Subprocessors

1. About this list

This list identifies providers that may process personal data for Symbiote Fitness Ltd when delivering the service. A provider receives only the data reasonably needed for its role. Availability and routing can vary by feature.

2. Amazon Web Services, Inc. and affiliates

Purpose: cloud hosting, databases, object storage, authentication, secrets, queues, email delivery, transcription, security, monitoring, backups, and AI services through Amazon Bedrock and Bedrock AgentCore.

Data: account, coaching, health, content, communications, technical, and usage data as required by the feature.

Primary region: United States, us-east-1. Bedrock inference can route within the US through a geographic cross-region profile. CloudFront website delivery uses a global edge network. Safeguards: contractual terms and lawful UK transfer mechanism where required.

3. OpenAI and its contracting affiliates

Purpose: AI model inference for text and image features and creation of knowledge embeddings. Realtime voice is not enabled for initial launch.

Data: prompts, relevant conversation and coaching context, user-provided media or extracted content, and generated output. We configure provider use for API service delivery and do not authorise public-model training on private service data.

Location: United States and other documented processing locations, independently of our AWS hosting region. Standard API abuse-monitoring records may retain prompts and outputs for up to 30 days, subject to endpoint-specific rules and provider exceptions. No zero-data-retention or EU-only processing commitment is made. Safeguards: contractual terms and lawful UK transfer mechanism where required.

4. Pinecone Systems, Inc.

Purpose: coach-scoped vector storage and retrieval for knowledge-base content.

Data: embeddings, chunk text, document metadata, tenant identifiers, and retrieval metadata.

Location: the production knowledge index is configured on AWS in the United States, us-east-1; provider support and administrative processing can use other documented locations. Safeguards: contractual terms and lawful UK transfer mechanism where required.

5. Cohere Technologies, Inc. through AWS Bedrock

Purpose: reranking retrieved knowledge to improve relevance.

Data: search query and candidate text passages required for reranking.

Processing route: invoked through AWS Bedrock where configured.

6. Stripe, Inc. and affiliates

Purpose: subscriptions, payments, Stripe Connect, payouts, invoices, fraud prevention, and payment support.

Data: identity, contact, business, billing, transaction, limited usage, and payment data. Stripe independently controls some processing required for regulated payment services.

Location: United Kingdom, United States, and other documented locations. Safeguards: Stripe contractual terms and lawful transfer mechanisms.

7. Functional Software, Inc. (Sentry), deferred

Sentry is not enabled for initial launch and will not receive production diagnostic data at launch. AWS provides operational logging and monitoring. We will update this list and applicable privacy information before enabling Sentry in the live service. Session replay is disabled.

8. Not enabled at initial launch

Twilio (WhatsApp messaging) and ElevenLabs (custom voice cloning and speech generation) are not enabled for initial launch. Historical development data may remain until an authorised user deletes or disconnects it. We will update this list and applicable privacy information before enabling either provider in the live service.

9. External product database and images: Open Food Facts

Purpose: barcode product lookup and display of public product images. Open Food Facts is an external product-data service; this entry describes the actual data flow and does not assert that it processes data solely under our instructions.

Data: our server sends the barcode number to world.openfoodfacts.org. It does not send your account credentials, private coaching content or uploaded photos. When a product image is shown, the browser requests it directly from images.openfoodfacts.org or static.openfoodfacts.org, exposing your IP address, browser and device headers, and product-image path to that service. The no-referrer policy suppresses the referring page address but does not hide your IP address or other request headers.

Manual food entry does not require a barcode lookup or product-image request. These external requests are separate from AI analysis of a food photo you upload.

10. Changes and objections

Coaches may subscribe to material subprocessor updates by contacting support@symbiotefitness.com. Where the Data Processing Agreement applies, we will give reasonable advance notice of a new subprocessor and handle reasonable data-protection objections under that agreement.