This is the archived copy of version 2026-10-27.1. It does not change. The current version is at /privacy/processing-schedule.
Version 2026-10-27.1 · Effective: 29 October 2026
This schedule forms part of the Data Processing Addendum and the Health Information Privacy Addendum. It lists the providers that process clinic information for Sumext's contractor invoice review features, and how long information is kept.
Service providers
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, user sign-in and private file storage | Tokyo, Japan |
| Vercel | Runs the Sumext application | Application functions run in Tokyo, Japan. Content delivery and logs may involve other countries. |
| Anthropic | AI reading of invoice lines | United States and other countries, under Anthropic's commercial terms, which do not permit training on our customers' data |
| GitHub and Google | Automated encrypted backups (encrypted before upload) | United States and other countries |
| Postmark and Twilio | Account emails and SMS notifications (no patient information) | United States |
The clinic's own accounting and booking systems (such as Xero, Noterro and Jobber) are controlled by the clinic and are not Sumext providers.
Retention
| Information | How long it is kept |
|---|---|
| Source invoices, derived files and appointment matching records | While the clinic uses the features, then returned or deleted within 30 days of the clinic stopping or asking us to. The clinic can request a shorter period. |
| Name-free audit and security records (including name-reveal logs) | 12 months |
| Encrypted backups | Up to 30 days in the active backup set, after which they are removed and permanently deleted within a further 30 days |
| Information we must keep by law | Only what is required, for as long as required. We tell the clinic what is kept and why. |
Deletion covers stored records, original and generated files, and queued tasks. If a backup is restored, earlier deletions are re-applied before the data is used.
Changes
We give at least 14 days' notice of a new provider or location that affects this information, where practical, as described in section 5 of the DPA.
Contact: support@sumext.com