Sub-processors
Sub-processors
Transparency about the third-party service providers we use to deliver our platform. This page is maintained as a living document and updated whenever changes occur.
Last updated: April 2026
About this page
Mena.ai ("MenaHealth Solutions, Lda.") engages certain third-party sub-processors to assist in providing our platform services. A sub-processor is a third-party data processor engaged by Mena.ai who has or potentially will have access to or process personal data provided by our users.
This page is maintained in accordance with Article 28(2) and (4) of the General Data Protection Regulation (GDPR). Our Terms and Conditions and Data Processing Agreement (DPA) reference this page for the authoritative and up-to-date list of sub-processors.
Current sub-processors
Google Cloud Platform (Google LLC)
Purpose: Cloud infrastructure and hosting — all platform data is hosted on GCP servers located in the European Union
Data processed: All platform data (encrypted at rest and in transit)
Location: EU (europe-west1)
Transfer mechanism: Data processed in EU; parent company in US covered by EU-US Data Privacy Framework + Standard Contractual Clauses (SCCs) + Transfer Impact Assessment (TIA)
Privacy policy: https://cloud.google.com/privacy
Stripe, Inc.
Purpose: Payment processing — subscription billing, invoicing, and payment method management
Data processed: Billing data, tax identification numbers, payment method details
Location: EU / US
Transfer mechanism: EU-US Data Privacy Framework (certified) + Standard Contractual Clauses (SCCs)
Privacy policy: https://stripe.com/privacy
PostHog, Inc.
Purpose: Product analytics — pseudonymized usage analysis to improve platform features and user experience
Data processed: Pseudonymized browsing and interaction data (no clinical or patient data)
Location: EU
Transfer mechanism: Data processed and stored in EU
Privacy policy: https://posthog.com/privacy
Cegid Vendus
Purpose: Invoicing and fiscal document issuance — compliance with Portuguese tax law
Data processed: Billing data, tax identification numbers (NIF)
Location: Portugal
Transfer mechanism: Data processed and stored in Portugal (no international transfer)
Privacy policy: https://www.vendus.pt/privacidade/
Change notification process
We will notify users by email at least 30 days before adding or replacing any sub-processor. Users have 15 days from notification to raise a reasoned objection. If a legitimate objection cannot be resolved, the user may terminate their contract without penalty.
To raise an objection to a new sub-processor, contact us at dpo@mena-ai.pt within 15 days of receiving the notification email.
Related documents
Contact
For questions about our sub-processors or data processing practices, contact our Data Protection Officer.