Към основното съдържание
MediSend
Open with codeRegister clinic
Open with code
← All review drafts
Archived draftNot effective

MediSend · 2026-10-12.review-1

Suppliers and subprocessors

An activity-based register; an integration does not establish an active contract or production region.

Draft date: Accepted versions remain unchanged.
Legal review required.

Draft for qualified Bulgarian/EU legal review. It is not effective and does not replace accepted documents. Reading it records no acceptance. Publication requires confirmed suppliers, retention periods and an approved notification and acceptance process.

Legal review required. Draft for qualified Bulgarian/EU legal review. It is not effective and does not replace accepted documents. Reading it records no acceptance. Publication requires confirmed suppliers, retention periods and an approved notification and acceptance process.

This earlier draft is preserved as written. It was not an accepted edition and has not been made effective.

Read draftRead current edition · v2026-09-02.2

1. Register status

This draft identifies code-supported integrations, not a verified list of active production suppliers. Before real data, the operator confirms the contracting entity, function, countries, DPA, onward recipients, retention and international transfers. Unknown suppliers are not represented as approved.

2. Storage and core infrastructure

Private local and S3-compatible storage are supported, including Amazon Web Services when configured. Data includes customer files and necessary metadata. Laravel API, PostgreSQL, Redis, backup and web-hosting suppliers, contracting entities and regions cannot be established from code alone and remain to be confirmed.

3. Email, SMS and security

Supported email integrations include Brevo and configurable SMTP/API services; SMSAPI is a supported SMS channel. They receive contact details and minimal service messages, which may contain a code/PIN in the selected flow. Contracting entities, processing, retention and onward recipients require verification.

Cloudflare Turnstile may process network and security signals on risk-sensitive forms. Sentry may receive limited sanitized technical errors when enabled. Neither is designed to receive medical content. Internally operated ClamAV is not a separate external recipient; an externally managed scanning service must be listed separately.

4. Payments and separate roles

Stripe supports explicitly initiated card payments and a customer portal. Data includes billing, plans, payments and fraud signals, not medical files. A payment supplier may independently control regulatory and security processing. A clinical-data supplier is a subprocessor only for the activity in which it actually assists MediSend.

5. Changes and transfers

The effective register must show verification dates, countries and the applicable mechanism for each service. New subprocessors follow the agreed DPA notification and objection process. No region, adequacy, certification or contractual protection is promised without evidence for the relevant account.