Sard Sub-processors
Last updated:
These are the third parties that process data on Sard's behalf. Taken from the project configuration and the dependency tree, not from memory. When one is added, this page changes in the same release.
| Provider | What it does | What it processes | Where |
|---|---|---|---|
| Google Cloud / Firebase | Database | All patient and consultation data | Dammam, Saudi Arabia. No Google region exists in Jordan |
| Google Cloud / Firebase | Sign-in | Clinician email, password hash, access permissions. No patient data | Google-managed; not selectable by us |
| Google Cloud / Firebase | File storage | Consultation audio recordings | Doha, Qatar. A different country from the database — file storage has no Dammam region |
| Google Cloud / Firebase | Our server code | Runs the model calls. Audio is passed by reference and never travels through it | Doha, Qatar |
| Google — Gemini | Speech to text, and drafting the note | The consultation audio and the full transcript | Not yet confirmed. We will not state a region we have not verified. |
| Google — reCAPTCHA Enterprise | Proving a request comes from our app | Device and browser signals. No patient data | Google-managed |
| Cloudflare | Domain and email routing | Email metadata for addresses at sardscribe.com. No clinical content | Global |
| Resend | Sends our account emails — verification codes, password resets | A clinician's email address and a six-digit code. No patient data | United States |
What is not here
Worth saying plainly, because the absence is itself a fact: no analytics, no advertising network, no error-reporting service, no support or chat widget, no CRM, no payment processor, and no third-party scripts in the application at all. Adding a session-replay or analytics tool to a page that shows patient data would be a change in posture, not a routine dependency, and it would appear here first.
The one that matters
Every consultation sends the patient's recorded voice and the complete transcript to Google for processing. That is not an optional integration; it is how the product works. Two things about it are still being established with counsel — the processing region, and whether the applicable terms are adequate for health data under Jordan's PDPL — and this page will say so until they are settled rather than say something comfortable in the meantime.
Questions: [email protected].