Subprocessors
Last updated: June 6, 2026
Rahatok L.L.C. ("Rahatok," "we," "us," or "our") engages third-party companies — "subprocessors" — to help deliver our Services. A subprocessor is a third party that processes personal data on our behalf, under our instructions and a data processing agreement, in support of providing our WhatsApp appointment-booking platform to clinics ("Clients") and their patients.
This page lists the subprocessors we currently use, the purpose of each engagement, the categories of personal data involved, and where the processing takes place. It is the canonical list referenced by our Privacy Policy and our Data Processing Agreement (DPA).
Current subprocessors
| Subprocessor | Purpose | Personal data processed | Processing location |
|---|---|---|---|
|
Google Cloud Platform Firestore & Vertex AI (Gemini) Google Cloud EMEA Limited / Google LLC |
Primary database for appointment data, and AI natural-language processing of patient messages via Vertex AI (Gemini). Message content is processed via API and is not used to train foundational models. | Patient name, phone number, appointment time; patient message content (processed in transit). | European Union — europe-west1 (Belgium). |
|
Make make.com Make / Celonis |
Workflow automation — orchestrating and routing booking data between WhatsApp, the AI layer, and our database. | Patient name, phone number, appointment details (in transit); automation execution logs. | European Union (EU data region). |
|
Meta Platforms WhatsApp Business Platform (Cloud API) Meta Platforms Ireland Limited |
Delivery of WhatsApp messages between patients and clinics. Rahatok operates as a registered Tech Provider.Tech Provider — in review | Patient phone number, message content (in transit). | Global (EU / United States). |
|
Twilio WhatsApp Business Solution Provider (BSP) Twilio Inc. |
Business Solution Provider connectivity for sending and receiving WhatsApp Business messages. | Patient phone number, message content (in transit). | United States (with EU processing options). |
|
Google Workspace Google Ireland Limited / Google LLC |
Business email, document storage, and internal collaboration used to operate and support the Services. | Contact details contained in correspondence (names, email addresses, phone numbers). | Global (EU / United States). |
|
Cloudflare Cloudflare, Inc. |
Website hosting, content delivery network (CDN), DNS, and edge security / DDoS protection. | IP addresses and request metadata (server and security logs). | Global (distributed edge network). |
|
Lemon Squeezy Merchant of Record Lemon Squeezy, LLC |
Payment processing and Merchant of Record — billing, tax handling, and invoicing for subscriptions. Lemon Squeezy is the legal seller of record; Rahatok does not store payment card details. | Billing name, billing address, country, payment card details, email address. | United States. |
|
Fillout fillout.com Restly, Inc. |
Sales and contact forms — collecting inquiries from prospective clinic clients who request information, a demo, or access to Rahatok (e.g. via our website contact and registration flows). | Name, email address, phone number, clinic or business name, and other details voluntarily submitted through our sales forms. | United States. |
Data residency & international transfers
Patient appointment data is stored in the European Union (Google Cloud europe-west1), and our automation layer (Make) runs on an EU data region. Some subprocessors — notably Twilio, Cloudflare, Lemon Squeezy, and Fillout — operate globally or from the United States, and certain processing therefore takes place outside the EU. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and each provider's data protection commitments.
Clients remain responsible for verifying that these cross-border data flows are permissible under their applicable healthcare data residency, patient privacy, and Ministry of Health regulations. Rahatok provides this documentation to assist Clients in their own compliance assessments but does not warrant compliance with any specific national healthcare regulatory regime.
AI processing of patient messages
Patient messages may transit through our AI service provider (Google Vertex AI / Gemini) for natural-language understanding, and through our workflow automation provider (Make) for routing. Patient message content is processed via API and is not used to train foundational AI models. Standard API retention is limited to short-term abuse-monitoring windows (typically up to 30 days). Rahatok does not store medical records, diagnoses, or chat transcripts.
Changes to this list
We may update our subprocessors as our Services evolve. When we add or replace a subprocessor that processes Client personal data, we will update this page and, where required by our DPA, notify affected Clients in advance and provide a reasonable opportunity to object. We encourage you to review this page periodically.
Contact
Questions about our subprocessors or data processing can be directed to:
Rahatok L.L.C.
Email: privacy@rahatok.com