Data processing & sub-processors
To run Arcaevo we rely on a small number of carefully-chosen sub-processors, each under a data-processing agreement (DPA) and, where relevant, EU Standard Contractual Clauses. This page lists them and what they do.
Our commitments
Every sub-processor is contractually bound to process data only on our instructions, apply strong security, and support your GDPR rights. We keep data in the EU wherever possible and assess any transfer carefully.
Infrastructure
Cloud hosting and encrypted storage within the EU (eu-west-1), providing the compute and databases that run the app and store your records.
Laboratories
ISO-accredited EU laboratories that process your blood samples and return results. They receive only the data needed to run and report your test.
Clinical review
Registered clinicians who review and sign off results. Access is logged and limited to the records they are reviewing.
AI narration
A large-language-model provider used solely to turn deterministic rule outputs into plain-English explanations. It is contractually prohibited from training on your data, and it cannot set clinical thresholds.
Payments & messaging
A PCI-compliant payment processor (we never store card numbers) and a transactional messaging provider for essential notifications like results-ready and fasting reminders.
Changes
We update this list before adding a new sub-processor that handles personal data, and members can subscribe to change notifications.