Sub-processors
Sub-processors
Transparency about the categories of third-party service providers we use to deliver our platform. This page is maintained as a living document and updated whenever changes occur.
Last updated: August 2026
About this page
Mena.ai ("MENAHEALTH SOLUTIONS, LDA") engages certain third-party sub-processors to assist in providing our platform services. A sub-processor is a third-party data processor engaged by Mena.ai who has or potentially will have access to or process personal data provided by our users. This page describes, for general transparency purposes, the categories of sub-processors we use.
The detailed, binding list of sub-processors, as required under Article 28(2) and (4) of the GDPR, is set out in Annex II-B of our Data Processing Agreement (DPA) and is made available to customers and prospective customers as part of contracting our services.
Sub-processor categories
Cloud Infrastructure & Hosting
Purpose: Platform hosting, including servers, storage and the Artificial Intelligence models used by the service
Data processed: All platform data (encrypted at rest and in transit)
Location: European Union
Transfer mechanism: Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework, where applicable
Payment Processing
Purpose: Payment processing, subscription billing and payment method management
Data processed: Billing data and payment method details
Location: European Union / United States
Transfer mechanism: EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs)
Product Analytics
Purpose: Usage analysis to improve platform features and user experience
Data processed: Pseudonymized browsing and interaction data (no clinical or patient data)
Location: European Union
Transfer mechanism: Data processed and stored in the EU
Invoicing & Tax Compliance
Purpose: Issuance of fiscal documents in compliance with Portuguese tax law
Data processed: Billing data and tax identification number (NIF)
Location: Portugal
Transfer mechanism: Data processed and stored in Portugal (no international transfer)
For the identification of each specific sub-processor, exact location and applicable transfer mechanisms, see Annex II-B of our Data Processing Agreement, available at platform.mena-ai.pt/subprocessors
Change notification process
We will notify users by email at least 30 days before adding or replacing any sub-processor. Users have 15 days from notification to raise a reasoned objection. If a legitimate objection cannot be resolved, the user may terminate their contract without penalty.
To raise an objection to a new sub-processor, contact us at dpo@mena-ai.pt within 15 days of receiving the notification email.
Related documents
Contact
For questions about our sub-processors or data processing practices, contact our Data Protection Officer.