Neogenic Subprocessors
Scality Ltd uses the following companies to provide Neogenic. Each processes clinic data only to deliver its part of the service, under a data processing agreement with us. Your primary data is stored in the European Union. We notify each clinic's privacy contact at least 14 days before adding or replacing a subprocessor.
Subprocessor list
| Company | What it does for Neogenic | Data location | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage | EU (Stockholm, Sweden) | EU Standard Contractual Clauses |
| Vercel, Inc. | Hosting the Neogenic web app | EU (Stockholm, Sweden); global delivery network | EU–US Data Privacy Framework; EU Standard Contractual Clauses |
| Railway Corp. | Application servers and background processing | EU (Amsterdam, Netherlands) | EU–US Data Privacy Framework; EU Standard Contractual Clauses |
| OpenRouter, Inc. | Routes requests from Neo, the AI assistant, to the two AI providers below. Neogenic's OpenRouter workspace enforces zero data retention, allows only Anthropic Claude models approved by Neogenic, and allows only these two providers, with no fallback to others. | United States | EU Standard Contractual Clauses |
| Amazon Web Services, Inc. (Amazon Bedrock), through OpenRouter | Runs the Anthropic Claude models that generate Neo's responses and read files shared with Neo, with zero data retention | As routed by OpenRouter; may be outside the EEA | Under OpenRouter's data processing agreement (EU Standard Contractual Clauses) |
| Google LLC (Google Cloud Vertex AI), through OpenRouter | Runs the Anthropic Claude models that generate Neo's responses and read files shared with Neo, with zero data retention | As routed by OpenRouter; may be outside the EEA | Under OpenRouter's data processing agreement (EU Standard Contractual Clauses) |
| Twilio Inc. (SendGrid) | Sending email from Neogenic | United States | EU–US Data Privacy Framework; EU Standard Contractual Clauses |
| Cloudflare, Inc. | Domain name service (DNS); bot protection (Turnstile) on a public form when the Clinic turns it on, which receives the form visitor's IP address and browser signals | Global | EU Standard Contractual Clauses |
Not our subprocessors
Google and Microsoft accounts that your staff connect to Neogenic for email and calendar are your own services under your contract with them. Neogenic acts on them only as your staff instruct.
Scheduling tools you embed in your forms, such as your own Calendly account, are also your own services: the form visitor's browser connects to them directly.
If you choose to sign in with Google, Google handles that sign-in under its own terms and privacy policy.
Previous versions: Version 2 (30 September 2026), Version 1 (24 September 2026)