision.
The Neogenic team wrote this guide. Read more about Neogenic.
Facts about other vendors were checked on their own websites on 26 October 2026.
