Sub-processor Register
Every third party that processes ClinicalHIS data — what it does, what it receives, where it is.
Last updated: 17 October 2026
Under our DPA (Annex B), Claridad Health Solutions engages the sub-processors below to operate ClinicalHIS. Which entries apply to a given hospital depends on its deployment model: tenant-local hospitals (data on their own servers) rely only on the central services they actually use; EU-cloud hospitals are covered by the full list. Entries marked “intra-group” are Claridad group entities. This register is the operative disclosure: if a change alters what personal data is disclosed or where it is processed, hospitals get at least 30 days' notice and a right to object (DPA section 5.2).
| Sub-processor | Purpose | Data disclosed | Location |
|---|---|---|---|
| Contabo GmbH (EU hosting) | Hosting of the ClinicalHIS application, database, file storage and local backups. | All platform data (server hosting). | Germany / France (EU) |
| Claridad Health Solutions — clinicalris.com (intra-group) | Radiology services (RIS/PACS): order routing, reading and reporting support for hospitals that enable the radiology link. | Imaging orders carry patient hospital number, first/last name, date of birth, sex and order details; reports and images for routed studies return to ClinicalHIS. Image/report exchange is enabled per hospital. | United States |
| WhatsApp / Meta Platforms (via self-hosted WAHA gateway or Meta Cloud API) | Patient/staff messaging: appointment reminders, notifications, one-time codes and announcements where the hospital enables it. | Recipient phone number and message content (content depends on the hospital's templates and may include the patient's name). | Ireland / US |
| Textbee / Twilio (SMS gateways) | SMS notifications and one-time codes where the hospital enables it. | Recipient phone number and message text. | Provider infrastructure (US) |
| Paystack / Stripe / Flutterwave (payment processors) | Payment collection for bills and subscriptions. | Transaction amount and currency; payer email (Flutterwave also receives the payer name). No clinical data. | Nigeria / Ghana · US · Nigeria |
| Email (SMTP) provider | System and clinical email: portal credentials, critical-result alerts, notifications. | Recipient email address and message content; clinical emails may include patient identifiers where clinically necessary. | Per configuration |
| Chat support widget (brandedclaws.com) | Public-website support chat. | Visitor IP, user agent and pages visited on the public website. Not the hospital platform. | Provider infrastructure |
| Google Fonts (tenant branding only) | Font delivery when a hospital configures custom brand typography. | Visitor IP (standard web request). | Google infrastructure (global) |
| Jitsi meeting server (hospital-configured) | Telemedicine video consultations. | Call metadata and participant identifiers for consultations routed to the configured server. | Per hospital configuration |
The highlighted row is the intra-group radiology transfer to clinicalris.com described in the privacy policy and DPA (Annex B).
Services that process no personal data
Exchange-rate feed (open.er-api.com) receives only a currency code. QR codes for check-in verification are generated locally in your browser — the external QR service previously used has been eliminated.
Removed
goqr.me (api.qrserver.com) QR rendering — eliminated; QR codes are now generated locally. NHIA claim-adapter scaffolding — not enabled and sends no data while inactive.
Last updated: 17 October 2026
Questions or objections regarding a sub-processor: privacy@clinicalhis.com.