Sub-processors
Ask Leida Ltd uses the following sub-processors to process personal data on behalf of its customers in providing the Leida service. We will give customers at least 30 days’ notice by email before adding or replacing a sub-processor.
Last updated: 16 October 2026
| Sub-processor | Purpose | Data | Location | Transfer mechanism | Safeguards |
|---|---|---|---|---|---|
| Supabase Pte Ltd | Database, authentication and file storage | All practitioner and client records, including health-related information (skin type and concerns, notes, and any pregnancy, breastfeeding or medication information the practitioner enters). Passwords are held as hashes. | Stored in the EU (Stockholm, Sweden). Provider based in Singapore. | EU storage (covered by UK adequacy regulations); the provider’s DPA includes standard contractual clauses for any restricted transfer. | Encryption at rest (AES-256) and in transit (TLS). Row-level access controls so each practitioner sees only their own clients. |
| Vercel Inc. | Hosting and serverless functions for app.askleida.com and founder.askleida.com | Data in transit through the application’s functions (client records and routine pages). Not stored by Vercel. | Functions run in Stockholm. Provider based in the USA; its content delivery network is global but serves static files only. | The provider’s DPA with standard contractual clauses and UK Addendum. The provider is also certified under the EU-U.S. Data Privacy Framework, which it states covers UK transfers. | TLS and HSTS on all domains. Personal data is served by functions in the EU, not cached at the edge. |
| Anthropic Ireland, Limited | AI drafting of the opening message, closing message and per-product explanation in a routine (Claude API) | Skin type, skin concerns, the practitioner’s skin overview, any context entered when creating a routine, and product details and usage notes. No name, email address or date of birth. The practitioner’s personal notes about a client are never sent. Practitioners are asked not to enter client names in free-text boxes. | Contracting entity in Ireland. Processing in the USA. | Anthropic’s DPA, incorporating standard contractual clauses and the UK Addendum. | Requests exclude name, email address and date of birth. Inputs and outputs are retained for up to 30 days for safety purposes and are not used to train models. |
| Plus Five Five, Inc. (Resend) | Service emails, such as password resets | Practitioner email addresses and the content of service emails. | Data held in the EU (Ireland). Provider based in the USA. | Standard contractual clauses under the provider’s DPA. | TLS in transit. Emails sent from askleida.com. |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical error reports only (where the error happened, the page address with IDs removed, browser and device type, with no names, emails, client details, entered content or AI inputs and outputs). | Data held in the EU (Germany). Provider based in the USA. | Sentry’s DPA with standard contractual clauses and the UK Addendum. | Personal data collection switched off and IDs and emails removed before a report leaves the app. Errors only, no session recording. |
| Elemental App Solutions LLC | Development, maintenance and support of the Leida app | Access to practitioner and client records, including health-related information, only when needed to develop, maintain and support the Leida app. | USA. The data stays in Leida’s EU-hosted systems and is accessed remotely. | The UK International Data Transfer Agreement (IDTA) issued by the ICO. | Written contract with confidentiality obligations. Development work uses a separate staging database with test data. Two-factor authentication on every account that can access production systems. |
Questions: hello@askleida.com. See also our privacy policy.