Subprocessors
Last reviewed: 16 July 2026
DawaHQ Limited uses the subprocessors below to provide the DawaHQ healthcare management platform. Your clinic is the data controller for patient data; DawaHQ acts as a data processor on your instructions.
Built to align with the Nigeria Data Protection Act 2023. International transfers and safeguards are described in our Privacy Policy.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | Patient PHI, staff PII, audit logs | eu-west-1 (Ireland) |
| Vercel Inc. | Application hosting, CDN | Request metadata, logs, IP | Global / US |
| Paystack Payments Limited | Payment processing | Billing name, email, transaction refs | Nigeria |
| Anthropic PBC | Optional clinical AI (decision support, summaries) | Clinical text via API (no patient names/IDs in prompts by design) | United States |
| Resend / Brevo / SendGrid (as configured) | Transactional email | Email address, message content | US/EU |
| Twilio / WhatsApp Business (as configured) | SMS / WhatsApp alerts | Phone number, alert content | US/Global |
| Functional Software Inc. (Sentry) | Error monitoring | Stack traces, session metadata (PHI scrubbed where feasible) | US |
| Upstash Inc. | Rate limiting | IP address, route keys | US (iad1) |
| Telegram (optional per clinic) | Critical staff alerts | Alert message content | Global |
OpenWA (optional, clinic-hosted)
When a clinic selects OpenWA in Settings, the clinic (or their MSP) self-hosts an unofficial WhatsApp Web gateway. That host is not a default DawaHQ subprocessor. See our WhatsApp BYOW documentation and ADR-020.
Changes
We update this register when subprocessors change. Enterprise customers receive notice per the Data Processing Agreement.
Contact: privacy@dawahq.com (Data Protection Officer: Stanley Jacob)