Sub-processors
To deliver the Babiha platform we use a small number of trusted third-party service providers. They act as sub-processors where they handle Customer Data on our behalf; some also act as controllers for their own purposes. This page lists the integrations used by the platform and the transfer-safeguard status recorded for each one. Where a status is still being verified, the table says so rather than presenting it as confirmed. Our Data Processing Agreement explains the standards that apply to processing for agency customers. An integration listed here is not evidence of a completed legal agreement. Any outstanding contract, transfer assessment and applicable safeguard must be completed before live Customer Data is used with that provider.
| Provider | What they do | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Database, authentication and file storage | All platform data, including care records | United Kingdom (London) | UK database region; contracting entity, overseas access and transfer arrangements require verification |
| Vercel | Application hosting and (with consent) privacy-friendly analytics | Application requests and responses, which may contain account or care data; technical logs and consented analytics | Functions configured for London; global delivery network; Vercel Inc.: USA | Applicable processor agreement, transfer mechanism and account settings require verification |
| Resend | Transactional email (verification, notifications) | Recipient identity and minimised care-service notification content, which can include visit, care-plan, medication-alert or incident context | United States | UK transfer safeguard and processor agreement status under owner/DPO verification |
| Expo Push Service | Routes mobile push notifications to Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) | Expo push token and minimised notification payload | United States / provider infrastructure | UK transfer safeguard and processor agreement status under owner/DPO verification |
| Sentry | Error and performance monitoring. Server-side always on (legitimate interest); in-browser monitoring and session replay only with analytics consent | Technical diagnostic data and consented replay data, with redaction and masking controls | Recorded web project region: EU (Frankfurt); provider headquartered in USA | Applicable processor agreement, transfer mechanism and account settings require verification |
| Stripe | Subscription billing, payment processing and invoicing | Agency billing contact and address, payment card details (collected by Stripe, never by Babiha), and a count of billable clients — no service-user personal or health data | Ireland / United States and other locations covered by Stripe’s service terms | UK transfer safeguard and processor agreement status under owner/DPO verification |
| postcodes.io | Postcode lookup for scheduling and travel estimates | Postcodes only (no names or full addresses) | Public API; current hosting and access arrangements require verification | Provider data handling and any restricted transfers require verification |
Mobile device platform services
Mobile notifications are delivered onward by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). When a user chooses voice input, Apple Speech Recognition or the Google speech service may process microphone audio and return a transcript if the device uses network-based recognition. The user controls these permissions in device settings. Babiha does not retain the raw voice recording.
Mapping and route planning
Where an agency uses the scheduling map, a map provider can receive technical request data such as your IP address and the map area requested. This is separate from sending a client's name or full address. External route optimisation is switched off by default: travel times are estimated locally unless a separate routing endpoint is configured for the deployment. A configured external routing service receives the coordinates needed for its calculation and requires assessment of its data protection terms and location before use.
Changes to this list
We may add or replace sub-processors as the platform evolves. Where we do, we will update this page and notify agency customers through their account contact before a new or replacement sub-processor handles their data. Customers may object on reasonable data protection grounds, as set out in our Data Processing Agreement. To update your notification contact or request further information, email dpo@babiha.care.