Loading Clinical Data...
Loading Clinical Data...
Legal
Where COA platform data technically lives today, and who has access to it. This page adds detail on top of the Privacy Policy (§4).
⚠ Draft — pending review by Cameroonian legal counsel. This describes our current technical architecture; it is not a compliance attestation.
This page lists, for informational purposes, the technical infrastructure and vendors ("subprocessors") that process data as part of the COA platform. It was written by the engineering team and has not yet been reviewed by legal counsel. It is neither a formal GDPR register nor a legal compliance attestation — those remain counsel pending.
If you are a partner facility or legal counsel and need further detail or a formal Data Processing Agreement (DPA), contact us at [email protected].
Data entered by clinical staff is first written to an encrypted local cache on the device (workstation, tablet), letting the facility keep working without internet access.
When connectivity returns, the device synchronises queued changes to the COA platform API.
The API and database (Google Cloud / Firebase, region us-central1 — United States) process and store the synced data. See section 3 for the subprocessor detail.
Access is governed by the platform's role-based permission model (RBAC). COA staff only access clinical data for platform operation and support, per the agreements in place with each facility.
API hosting, authentication and database (Firestore). Current region: us-central1 (United States). African hosting is under active exploration, with no confirmed deployment date.
Hosting and CDN delivery for the coa-platform.com website itself — distinct from the product API above.
SANDBOX (test) environment only at this stage — no real payment data is processed in production. Final payment provider selection and the corresponding data-processing agreement are still pending.
Plausible / Fathom, enabled only with your explicit consent to non-essential cookies (see the Cookie Policy). No analytics domain is currently configured in production — analytics is not active on the site today.
A formal GDPR subprocessor register with applicable transfer legal bases.
Signed Data Processing Agreements (DPAs) with each vendor listed above.
Confirmation of a timeline for local or regional African hosting.
Review of this page by Cameroonian legal counsel before any contractual use.