Shifaia Healthby Union Pharmaceutical
Subprocessors

Who else touches the data

Saying “trusted service providers” without naming them tells you nothing. So here they are, named.

Last reviewed 20 August 2026 4 providers Union Pharmaceutical, Cairo العربية

These are the third parties that receive data from Shifaia Health in order for the app to work. We publish this because a clinician deciding whether to use a clinical tool is entitled to know who else touches the data.

None of them receives a patient identifier. Patient name, chart number and phone stay on your device and are excluded from everything the app sends. What these providers receive is de-identified clinical data — age, sex, symptoms, medications, findings — or, for the hosting provider, your professional account details.

Who receives what

ProviderPurposeReceivesProcessed in
Supabase
Supabase Inc.		 Database, authentication, file storage for prescription PDFs Your professional account data; de-identified consultation records; prescription PDFs you generate Frankfurt, Germany (EU)
Microsoft Azure
Azure OpenAI / AI Foundry		 The AI models that generate assessments, and the models used for background parsing tasks De-identified clinical text only. No account data, no identifiers. Sweden Central (EU)
Google
Gemini API		 A secondary model used for assessments and for extracting structured fields from pasted text De-identified clinical text only. No account data, no identifiers. Not region-pinned; may include the United States
Netlify Hosting for this website Website visits; emails previously submitted to the retired early-access waitlist Global content network

Two clarifications worth making

  • DeepSeek models do not go to DeepSeek. The app can route to DeepSeek-family models, but it reaches them through Microsoft Azure AI Foundry, where Microsoft hosts them. No data is sent to DeepSeek the company, and none goes to China.
  • WhatsApp is not a subprocessor. When you send a prescription to a patient, your own device opens WhatsApp and you send the message. We do not route it, and we never hold your patient’s phone number. The PDF is generated without the patient’s name for that reason.

Retention at the AI providers

Under Microsoft’s standard abuse monitoring, text sent to Azure OpenAI may be retained for up to 30 days so that misuse can be detected, then deleted. Microsoft offers an exemption from this (“Modified Abuse Monitoring”) which removes the retention entirely, subject to eligibility criteria.

We have not been granted it, and until we are, the 30 days above is what applies. We will update this page if that changes.

Neither Microsoft nor Google uses the data to train their models, and neither do we — see section 3a of the Privacy Policy.

Changes

We keep this page current and update it promptly when a provider is added or removed. If you would rather be told than have to check, email zeyad@shifaia.com and we will add you to the notification list.

The controller-facing summary of all of this is at For data controllers.

↑