Loading
These terms, under Article 28 of the UK GDPR, apply only to a separately contracted organisation module whose order names the customer as controller and Sumrex as processor. They do not apply to our direct consumer service, which is covered by our privacy notice.
Last updated 3 October 2026 · Chronix Health Group Ltd (company no. 16663224)
For the content listed in the signed organisation order, you are the controller and Chronix Health Group Ltd (company no. 16663224) (“Sumrex”, “we”) is the processor. The order states the subject matter, duration, nature and purpose of the processing, the types of data, any special-category data, the data subjects and your documented instructions. These terms do not change our role for any activity where we in fact act as controller or joint controller.
We process this information only on your documented instructions, which are the actions you take in the product and these terms. This includes transfers. The exception is where the law requires otherwise, in which case we tell you unless the law forbids it. We never use this information for our own purposes, for analytics, for product improvement or to train any AI model. If we believe an instruction breaches data-protection law, we will tell you.
Everyone we authorise to process this information is bound by a duty of confidentiality and accesses it only where needed to provide the service.
We maintain appropriate technical and organisational measures, including encryption in transit and at rest and access controls that limit each account to its own data.
You authorise us to use the sub-processors below. We impose data-protection terms on each that are no less protective than these, and we remain responsible for their performance. We will give you advance notice of any addition or replacement so that you can object.
| Sub-processor | What it does | Location / transfer basis |
|---|---|---|
| Supabase | Database and authentication, where your records are stored | UK/EU |
| Vercel | Application hosting; information passes through in transit and is not stored there | US (UK–US Data Bridge; IDTA fallback) |
| Cloudflare | DNS for sumrex.app, and a backup copy of the documents uploaded to Sumrex | EU for the document backup copy; US-headquartered (UK Addendum to the EU Standard Contractual Clauses) |
| Resend | Sends the emails Sumrex sends; it handles the address and the message | US (UK–US Data Bridge; UK Addendum fallback) |
| Anthropic | The optional in-app assistant; processes only what you type into it | US (UK–US Data Bridge; IDTA fallback) |
Taking into account the nature of the processing, we help you respond to requests from the people you record: access, correction, erasure, restriction, objection and portability. The product lets you view, edit, export and delete the information directly. For anything more, contact privacy@sumrex.app.
Taking into account the information available to us, we help you with your obligations under Articles 32 to 36: security, breach notification, data-protection impact assessments and prior consultation.
We will tell you without undue delay after becoming aware of a personal-data breach affecting this information, with the details you need to meet your own notification duties.
When your contract ends, or at your request, we delete or return this information and delete existing copies. The exception is where the law requires us to keep a record, and then we keep only what the law requires, for no longer than it requires.
We make available the information needed to show compliance with these terms. On reasonable notice and subject to confidentiality, we allow for and contribute to audits of the processing we carry out for you.