Sub-processors
Effective date: 2026-07-30 · Last updated: 2026-09-12 · Version: 1.1
VETRA LLC uses a small number of third-party providers to operate mySEHA. This page lists every one of them, what each does, what data it receives, and where it processes that data.
We publish this because you cannot meaningfully consent to how your health data is handled without knowing who handles it. We update this page when a provider is added, removed or changed.
We do not sell your personal data. We do not share your health information with advertisers or data brokers. We use no advertising, attribution or third-party analytics services in either the app or this website.
1. The mySEHA app
| Provider | Role | Data it receives | Where |
|---|---|---|---|
| Supabase (on Amazon Web Services) | Database, file storage, authentication, backend functions | All account and health data, and every document you upload | Ireland (EU) |
| Anthropic, PBC | AI analysis of results; reading text from uploaded documents | Biomarker values and health context; the images of lab reports, prescriptions and scans you upload, including any name or clinic printed on them | United States |
| Google (Gemini) | Transcribing a voice note into text; matching a food you search for that we cannot match ourselves | The audio of the voice note, and the food name you typed. No identifier and none of your health records are sent | United States; Google may process data in any country where it has facilities |
| Twilio | Delivering login codes by SMS | Your phone number and the code | United States / global carriers |
| Meta Platforms (WhatsApp Business) | Delivering login codes by WhatsApp, where enabled | Your phone number and the code | United States |
| Brevo | Service and transactional email | Your email address, first name and language. An instruction to send each email, including a separate "critical finding" email when a lab analysis contains one — so Brevo learns that your email address has a critical lab result. The first name of a family member you add, and the sign-in method, date and time when you add or remove a way of signing in | European Union |
| RevenueCat | Handling in-app purchases on Apple devices | Your account identifier and the details of each purchase: store, transaction identifier, product, price and currency. Never card or bank details, which stay with Apple | United States |
| Sentry | Crash and error diagnostics | Diagnostic events, your account identifier, and the names of screens visited. Configured to exclude health values | Germany (EU) |
| Expo | Delivering push notifications | Your notification token and the text of the notification — which, when a lab analysis completes, names your laboratory and states how many results fall outside the usual range. Medication reminders are scheduled by your own device and never reach Expo | United States |
| Cloudflare | Protecting sign-in against automated abuse | Challenge signals and your IP address | Global network |
| Apple | Sign in with Apple; app distribution; Apple Health access on your device | Sign-in identifier. Apple Health data is read on your device and is never sent back to Apple by us | United States |
| Google Sign-In; app distribution; Health Connect access on your device | Sign-in identifier. Health Connect data is read on your device | United States | |
| USDA FoodData Central | Looking up the nutritional composition of a food | A food search term only. No identifier and no health data are sent | United States |
2. The mySEHA website
| Provider | Role | Data it receives | Where |
|---|---|---|---|
| Cloudflare | Hosting, content delivery, security, and the human-verification challenge on our forms | Standard technical data including IP address; challenge signals | Global network |
| Brevo | Storing waitlist contacts and sending launch emails | Your email address, language, sign-up date, referral code, and the optional interest you select | European Union |
| Railway | Hosting our content management system | No user or health data. It holds our published health-education content only | United States / EU |
| Supabase | Database for the content management system | No user or health data — this is a separate system from the app database and cannot reach it | Sweden (EU) |
| GitHub | Source code and deployment | No user or health data | United States |
3. Two things worth understanding
The website and the app do not share a database. The public website and our content system run on entirely separate infrastructure, with no connection to the database holding your health records. The website reads published health-education content at build time through a restricted, read-only credential. This is a structural separation, not a policy commitment: a compromise of the website reaches no health data because there is no route from one to the other.
Our AI providers can read your data. They have to — a service that explains your lab results cannot keep those results secret from the system doing the explaining. Under our agreement with Anthropic, data sent to its API is retained for up to 7 days for operational and safety purposes and is not used to train its models. Under Google’s terms for paid use of its API, which is how we use Gemini, Google does not use the data to improve its products and logs it for a limited period to detect misuse. We do not use end-to-end encryption and we will never claim that we or our providers are unable to see your data.
4. Changes
We will update this page whenever we add, remove or replace a provider that processes personal data. Where a change materially affects how your health data is handled, we will also tell you in the app.
Questions about anything on this page: privacy@myseha.ai. How we use the data these providers process is described in our App Privacy Policy and our Website Privacy Policy.
This policy is also available in Arabic. In case of any conflict between the English and Arabic versions, the English version prevails.