Sub-processors
Last updated: 2026-07-01
To run NOYU we rely on a small number of trusted third-party services ("sub-processors") that process personal data on our behalf. Each is bound by a data protection contract and may only use your data on our instructions and for the purpose shown below.
Where a sub-processor is outside the UK or EEA, transfers are protected by appropriate safeguards (such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision), as described in our Privacy Policy.
AI providers
Anthropic
United StatesGenerates your advice, insights, reports, and food-photo analysis.
Data: Relevant Health Data and Member Content, plus your first name, age, sex, ethnicity, height, and weight. No surname, email, phone, address, or date of birth.
Google (Gemini)
United StatesGenerates your reports and some insights.
Data: Relevant Health Data and Member Content, plus the demographics above.
OpenAI
United StatesTranscribes voice notes and checks messages for harmful content before NOYU responds.
Data: Voice recordings you choose to transcribe and the text of your messages to NOYU.
Hosting and storage
Neon
European UnionManaged database that stores your account and health data.
Data: All member data held at rest.
Amazon Web Services (AWS)
European UnionStores raw data from connected sources and files you upload (such as food photos).
Data: Wearable payloads, uploaded images, and documents.
Vercel
United States (with EU edge)Hosts our website and app, and routes our requests to the AI providers above (AI Gateway).
Data: App infrastructure; transient routing of AI requests.
Wearables and connections
Terra
United States / European UnionConnects wearables and health apps you choose to link (Garmin, Oura, Apple Health, Strava, Runna, Coros, and others).
Data: Sleep, activity, heart, body, and workout metrics from your connected devices.
Google (Calendar)
United StatesIf you connect it, lets NOYU take upcoming races and events into account.
Data: Calendar event titles, dates, times, and locations.
Apple
United StatesSign in with Apple, and push notifications to your iOS device.
Data: Authentication token and device push tokens.
Blood testing
Randox Health
United KingdomProcesses blood samples and returns results, where you take a test.
Data: Name, date of birth, sex, contact and address details, relevant health history, and biomarker results.
Tuli Health
United KingdomBooks blood tests and delivers results, where you take a test.
Data: Name, email, date of birth, sex, and address details.
Payments
Stripe
European Union / United StatesProcesses payments if you buy a blood test.
Data: Name, email, and payment status. Card details go directly to Stripe - we never see or store your full card number.
Communications and support
Resend
United StatesSends account emails and, if you opt in, marketing emails.
Data: Email address and name.
Crisp
European UnionPowers our in-app support chat.
Data: Name, email, and the messages you send our support team.
Analytics and operations
PostHog
European UnionProduct analytics to help us understand and improve NOYU.
Data: Usage events and interactions. Not your Health Data.
Slack
United StatesInternal team alerts and handling of member feedback.
Data: Operational alerts and any feedback you choose to send us.
Changes to this list
We will update this page before adding any new sub-processor that handles your personal data. If you have questions about a sub-processor or a transfer safeguard, email hello@noyu.health.