List of subprocessors
For the purpose of providing and maintaining the Odonta360 platform, Bolutions LTD engages the service providers listed in the table below. Each of them processes personal data solely for the purpose of providing its service to us and is bound by a personal data processing agreement.
This page constitutes Annex III to the Personal Data Processing Agreement (DPA) concluded with each practice. Practices are notified of any intended change to this list at least 30 days in advance, with a right to object.
| Subprocessor | Type of service | Country of processing / hosting | Data processed |
|---|---|---|---|
| Supabase (Supabase Inc.) | Database, authentication, file storage | Hosting: EU (Frankfurt); provider: USA | All Platform data, including medical records, photographs and diagnostic images |
| Vercel (Vercel Inc.) | Application hosting and delivery | Hosting: EU (Frankfurt); provider: USA | Data in transit, system logs, IP addresses |
| Meta Platforms Ireland Ltd. | WhatsApp, Instagram and Messenger channels — only if the practice connects them | EU / USA | Message content and sender account identifiers |
| Inngest | Execution of background jobs (scheduled tasks, queued processing) | USA | Job identifiers and metadata; for inbound message and e-mail processing, also the message content (text, sender name and contact details) until the message is written to the Platform. No dental record content, photographs or diagnostic images. |
| Botpress | Chatbot on the practice's website — optional | USA | Chatbot conversation transcripts |
| External integrations connected by the practice itself (webhook) | Forwarding of events to external automation tools | At the practice's choice | Only the data the practice chooses to forward; no integration is active by default |
| The practice's e-mail provider (IMAP/SMTP) | Receiving and sending the practice's e-mail through the Platform | At the practice's choice | E-mail content and attachments |
Transfers of data outside the European Economic Area
All production data of practices, including medical records, photographs and diagnostic images, is stored on servers within the European Union (Frankfurt, Federal Republic of Germany).
Subprocessors established outside the European Economic Area are engaged solely subject to appropriate safeguards for transfers to a third country — Standard Contractual Clauses (SCC) together with a transfer impact assessment — in accordance with Articles 63 to 65 of the Personal Data Protection Act (“Official Gazette of the RS”, No. 87/2018), that is, Articles 44 to 49 of the GDPR.
What we do not use
The Odonta360 Platform does not use artificial intelligence systems, advertising networks, tools for analysing user behaviour within the application, or payment processing within the Platform. No patient data is sent to providers of artificial intelligence services.
Contact
Questions concerning this list: office@odonta360.com