Sub-Processors
A complete list of third-party services that process data on behalf of A-X Software (operator of BioForge). We keep this list minimal and transparent.
Last updated: April 2026
Backend application hosting and PostgreSQL database infrastructure. Hosts the BioForge API, stores all application data including user accounts, training data, health records, genetic data, blood work, microbiome profiles, and AI-generated analyses.
Frontend hosting and global content delivery network. Serves the BioForge web application. No personal data is stored on Vercel servers — it delivers only the application code and static assets.
Large Language Model (LLM) provider for cross-domain health analysis, coaching, and recommendation generation. Processes only aggregate metrics computed by BioForge (training-load indices, recovery trends, periodization variables) and non-device health context (blood work summaries, genetic insights, microbiome composition, health records). Raw data obtained via third-party device APIs — including the Garmin Connect Developer Program API — is never transmitted. Operates under a zero-retention policy: data is processed and returned immediately, never stored, and never used for model training.
Semantic vector embeddings for the knowledge base search functionality. Processes text excerpts from scientific content (video transcriptions, extracted claims) to enable semantic search. Does not process raw health data, genetic data, or personally identifiable information.
Genomic foundation model inference (Evo 2, served via the NVIDIA BioNeMo NIM API). Scores the predicted functional impact of genetic variants and produces variant embeddings. Receives only short DNA sequence windows derived from uploaded variants (reference and alternate alleles plus surrounding genomic context); no athlete identifier accompanies these sequences. Processed under NVIDIA's NIM API terms.
Railway
EU (Netherlands)Backend application hosting and PostgreSQL database infrastructure. Hosts the BioForge API, stores all application data including user accounts, training data, health records, genetic data, blood work, microbiome profiles, and AI-generated analyses.
Vercel
Global (Edge)Frontend hosting and global content delivery network. Serves the BioForge web application. No personal data is stored on Vercel servers — it delivers only the application code and static assets.
Anthropic
United StatesLarge Language Model (LLM) provider for cross-domain health analysis, coaching, and recommendation generation. Processes only aggregate metrics computed by BioForge (training-load indices, recovery trends, periodization variables) and non-device health context (blood work summaries, genetic insights, microbiome composition, health records). Raw data obtained via third-party device APIs — including the Garmin Connect Developer Program API — is never transmitted. Operates under a zero-retention policy: data is processed and returned immediately, never stored, and never used for model training.
Voyage AI
United StatesSemantic vector embeddings for the knowledge base search functionality. Processes text excerpts from scientific content (video transcriptions, extracted claims) to enable semantic search. Does not process raw health data, genetic data, or personally identifiable information.
NVIDIA
United StatesGenomic foundation model inference (Evo 2, served via the NVIDIA BioNeMo NIM API). Scores the predicted functional impact of genetic variants and produces variant embeddings. Receives only short DNA sequence windows derived from uploaded variants (reference and alternate alleles plus surrounding genomic context); no athlete identifier accompanies these sequences. Processed under NVIDIA's NIM API terms.
International Transfer Safeguards
All sub-processors located outside the European Economic Area (EEA) operate under Standard Contractual Clauses (SCCs) approved by the European Commission. These clauses contractually obligate the sub-processor to protect your data to EU standards regardless of their physical location.
We assess the data protection laws and practices of each destination country before engagement and implement supplementary technical measures (encryption, pseudonymization) where necessary.
Notification Policy
We will notify users at least 30 days before adding any new sub-processor or making material changes to existing sub-processor arrangements. Notifications will be sent via email to your registered account address and posted on this page.
If you object to a new sub-processor, you may contact our DPO at dpo@bioforge.science to discuss your concerns or exercise your right to terminate the service.