Mobcly Subprocessors
Last updated: 10 October 2026.
Clinics store their patients’ records in Mobcly. To run the service we use a few outside companies (“subprocessors”) that handle some of that data on our behalf. This page lists them, what each one does, which data it can see, and where.
- Why this page exists: our Terms of Service (Annex A §6) promise to tell clinics at least 30 days before we add or replace a subprocessor. Clinics may object, and if we cannot solve the objection they may end the agreement and get a refund of unused prepaid time.
- How you hear about changes: we email every clinic owner and add the change to the log at the bottom of this page.
- Every subprocessor is bound by a data processing agreement with protection equal to ours.
Current subprocessors
| Company | What it does for Mobcly | Data it handles | Where the data is |
|---|---|---|---|
| Hetzner Online GmbH (Germany) | Runs our servers and the database | All clinic data held on our servers: patient records, examinations, prescriptions, appointments, accounts | EU (Finland) |
| Cloudflare, Inc. (USA) | Secure network in front of our servers; stores exam images and encrypted backups (R2, EU jurisdiction); the bot check on booking and public pages (Turnstile) | Data passing through to our servers; exam images; backups (encrypted, Cloudflare cannot read them) | Images and backups stored in the EU; network traffic passes Cloudflare’s global network |
| Sendinblue SAS (Brevo) (France) | Sends emails | Recipients’ names and email addresses, and the email content: booking confirmations and reminders for patients, account emails for clinic staff | EU |
| Functional Software, Inc. (Sentry) (USA) | Error reports | Technical details of errors. We avoid personal data in them on purpose | EU (Germany) |
| PostHog, Inc. (USA) | Usage statistics | Which screens are used, with the account id. Page addresses are stripped of ids, so no patient data | EU |
Some data used to run the business, not patient records, goes to other providers that are not subprocessors of clinic data: Stripe (payments) and Google (Sign in with Google, only if a user picks it). Our Privacy Policy §6 describes them.
Transfers outside the EU
Where a company above is based in, or may access data from, the United States, the transfer relies on the EU-U.S. Data Privacy Framework where the company is certified, or on the European Commission’s Standard Contractual Clauses.
Change log
| Date | Change |
|---|---|
| 10 October 2026 | First published list. |
Questions: [email protected].