Vendors

Sub-processors

Last updated · 21 April 2026Version · 2026.04-rev1Governing law · Republic of Ghana

This page is the authoritative, always-current list of third-party services Vedge engages to deliver the platform. It is incorporated by reference into every tenant’s Data Processing Agreement as Annex II.

We notify tenants by email at least 30 days before adding or replacing a sub-processor. To subscribe to change notifications, email legal@tryvedge.com with subject “sub-processor updates”.

Current sub-processors

Vendor	Purpose	Data	Location	Transfer	PHI?
Amazon Web Services EMEA SARL vendor DPA	Infrastructure hosting — application servers, database, object storage	All tenant data, including PHI	af-south-1 (Cape Town) / eu-west-1 (Ireland)	Standard Contractual Clauses + Data Processing Addendum	Yes
Cloudflare, Inc. vendor DPA	CDN + DDoS mitigation + object storage (R2) for uploaded documents	Uploaded documents (lab reports, imaging PDFs, ID scans) Request metadata	United States (global edge)	Standard Contractual Clauses + DPA	Yes
OpenAI, LLC vendor DPA	Optional AI-assisted diagnostic support (tenant-opt-in only)	De-identified clinical prompts submitted by practitioners	United States	Zero-data-retention agreement + SCCs	Yes
Resend, Inc. vendor DPA	Transactional email delivery (appointment reminders, lab results, notifications)	Recipient email, sender, subject, body	United States	Standard Contractual Clauses + DPA	No
mNotify Ltd vendor DPA	SMS delivery (appointment reminders, patient welcome, critical alerts)	Recipient phone number, sender ID, message body (no clinical content)	Ghana	N/A — intra-jurisdiction	No
Paystack Payments Limited vendor DPA	Card + mobile money payment processing (Ghana + Nigeria)	Payer name, email, amount, currency, card/MoMo instrument metadata	Nigeria	Intra-African processor + SCCs	No
Flutterwave Technology Solutions Ltd vendor DPA	Card + mobile money payment processing (pan-African)	Payer name, email, amount, currency, payment instrument metadata	Nigeria / United States	SCCs	No
Stripe Payments Europe Ltd vendor DPA	Card payment processing (international / premium tenants)	Payer name, email, amount, currency, card instrument metadata	Ireland / United States	Standard Contractual Clauses + DPA	No
Daily.co, Inc. vendor DPA	Teleconsultation video rooms (feature-gated)	Room metadata, participant identifiers, no recordings retained	United States	SCCs	No

Flow-down obligations

Every sub-processor above is bound by a contractual DPA with terms at least as strict as our tenant DPA — including confidentiality, security measures, breach notification, and sub-processor change notice. Vedge remains liable to tenants for sub-processor performance under the limits set in our Terms of Service.

Objection rights

Tenants may object to a new sub-processor on reasonable data protection grounds within 30 days of notification. If the objection cannot be resolved, the tenant may terminate the subscription for convenience with pro-rata refund of prepaid fees — see Terms §7 (sub-processor clause of the DPA).