Legal
Sub-Processors & Third-Party Controllers
Sub-Processors
The following entities process personal data on behalf of MedRAG under documented Data Processing Agreements:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (servers, network, encrypted storage) | Germany (Falkenstein) |
Third-Party Controllers
The following entities receive limited personal data as independent data controllers:
| Third Party | Purpose | Data Shared | Location | Privacy Policy |
|---|---|---|---|---|
| Mollie B.V. | Payment processing | Name, email, payment method | Netherlands | mollie.com/privacy |
Mollie acts as an independent controller under PSD2 financial regulations for payment transactions.
Key Principles
No US-based sub-processorsAll data remains within the European Economic Area.
No external AI/ML APIsAll embedding and reranking is performed on self-hosted infrastructure within Germany.
Minimal data sharingOnly billing-related data leaves MedRAG infrastructure — and only to Mollie for payment execution.
Change Notification
Per our Data Processing Agreement (Section 5), customers will be notified at least 30 days before any new sub-processor is added. Customers may object within this period.
Contact
Questions about our sub-processors: admin@medrag.eu