Agreements
Sub-processors
Lists the sub-processors ENA Innovation uses to provide the EnaResearch service and the providers used for the website.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This page lists the sub-processors that ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation") uses for personal data it processes on behalf of its customers (organizations or individuals using EnaResearch; each a "Customer") when providing the EnaResearch service. A sub-processor is a third-party service provider that processes data, which ENA Innovation processes as data processor, on ENA Innovation's behalf and on its instructions.
Each Customer uses its own Customer Environment running at organizationcode.enaresearch.com: a separate environment with its own application stack and its own database and database user. The providers below are used to operate these environments.
1. Sub-processors
| Sub-processor | Service | Data categories | Location |
|---|---|---|---|
| Huawei Cloud | Hosting of Customer Environments (virtual servers, managed PostgreSQL database, storage and backups) and of ENA Cloud services | All data in the Customer Environment: participant identity details, the hash of the identifier, device and health-platform data, clinical records, manually entered values, research variables and statistical results, study and participation records, organization users, audit records, backups | Region set in the agreement with the Customer |
| Logto | Authentication and invitations for organization users (owner, researcher) | Organization user's name, email address, roles, session information | Logto Cloud managed service, outside Türkiye |
| ENA Cloud (operated by ENA Innovation) | Organization discovery and notification gateway (email delivery) | Organization code; recipient email address and message content | On Huawei Cloud |
| Resend (through ENA Cloud) | Email delivery | Recipient email address and message content | USA |
| Sentry (only if enabled) | Error monitoring | Error records; configured not to send personal data | EU (Germany), Sentry's EU data region |
| Anthropic (only if the Customer enables the AI assistant) | Optional AI assistant for research analysis (suggesting tests, explaining results, drafting reports); off by default | Only aggregate study information (variable definitions, counts with small numbers suppressed, statistical test output) and text the researcher types; never participant-level records or identity data | USA |
Notes:
- ENA Cloud is a service operated by ENA Innovation itself; it is not a third party. It is shown in the list for transparency.
- Apple and Google are not sub-processors. Apple Health (HealthKit) and Health Connect data stays on the participant's device until the EnaResearch app on that device sends it to the Customer's environment; Apple and Google do not process this data on EnaResearch's behalf.
- Where available, wearable-device data is sent directly to the Customer's environment, either through a hub on the Customer's premises or through the participant's phone.
- The AI assistant is optional and off by default. Anthropic receives data only if the Customer enables the assistant, and then only aggregate study information and text the researcher types.
2. Providers used for the website
ENA Innovation is the data controller for the www.enaresearch.com website. The providers used for it do not process data in Customer Environments:
| Provider | Service | Location |
|---|---|---|
| Vercel | Website hosting; cookieless, aggregate visit and performance statistics | USA |
| Resend (through ENA Cloud) | Forwarding contact and demo form content to our team by email | USA |
3. International transfers
Transfers to sub-processors located abroad are made under Article 9 of Turkish Law No. 6698 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, relying on appropriate safeguards such as standard contracts. The safeguards used for Customers subject to the GDPR, the UK GDPR or the Swiss FADP are described in Section 17 of the Data Processing Agreement. See the Privacy Policy for details.
4. Changes
This list may change. Before adding a new sub-processor or replacing an existing one, ENA Innovation updates this page and notifies Customers within the period and in the manner set out in the Data Processing Agreement. Customers may object on reasonable grounds within the period provided in that agreement.
Questions: support@enainnovation.com