Last updated: 2026-10-06
GutFix Ltd acts as the data controller for personal data processed through the GutFix application and website. To deliver the service we engage the third-party processors listed below. We rely on each provider's standard data processing terms where it offers them. Telegram, which we use only for internal alerts, does not, so it never receives your name, email or anything you wrote.
When we add a sub-processor or change the data a sub-processor receives, we update this page and its “Last updated” date before the change takes effect, and for a material change we also tell customers by email where appropriate.
| Sub-processor | Purpose | Data shared | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Database & authentication | All user data (auth records, profile, health logs) | United Kingdom (AWS London, eu-west-2) | EU SCCs + UK Addendum |
| Anthropic | AI analysis & chat | Health context and your first name (no email address) | United States | EU SCCs + UK Addendum |
| OpenAI | Embeddings for knowledge base | Chat messages and intake text without your name or email (retained by OpenAI for up to 30 days for abuse monitoring) | United States | EU SCCs + UK Addendum |
| Modal | AI protocol-generation compute | Pseudonymous user ID, your intake answers and lab values (no name or email) | United States | EU SCCs + UK Addendum |
| Pinecone | Vector database for retrieval-augmented generation | Knowledge-base vectors plus per-member chat-memory vectors keyed by a pseudonymous user id (no name or email) | United States | EU SCCs + UK Addendum |
| Stripe | Payment processing & subscription billing | Payment data, customer ID, billing email | United States / EU | EU SCCs + UK Addendum |
| Whoop | Wearable biometric data integration | OAuth tokens (biometric data fetched on demand, user-authorised) | United States | EU SCCs + UK Addendum |
| Vercel | Application hosting & web analytics | Every request to our website and servers (IP address, browser, page address and what you send us), plus cookie-less page-view and speed statistics | United States | EU SCCs + UK Addendum |
| PostHog | Product analytics & conversion funnels | Page views, user interactions, session recordings (masked; on the website only after you consent, in the app only if you switch them on), and the product events our server records | EU (Frankfurt) | Within EU |
| Upstash | Rate limiting & caching (Redis) | Request counts keyed by your account ID or IP address | United States | EU SCCs + UK Addendum |
| Resend | Email delivery | Your email address and first name, the emails we send you (including your quiz plan PDF), which ones you get (this can depend on your quiz result), and when you click a link (and, for marketing emails, when you open an email) | United States | EU SCCs + UK Addendum |
| RevenueCat | Mobile subscription management (iOS/Android in-app purchases) | Purchase events, subscription status, pseudonymous app user ID | United States | EU SCCs + UK Addendum |
| Telegram | Internal operational alerts to the founding team | An 8-character member code, the type of alert (for example a cancellation), a 1-word reason category and numbers such as days active. Never names, emails or anything a member wrote | United Arab Emirates / distributed | None. Telegram has no data processing terms with us, so it gets only the fields listed |
| Sentry | Error monitoring & performance tracing | Error traces, session context (health data redacted) | United States / EU | EU SCCs + UK Addendum |
| Advertising conversion tracking | Page views, hashed email (sent only when you accept marketing cookies) | United States | EU SCCs + UK Addendum | |
| Meta (Facebook) | Advertising conversion tracking | Page views, conversion events and a hashed email at purchase (sent only when you accept marketing cookies) | United States / Ireland | EU SCCs + UK Addendum |
| X (Twitter) | Advertising conversion tracking | Page views, X click ID, hashed email at purchase (sent only when you accept marketing cookies) | United States | EU SCCs + UK Addendum |
| OpenAI (ChatGPT ads) | Advertising conversion tracking | Page views, ChatGPT ad click ID, browser identifier, hashed email at purchase (sent only when you accept marketing cookies) | United States | EU SCCs + UK Addendum |
| GoMarketMe | Credits app installs to our affiliate partners | Device and install details, the affiliate link you came from, and whether you subscribed (only if usage analytics is on in the app) | United States | EU SCCs + UK Addendum |
| Expo | Push notification delivery | Your device's push token and the text of each notification, which can include your first name and Gut Vitality score | United States | EU SCCs + UK Addendum |
| Google Workspace | Our email inbox (hello@gutfix.ai) and internal documents | Anything you email us, and our internal alerts about your account (which can include your name, email and what you wrote) | United States / EU | EU SCCs + UK Addendum |
Questions about a specific sub-processor?
Email hello@gutfix.ai. Read our full Privacy Policy for details on legal basis, retention, and your rights.
