Kia sub-processors and transfers
Version 2026-10-12.2 — published October 12, 2026
Public, dated and versioned map of the sub-processors NOVIAMIND relies on for Kia, the data they process, their country and the mechanisms governing any transfer or remote access outside the European Economic Area (GDPR art. 28 and 44 ff.; French Public Health Code art. R.1111-11 III for French practices).
| Sub-processor | Country | Function | Data | Retention | Transfer outside the EEA and mechanism |
|---|---|---|---|---|---|
| Google Cloud (Google Cloud EMEA Limited, Ireland; Google LLC, United States) | Belgium, europe-west1 region (Ghlin data centre) | Application hosting (Cloud Run), medical database (Cloud SQL, PostgreSQL), encrypted backups (Cloud Storage), secrets, technical logs, software images | All practice data, encrypted at rest and in transit; physician identity; technical logs without clinical content | Data: for the contract and the country’s retention period. Backups: 30 days, then 7 days of recovery. Technical logs: limited period | Stored and processed in the EU. Google LLC is subject to US law (CLOUD Act, FISA 702): European Commission standard contractual clauses included in the Google Cloud Data Processing Addendum; Google LLC’s listing under the EU–US Data Privacy Framework to be verified on the official register. No remote access from outside the EEA requested by NOVIAMIND. Services used are listed in Google’s HDS v2.0 certificate (no. 2022-013, activities 1 to 5); Google HDS addendum to be signed by NOVIAMIND |
| Vertex AI (Google Cloud) | EU region (European regional endpoint) | Clean-up of a dictated report, only at the physician’s request — closed until qualified | Report text submitted by the physician | No provider retention: cache disabled, no request logging, no use for training | Same mechanism as Google Cloud; no global or non-EU endpoint |
| Supabase (Supabase Inc., United States; data in Ireland, eu-west-1 region) | Ireland, EU | Physician authentication only (email, phone, sign-in factors); no patient data | Physician’s email, phone number, sign-in dates | While the account exists; deleted when the account is closed | Hosted in the EU; US parent company: standard contractual clauses (Supabase data processing agreement). No remote access from outside the EEA requested |
| Twilio (Twilio Inc., United States; Twilio Ireland Limited) | United States and Ireland | Delivery of SMS verification codes | Physician’s phone number, one-time code, timestamp | Provider delivery logs, limited period | Transfer to the United States covered by standard contractual clauses and Twilio’s binding corporate rules; no patient data |
| Resend (Resend Inc., United States; sent from the eu-west-1 region) | Ireland, EU; US company | Sign-in emails and security notices to the physician | Physician’s email address, service email content | Provider delivery logs, limited period | Sent from the EU; US parent company: standard contractual clauses (Resend data processing agreement); no patient data |
| Cloudflare Turnstile (Cloudflare, Inc., United States) | Global network | Bot protection on the sign-in page, when enabled | Verification token, IP address and technical browser characteristics | Limited period at the provider | Standard contractual clauses; no patient data |
| PubMed — National Library of Medicine (NIH, United States) | United States | Biomedical literature search, at the physician’s request | Generic search keywords only; Kia refuses any patient data before sending | No retention by Kia; NIH technical logs | The query carries no personal data by design; the Kia server’s IP address is transmitted |
| CIMA — Agencia Española de Medicamentos y Productos Sanitarios (AEMPS) | Spain, EU | Look-up of medicines authorised in Spain, at the physician’s request | Generic search keywords only | No retention by Kia | No transfer outside the EEA |
Notes
- Remote access from outside the EEA: none. NOVIAMIND neither performs nor has performed any access to practice data from a third country.
- Features that process patient data are closed during qualification; this page describes the architecture adopted, not an opening.
- Non-EU laws applicable to Google LLC, Twilio Inc., Resend Inc., Supabase Inc. and Cloudflare, Inc.: CLOUD Act (18 U.S.C. § 2713) and FISA section 702. Residual risk: an access request from a US authority addressed to the provider; measures: EU storage and processing, encryption, no patient data at providers other than Google Cloud, contractual challenge of requests by the provider, information of the practice. The detailed transfer assessment is delivered to each practice with its contract.
- Any change of sub-processor is notified to practices before it takes effect; practices may object under the terms of the contract.
Kia Privacy Policy · Terms of Service · privacy@ciaoalfred.com