Legal
Subprocessors & data processing
Effective 2026-06-04
DuoVitals uses carefully selected infrastructure and service providers to operate the Service. This page lists subprocessors that may process personal data on our behalf, and summarizes our approach to data processing agreements (DPAs).
1. Overview
We act as the data controller for personal data you provide when using DuoVitals. Certain tasks — hosting, email delivery, analytics (when you opt in), and retrieving data from Oura — are performed by subprocessors under contractual obligations to protect your data and process it only on our instructions.
We do not sell your health data. Subprocessors receive only the minimum data needed for their specific function.
2. Subprocessor list
The following subprocessors may process personal data when you use the Service:
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Self-hosted infrastructure (Coolify VPS) | Application hosting, background workers | United States (operator-selected region) | All service data in transit and at rest on our servers |
| PostgreSQL (managed via hosting provider) | Primary database — accounts, cached Oura data, partner links | Same region as application hosting | All persisted application data |
| Redis (managed via hosting provider) | Background job queue and rate limiting | Same region as application hosting | Transient job metadata only — no health metrics |
| Oura Health Oy | Source of health data via official OAuth API | Finland / EU | OAuth tokens (encrypted at rest) and API requests for your Oura data |
| Resend, Inc. | Transactional email (partner score alerts, weekly digest) | United States | Recipient email address and notification content only |
| Plausible Insights OÜ (optional) | Privacy-friendly page-view analytics when you opt in | EU | Anonymous page URLs and referrer — no health data, no ad tracking |
| Infisical, Inc. | Secrets management for production configuration | United States | Infrastructure credentials only — not user health data |
Plausible Analytics is loaded only if you choose "Accept analytics" in our cookie banner. Essential-only users are not tracked.
3. Data processing agreements
Where required by applicable law (including GDPR Article 28), we maintain written data processing terms with subprocessors that handle personal data on our behalf. These agreements require subprocessors to:
- Process data only according to our documented instructions
- Implement appropriate technical and organizational security measures
- Assist with data subject requests and breach notification where applicable
- Delete or return data when the processing relationship ends
Enterprise or EU-based customers who need a copy of our DPA or standard contractual clauses may contact us at hello@duovitals.app. We will respond within a reasonable timeframe.
4. Changes to subprocessors
We may add or replace subprocessors as the Service evolves. Material changes will be reflected on this page with an updated effective date. Where required by law, we will notify registered users before engaging a new subprocessor that processes personal data.
5. Contact
Questions about subprocessors or data processing? Email hello@duovitals.app.
Questions? See also Why DuoVitals.