Theravo Subprocessors
Service providers used to operate Theravo and process data on behalf of practices.
Provider information
- Business name
- Theravo
- Proprietor
- Egidijus Girčys
- Business address
- Mies-van-der-Rohe-Str. 6
14469 Potsdam
Germany - Place of business
- Potsdam, Germany
- Contact
- hello@theravo.de
- Legal email
- legal@theravo.de
Current subprocessor list
The table identifies providers that Theravo currently uses as active or conditional subprocessors. A provider is not listed merely because an integration is technically available. A conditional provider receives personal data only where a practice has actually enabled and uses the relevant feature.
| Provider | Purpose | Data categories | Data subjects | Processing location | Third-country transfer | Patient data possible | Status | Condition of use |
|---|---|---|---|---|---|---|---|---|
| netcup GmbH | Data-centre, server and network infrastructure for the Theravo root server | Practice account data, appointment and patient data, messages, technical logs and backups stored in Theravo | Practice users, patients and website visitors | Nuremberg, Germany | No third-country transfer intended for this hosting service | Yes | Active | Continuously used service |
| Brevo / Sendinblue GmbH | Transactional delivery of account and appointment email | Sender and recipient addresses, names, subject lines, message content, delivery metadata and appointment-invitation attachments | Practice users, patients and prospective patients | European Union; documented onward transfers are subject to the provider agreement and applicable safeguards | Data-processing agreement and applicable transfer safeguards | Yes | Active | Continuously used service |
| OVH GmbH / OVHcloud | Hosting of Theravo-managed appointment mailboxes and inbound email transport | Sender and recipient addresses, names, subject lines, appointment-email content, message headers and attachment metadata | Practice users, patients and prospective patients | European Union under the configured mailbox service | Data-processing agreement and applicable provider terms | Yes | Active | Continuously used service |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payment processing for appointment bookings when a practice enables Stripe | Payment status, amount, currency, checkout and transaction references, patient email and name where required, and appointment association | Practice users and patients using paid booking | European Economic Area and, where required for the payment service, other processing locations documented by Stripe | Stripe data-processing terms, adequacy decisions, standard contractual clauses and additional safeguards where required | Yes | Only when the feature is enabled | Only for practices that enable payment processing through Stripe. |
Hosting infrastructure
Theravo is operated on a root server hosted by netcup GmbH in Nuremberg, Germany. netcup provides the data-centre, hardware, network and base infrastructure. Theravo remains responsible for the operating system, application configuration, access management, updates, backups, monitoring and application security.
Self-managed services
The application, database, appointment mailbox processing and the local language model are operated under Theravo's control on the root-server infrastructure. A locally executed software component is not a separate subprocessor merely because its software or model weights were developed by another organisation.
Optional services
Payment, email-delivery, monitoring, backup, content-delivery and other external providers are listed only where they are actually configured and can receive personal data. The status “only when the feature is enabled” means that the provider is used solely for practices and affected persons who use that feature.
Further processors in the service chain
A direct subprocessor may use further processors. For netcup, the further processors and change procedure identified in the current netcup DPA apply. Theravo documents and reviews this service chain in its internal provider register.
Provider due diligence and contract records
For every active or conditionally used provider, Theravo maintains an internal register recording the actual contracting entity, registered address, service, data categories, processing locations, DPA, TOMs, further subprocessors, transfer mechanism and last review date. The contracts actually concluded are authoritative; the public table is a plain-language summary.
Changes to subprocessors
Theravo gives practices reasonable prior notice of a new or replaced subprocessor where required by the Data Processing Agreement. Practices may object on reasonable data-protection grounds within the period stated in that notice.
Contact
Questions about subprocessors may be sent to privacy@theravo.de.