Sub-processor Register
A complete list of third-party sub-processors engaged by OpenBook Clinical Pty Ltd (ABN 38 698 494 656) to process personal data in the course of delivering the OpenBook Clinical service.
Sub-processor Register
The following sub-processors are currently authorised to process personal data on behalf of OpenBook Clinical. All sub-processors are bound by data processing terms that impose equivalent obligations to those in our standard DPA.
| Sub-processor | Function | Location | Data Accessed | Data Retention | Certification |
|---|---|---|---|---|---|
| Supabase Inc.Security page ↗ | Database, authentication, file storage | Australia (ap-southeast-2, Sydney) + US (headquarters) | User accounts, search logs, CPD records, session data | Per data retention schedule; deleted within 60 days of account closure on request | SOC 2 Type II |
| Anthropic PBCSecurity page ↗ | AI processing (Claude API) — query synthesis and evidence retrieval | United States | Search query text only; no account data or patient data | 0 days — zero-data-retention agreement; queries are not stored or used for model training | SOC 2 Type II |
| Vercel Inc.Security page ↗ | Web application hosting, CDN, serverless functions | Global (primary: United States; edge nodes worldwide) | Request logs (IP address, request headers, response metadata) | 30 days (request logs); no personal data stored at edge | SOC 2 Type II |
| Stripe Inc.Security page ↗ | Payment processing, subscription management, invoicing | United States | Billing name, email address, payment method token (no full card numbers stored by OpenBook Clinical) | Per Stripe data retention policy; billing records retained 7 years per Australian tax law | PCI DSS Level 1 |
| Postmark (ActiveCampaign)Security page ↗ | Transactional email delivery (account notifications, billing receipts, password resets) | United States | Recipient email address, email content (transactional only) | 45 days (message logs) | SOC 2 Type II |
Change Notification
OpenBook Clinical will notify customers of any intended additions or replacements to the sub-processor list with not less than 30 days' notice prior to the change taking effect. Notification is provided by:
- Email to the account holder's registered email address
- Update to this page with a changelog entry
- Where a DPA is in place, direct notification to the nominated privacy contact
Customers who object to a proposed sub-processor change may raise their objection in writing to openbookclinical@gmail.com within the 30-day notice period. Where an objection cannot be accommodated, the customer may terminate their subscription in accordance with the Terms of Service.
To receive sub-processor change notifications by email, subscribe at openbookclinical@gmail.com.
International Data Transfers
Some sub-processors (Anthropic, Vercel, Stripe, Postmark) are located in the United States. Where personal data is transferred outside Australia, OpenBook Clinical relies on one or more of the following transfer mechanisms:
- Adequacy determination: Where the destination country has been assessed as providing an adequate level of protection under Australian privacy law.
- Contractual safeguards: Standard contractual clauses or data processing agreements that impose equivalent obligations to Australian Privacy Principle 8.
- Zero-data-retention: For Anthropic (AI processing), a zero-data-retention agreement ensures that no personal data is stored on Anthropic's systems following processing. Query content is transmitted securely and immediately discarded.
The Anthropic zero-data-retention agreement is the primary safeguard for AI query processing. A summary of its key terms is published in the AI Governance Framework.
Questions about sub-processors?
For enquiries about our sub-processor arrangements, to subscribe to change notifications, or to request additional documentation for your institutional procurement process, contact our privacy team.
openbookclinical@gmail.comOpenBook Clinical Pty Ltd · ABN 38 698 494 656 · Sydney, NSW, Australia