Draft list pending production vendor confirmationLast updated 21 May 2026
Subprocessor List
Current and expected vendors that may process personal data for NutriScope, including items requiring confirmation before production launch.
Audience: Practitioners, clinics, clients and reviewers
This list records the current and expected vendors used to provide NutriScope. It must be confirmed against the live production deployment, contracts and enabled integrations before launch.
Current And Expected Subprocessors
| Provider | Purpose | Data involved | Status |
|---|---|---|---|
| Supabase | Database, authentication, storage, edge functions and backend services | Account, client, tracker, message, file, booking, audit and app data | Expected core provider |
| Stripe | Hosted checkout, connected accounts, payment status, disputes and regulated payment services | Payment metadata, payer details, amount, currency and Stripe identifiers | Expected for paid bookings and packages |
| Lovable platform services | Application hosting, auth/email support and operational tooling used by the current stack | Account, email, routing, logs and operational metadata depending on deployed service | Confirm production scope |
| Transactional email provider | Account, invite, booking, reminder, questionnaire and message notification emails | Recipient, template data and delivery metadata | Confirm exact provider before launch |
| OneSignal | Opt-in web push delivery for signed-in users | Push subscription id, event/template name, notification content and delivery metadata | Expected for production push if enabled |
| Configured AI provider | Optional AI-assisted drafts, summaries or possible pattern prompts | Minimised client review context where enabled | Optional; confirm provider and terms before launch |
| Google Meet, Microsoft Teams or Zoom | Optional practitioner-connected video meeting link creation | Generic session title, time and provider token data; no client health context by design | Optional integrations |
| Monitoring, logging and support tools | Security, reliability, support and troubleshooting | Operational metadata; health data should be excluded where possible | Confirm exact tools before launch |
Changes To Subprocessors
NutriScope should give appropriate notice of material subprocessor changes where required by contract, and should assess privacy, security, residency and transfer implications before enabling a new provider.
International Transfers
Some providers may process data outside the UK. Transfer safeguards should be confirmed in vendor contracts and the privacy notice before production launch.