Statura CareBook a demo

Subprocessor Schedule

Approved subprocessors grounded in the live stack.

This schedule identifies the third-party vendors Statura uses to host, operate, monitor, message, bill, or support the service where those vendors may process customer data or service metadata.

Last updated: 27 May 2026

This schedule identifies the approved subprocessors substantiated in the current production codebase and live delivery stack as at the version date.

Approved subprocessors

Scroll the table sideways to see all columns.

VendorService purposeTypical data involvedLocation note
SupabasePrimary application database, authentication, storage, and backend platform servicesCore customer records, authentication data, application data, audit logs, stored filesPrimary production project configured in Sydney, Australia
VercelWeb and portal hosting, edge delivery, deployment infrastructure, and operational logs for hosted frontendsRequest metadata, limited application telemetry, support diagnostics, content served through hosted web appsHosting and edge services provided through Vercel infrastructure
GoogleWebsite analytics and advertising conversion measurement where configuredWebsite usage events, page views, device and browser metadata, IP-derived approximate location, advertising click identifiers, and conversion eventsService may process data outside Australia
SentryError monitoring, crash reporting, and operational diagnostics for web and mobile applicationsError traces, request metadata, device metadata, diagnostic context after Statura scrubbing and filtering controlsSentry ingestion currently configured through US-hosted endpoints
ResendTransactional email delivery for notifications, invitations, and service communicationsEmail address, message metadata, message content required for delivery, bounce and delivery eventsService may process data outside Australia
TwilioSMS delivery and telehealth/video token infrastructure where enabledPhone numbers, message metadata and content, telehealth participant metadata, session identifiersService may process data outside Australia
StripeSubscription billing, invoicing, checkout, and payment-administration workflows where enabledBilling contact details, billing metadata, subscription status, invoice records; payment card data handled by Stripe directlyService may process data outside Australia

Notes on scope

  1. This schedule is limited to subprocessors evidenced in the current Statura codebase and live production delivery path.
  2. Some platform vendors may process only limited metadata rather than full application content.
  3. Mobile app distribution through Apple and Google app stores is not listed here as a core customer-data subprocessor for platform operations. Those stores govern app distribution, device installation, and store-account interactions under their own terms.

How updates are handled

  1. Statura may update this schedule from time to time as the service evolves.
  2. If Statura intends to add a materially new subprocessor that is reasonably likely to affect customer-data risk, Statura will update this schedule and, where required by the customer agreement, give notice through the service, email, or another reasonable channel.
  3. If the customer reasonably objects to a materially new subprocessor on documented privacy, confidentiality, or security grounds, the customer must notify Statura within 15 business days after the update notice. The parties will act in good faith to discuss a reasonable alternative or mitigation.
  4. If the parties cannot resolve a reasonable objection to a materially new subprocessor, the customer may terminate the affected service or module on written notice without penalty for the unused future portion of the affected prepaid fees.
  5. Continued use of the service after the effective date of an updated schedule constitutes acceptance of the updated schedule, subject to any rights in the customer agreement.

Related documents

Contact