List of Subprocessors
Last updated: 25 October 2026
Applies to: the Zura Health OS mobile application and related services ("Zura")
1. Introduction
Zura Health OS ("Zura", "we", "us", "our") is operated by Zura Health UG (haftungsbeschränkt), Heinrich-Egger Straße 8, 85614 Kirchseeon, Germany, registered with the Local Court (Amtsgericht) of Munich under HRB 316115, which acts as the controller within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").
To deliver the Zura service, we rely on a number of third-party service providers that process personal data on our behalf and under our instructions. Under Article 28 of the GDPR these providers are our processors; where they engage their own providers, those are subprocessors. This document lists the processors and subprocessors we use, the purpose of each, the categories of personal data involved, where the processing takes place, and the safeguard that applies to any transfer outside the European Economic Area ("EEA").
This list is referenced by, and forms part of the context of, the Zura Privacy Policy.
2. How we manage subprocessors
- We have entered into a written data processing agreement ("DPA") with each provider; each DPA imposes the obligations required by Article 28 GDPR.
- Where a provider processes personal data outside the EEA, we have an approved transfer mechanism in place — an EU adequacy decision, the EU Standard Contractual Clauses ("SCCs"), or the EU–US Data Privacy Framework where the provider is certified — together with supplementary measures such as encryption in transit and at rest.
- We keep this list current. If we add or replace a subprocessor that materially affects the processing of your personal data, we will update this page and, where required, notify you in advance through the application or by email so that you can exercise any rights you have.
3. Current subprocessors
3.1 Hosting and core infrastructure
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) | Cloud hosting of the backend application, the primary PostgreSQL database, the Redis cache/queue, container infrastructure, the AI inference service, private storage for the photos and documents you upload (Amazon S3, since 2 October 2026), service emails (Amazon SES), server logs (Amazon CloudWatch), load-balancer access logs and a record of each access to the photos and documents you upload (AWS CloudTrail); hosting of our website, of the messages and pilot-programme applications sent through its forms and of the screenshots attached to bug reports (Amazon ECS, Amazon RDS, Amazon S3); delivery of exercise videos and food images to the App, and of the Android test version of the App offered on our website (Amazon CloudFront) | Account and profile data, user-generated content, health data, conversation history, photos and documents you upload, email addresses for service emails, technical logs, including load-balancer access logs and records of access to your uploaded files, which contain your device's IP address; messages, pilot-programme applications and bug-report screenshots sent through our website; for content delivery (Amazon CloudFront), your IP address and technical request data, without any account identifier | EU — eu-central-1 (Frankfurt, Germany) | Processing within the EEA; SCCs for any incidental support access from outside the EEA; for CloudFront edge locations outside the EEA, the AWS GDPR Data Processing Addendum with SCCs and the EU–US Data Privacy Framework |
| Anthropic (Anthropic, PBC, United States) | Claude Code, the AI coding assistant our team uses to build, operate and fix the Services | Personal data that appears in server logs, error reports or database records that a team member opens while fixing a problem, which can include account identifiers, email addresses and health details; nothing is sent to it automatically | United States | Anthropic Data Processing Addendum (part of Anthropic's Commercial Terms for our Claude Team plan) + SCCs; Anthropic does not use this data to train its models |
| Self-hosted Open Wearables instance (operated by Zura) | Zura's own deployment of the Open Wearables integration platform, used to import wearable/health data | Health and activity data from connected wearables | Zura infrastructure on AWS eu-central-1 | Processing within the EEA |
| GitHub (GitHub, Inc., United States) | Hosting of our source code and of the automated checks and deployments that run on it | Email addresses, and in a few cases names, of pilot testers and test accounts that appear in our source code and its history; no other user data | United States | GitHub Data Protection Agreement + SCCs |
3.2 Storage
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud Storage (Google Cloud EMEA Limited / Google Ireland Limited) | Private, access-controlled object storage for temporary files for the nightly batch AI insights, deleted after each run; it also serves the exercise pictures shown in the App | Summaries of workout, nutrition, health and cycle data; the device's IP address when an exercise picture loads | European Union for the AI-insight files; United States (Google Cloud multi-region) for the exercise pictures | Processing within the EEA for the AI-insight files; for the exercise pictures, Google Cloud Data Processing Addendum + SCCs and the EU–US Data Privacy Framework |
3.3 Artificial intelligence
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Google — Vertex AI (Google Cloud EMEA Limited / Google Ireland Limited) | Google Cloud's Vertex AI service powers the Zura coach, food recognition, reading the health documents you upload, generating workout and meal plans, and personalised insights | Conversation content, voice transcripts, food photos, health documents you upload, context from your profile, check-ins, cycle tracking and wearable data, the times of your calendar entries (without their titles or places), the town and gym you have chosen in the App and the weather forecast for that town, prompt text; we do not add your name or email address to these requests | Google Cloud — European Union; our systems send these requests only to EU regions | Google Cloud DPA + SCCs; inputs may not be used to train the models and are held only temporarily as part of providing the service |
| Google — Live API on Vertex AI (Google Cloud EMEA Limited / Google Ireland Limited) | Real-time multimodal voice processing for live voice conversations with the Zura coach | Live audio of your conversation with the Zura coach, and the model's audio and text response | Google Cloud — European Union (europe-west4) | Google DPA + SCCs; Google contractually prohibited from using inputs to train its models; we do not record or store the audio |
3.4 Wearable and health-data integrations
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Apple — HealthKit (Apple Inc.) | On-device health data store on iOS; supplies health data the user authorises Zura to read | Health and activity data (steps, heart rate, sleep, workouts, etc.) | Read on the user's device; governed by Apple's platform terms | Data is accessed on-device with the user's explicit permission |
| Google — Health Connect (Google Ireland Limited) | On-device health data store on Android; supplies health data the user authorises Zura to read | Health and activity data (steps, heart rate, HRV, sleep, weight, body fat, calories, hydration, etc.) | Read on the user's device; governed by Google's platform terms | Data is accessed on-device with the user's explicit permission |
Note on wearable providers. When you connect a wearable through Open Wearables, data is fetched from the wearable provider's own servers (the providers currently offered in the App are Google Health, Oura and Polar). Those providers are independent of Zura, act under their own terms and privacy policies, and may host data outside the EEA. We are not responsible for their processing.
3.5 Analytics, monitoring and messaging (Firebase, Google Analytics and Sentry)
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Google — Firebase Analytics (Google Ireland Limited) | Measures feature and screen usage and basic session information; enabled only with consent | App event/usage data, pseudonymous app-instance identifier, device and OS information, pseudonymous user ID and general profile attributes (age group, gender, country, goals) | Google global infrastructure, including the United States | Google Ads/Measurement DPA + SCCs; EU–US Data Privacy Framework where applicable |
| Google — Firebase Crashlytics (Google Ireland Limited) | Crash and error reporting to detect and fix defects | Crash diagnostics, device state, OS/app version, pseudonymous identifiers, including the user ID | Google global infrastructure, including the United States | Google DPA + SCCs |
| Google — Firebase Performance Monitoring (Google Ireland Limited) | Measures app start-up time, network response times and stability; enabled only with consent | Performance metrics, device and network information, addresses of the App's requests to our servers | Google global infrastructure, including the United States | Google DPA + SCCs |
| Google — Firebase Cloud Messaging (Google Ireland Limited) | Delivers push notifications to Android and iOS devices (on iOS through Apple's Push Notification service) | Push-notification tokens, device identifiers, notification text | Google global infrastructure, including the United States | Google DPA + SCCs |
| Google — Firebase Remote Config (Google Ireland Limited) | Remote feature configuration | App-instance identifier, basic device information | Google global infrastructure, including the United States | Google DPA + SCCs |
| Apple — Apple Push Notification service (Apple Inc.) | Delivers push notifications to iOS devices, forwarded by Firebase Cloud Messaging | Push-notification device tokens | Apple infrastructure, including the United States | Apple DPA + SCCs |
| Sentry (Functional Software, Inc., United States) | Error and performance monitoring for our servers (backend and its background jobs, AI service and voice assistant), to find and fix defects and slow responses | Technical error reports and performance data (the duration of requests, background jobs and the steps of Zura's replies; for Zura, also the AI model used and the number of tokens processed, but not the content of messages or replies), which can include a pseudonymous user ID in the address of a request; we configure Sentry not to collect request contents and to filter out health-related fields | Sentry EU data region (Germany) | Sentry DPA + SCCs |
| Google — Google Analytics for our website (Google Ireland Limited) | Measures how our website zurahealthos.com is used; Google Analytics is loaded only after you accept analytics in the website's cookie banner; until then, nothing is sent to Google | IP address, browser and device information, the address and title of the pages visited and a pseudonymous cookie identifier | Google global infrastructure, including the United States | Google Ads Data Processing Terms + SCCs; EU–US Data Privacy Framework where applicable |
3.6 Authentication (used only if you choose social sign-in)
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Google — Sign-In (Google Ireland Limited) | Lets you create or access your account with your Google account | Name, email address, Google account identifier, profile basics | Google global infrastructure, including the United States | Google DPA + SCCs |
| Apple — Sign in with Apple (Apple Inc.) | Lets you create or access your account with your Apple ID; when you delete your account, we ask Apple to end that sign-in | Name, email (or Apple private relay address), Apple account identifier; a sign-in token from Apple, which we keep encrypted until Apple has ended the sign-in | Apple infrastructure, including the United States | Apple DPA + SCCs |
3.7 Payments
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Apple — In-App Purchase (Apple Inc.) | Processing of subscriptions purchased on iOS | Apple account identifier, purchase and subscription records | Apple infrastructure, including the United States | Apple processes in-app purchases under its own terms as an independent controller; Apple DPA + SCCs for any processing on our behalf |
| Google — Play billing (Google Ireland Limited) | Processing of subscriptions purchased on Android | Google account identifier, purchase and subscription records | Google infrastructure, including the United States | Google processes Play purchases under its own terms; Google DPA + SCCs for any processing on our behalf |
| RevenueCat (RevenueCat, Inc., United States) | Manages subscriptions bought in the App: receives the purchase, renewal, cancellation and refund records from the App Store and Google Play and tells our servers whether you have an active subscription | Your Zura user ID (a pseudonymous identifier) and the purchase and subscription records provided by Apple or Google | United States | RevenueCat DPA + SCCs |
3.8 Transactional and business email
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg) | Delivery of service emails, currently password-reset codes, and, since 14 October 2026, the emails our website sends to our team about the messages, feature requests and bug reports you send through its contact forms and about applications to our pilot programme | Email address and the content of the email; for the emails from our website, your name, email address and the content of the form, including a link to any screenshot (for pilot-programme applications also age range, city, phone number or messenger ID and the answers given) | EU — eu-central-1 (Frankfurt, Germany) | Processing within the EEA |
| Google Workspace (Google Cloud EMEA Limited / Google Ireland Limited) | Our business email, including info@zurahealthos.com, which we use to receive and answer your messages, support requests and requests about your personal data | Your name and email address, the content of your emails to us and of our replies, and any attachments | Google global infrastructure, including the United States | Google Cloud Data Processing Addendum + SCCs; EU–US Data Privacy Framework |
3.9 Real-time voice infrastructure
| Subprocessor | Purpose | Personal data categories | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Self-hosted LiveKit server (operated by Zura) | Real-time voice transport and orchestration for live voice conversations with the Zura coach (WebRTC transport layer to Vertex AI; the audio is not recorded) | Live audio stream of your voice conversation; session connection metadata; profile context passed to the voice assistant | Zura infrastructure on AWS eu-central-1 | Processing within the EEA; no session recording |
4. Application distribution
Test builds of the application are distributed through Apple TestFlight (Apple Inc.) on iOS and, on Android, as a direct download from our website, delivered through Amazon CloudFront (see Section 3.1). Release builds are distributed through the Apple App Store (Apple Inc.) and the Google Play Store (Google Ireland Limited). Apple and Google process account and device identifiers to deliver the application and, where you obtain the app through them, operate as independent controllers under their own terms and privacy policies.
5. Third-party content (not personal-data subprocessors)
The following services are used to display content and are not our processors. They receive no account identifier from us; where the App loads content directly from them, as described below, they receive your device's IP address and technical request data; they are listed for transparency:
- Unsplash — supplies stock photos of meals and ingredients. Our servers search Unsplash using only the name of the dish or ingredient; when the App shows such a photo, it loads it directly from Unsplash, which receives your device's IP address and technical request data.
- YouTube (Google) — certain exercise and meditation videos, and videos in Zura's feed, are shown through an embedded YouTube player in privacy-enhanced mode, and some exercise previews are images loaded from YouTube. When such a player or preview image is shown (an exercise demonstration can start by itself during a workout), YouTube receives your device's IP address and technical request data and may collect data from the device under Google's own privacy policy.
- Publishers in Zura's feed — the pictures that accompany the articles, videos and podcasts in Zura's feed are loaded directly from the publishers' own servers, which receive your device's IP address and technical request data when a picture is shown. Articles and podcasts you choose to open are opened in your browser or another app, under the publisher's own terms.
- MuscleWiki — supplies many of the exercise descriptions and videos in the App. When a video plays, our servers fetch it from MuscleWiki and pass it on to the App without keeping a copy, so MuscleWiki receives neither your IP address nor any account identifier.
- Open Food Facts, USDA FoodData Central and FatSecret — food searches and barcode look-ups are sent from our servers with the search text or barcode only, without any account identifier. Where the App shows a product photo from Open Food Facts, it loads the photo directly from Open Food Facts' servers, which then receive your device's IP address and technical request data.
- OpenStreetMap and MET Norway — when you choose your town or look for your gym in the App, our servers send the place name you type, or an approximate location rounded to about one kilometre, to OpenStreetMap's Nominatim service (and, if it does not answer, to a public Overpass server), and fetch the weather forecast for that approximate location from the Norwegian Meteorological Institute (MET Norway). These requests come from our servers and carry neither your IP address nor any account identifier.
6. Contact
Questions about this list or about our use of subprocessors can be sent to info@zurahealthos.com.