Broby engages the following Sub-processors to process Customer Personal Data on the terms of this DPA. The current version of this list is also available on request from the DPO contact in Section 15.
| Sub-processor | Role | Region of processing |
|---|---|---|
| Anthropic, PBC (United States) | Claude AI models — radiology image analysis, differential diagnosis reasoning, transcript correction, agent reasoning | United States |
| OpenAI, L.L.C. (United States) | GPT-4 family — clinical text extraction, summarisation, classification, template parsing, radiology fallback | United States |
| A*STAR Institute for Infocomm Research (Singapore) | MERaLiON speech-recognition model — transcription (primary) | Singapore |
| Deepgram, Inc. (United States or EU) | Speech-recognition fallback | United States / EU |
| SenseVoice / FunAudioLLM (Alibaba open-weights model) | Cantonese speech-recognition fallback | Self-hosted on Broby infrastructure |
| Stripe Payments Singapore Pte. Ltd. and Stripe, Inc. | Subscription billing and payment processing | Singapore + United States |
| Functional Software, Inc. d/b/a Sentry (United States) | Application error monitoring | United States |
| Railway Corp. (United States) | Backend application hosting, managed PostgreSQL database, managed Redis cache, and object storage for audio, transcripts, and uploaded images | United States (current); migration to Singapore region planned |
Each Sub-processor is bound by a written data-processing agreement (or equivalent contractual obligations auto-incorporated through the Sub-processor's standard service terms) requiring it to process Customer Personal Data only on Broby's instructions and to apply security measures of a comparable standard to those set out in Annex B.