ChairFill does not run its own data centres. To deliver the Service we rely on the providers below. Each is engaged under a written contract with data protection obligations no less protective than those in our Data Processing Addendum, and we remain fully liable to your practice for what they do.
This page forms part of the DPA (Annex III). We give 30 days' notice before adding or replacing a provider. That notice goes automatically to every practice with an active account — nothing to subscribe to. Objections, or a request to copy the notice to an additional address, go to privacy@getchairfill.com.
These process patient data as a matter of course, because the Service runs on them.
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Cloudflare, Inc. United States |
Application hosting, serverless compute, caching, CDN, firewall, bot protection, inbound email routing | All traffic to the Service, and therefore all Personal Data in transit; short-lived cached availability data | Global edge network |
| Supabase, Inc. United States |
Primary database and account authentication | All stored Personal Data — patients, appointments, message history, consent records, practice accounts | Managed PostgreSQL — Frankfurt, Germany (Central EU region) |
| Google LLC United States |
Sign-in (OAuth); AI replies via Google Cloud Vertex AI; Google Calendar sync; Google Business Profile and reviews; Maps; speech synthesis; outbound email | Patient name, phone number, message content, appointment details; practice profile and review data | United States and global |
These receive patient data only for the channels your practice switches on. A practice that never enables SMS or voice sends no data to Twilio or Vapi.
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Meta Platforms, Inc. United States / Ireland |
WhatsApp Business Platform and Instagram messaging | Patient phone number or Instagram handle, and the content of messages exchanged with your practice | Global |
| Twilio Inc. United States |
SMS delivery and telephony for inbound calls | Patient phone number, SMS content, call metadata and audio | United States and global |
| Vapi United States |
Voice receptionist orchestration — speech recognition and speech synthesis during calls. Vapi engages Deepgram (speech-to-text) and ElevenLabs (text-to-speech) as its own sub-processors. | Call audio and transcripts, including anything the caller says | United States |
These receive your practice's business data. They do not receive patient data.
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Stripe, Inc. United States |
Card payments outside India | Practice billing contact and payment details. Card numbers go directly to Stripe and never reach ChairFill. | United States and global |
| Razorpay Software Private Limited India |
Card, UPI and net-banking payments in India | Practice billing contact and payment details | India |
| Functional Software, Inc. (Sentry) United States |
Application error monitoring | Technical diagnostics — error messages, stack traces, request paths. Not a patient data store, though an identifier can appear incidentally in an error payload. | United States |
Most of these providers are established in the United States, so Personal Data processed through ChairFill will generally leave the country your practice operates in.
For data protected by the UK or EU GDPR, transfers are made under the Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision — see section 13 of the DPA. Under India's DPDP Act, transfers are permitted except to territories the Central Government restricts.
If your practice is subject to an in-country data residency requirement — as health providers in the UAE and Saudi Arabia typically are — ChairFill does not currently meet it. Contact privacy@getchairfill.com before onboarding.
Objections and change notices: privacy@getchairfill.com
Related: Data Processing Addendum · Privacy Policy · Terms of Service