Service providers and recipients
Information about services identified in the Lens Portal setup and the confirmations needed for their use.
Verification status at 31 October 2026. The portal currently uses a Lovable Pro workspace with a Lovable Cloud backend. Lovable's published information says its standard data processing agreement is included on Business and Enterprise plans. Its published terms and standard data processing agreement also restrict sensitive information unless an appropriate written permission applies.
Eyewear has not yet confirmed a separate agreement permitting the current handling of patient health information. We are confirming the contractual coverage, the relevant processing locations and safeguards. A higher plan alone must not be assumed to permit health information. Publication of this inventory, customer acceptance of Eyewear's terms or a patient's consent does not resolve those provider requirements.
The optional AI assistant and document extraction functions have been paused for staff and customers while written provider permission is being sought. Previously stored information remains subject to the retention and rights processes. The provider review also covers the hosted backend, so the AI pause does not resolve the wider agreement issue. Contact lab@itseyewear.com for the status of this work and the appropriate processing arrangements.
1. Infrastructure and AI services
Lovable Labs Incorporated
Identified use: website hosting and delivery, provider visitor analytics, the Lovable Cloud backend environment and email service connections. The optional assistant and document extraction functions used its AI gateway before being paused.
Information involved: account and technical information; visit and page measurement information; database and stored file information handled through the hosted environment; recipients and content for emails sent through its service; and content previously submitted through the AI features.
Lovable collects the visitor measurements through its hosting service. See the visitor analytics notice for the provider's published description and current controls.
Location information: the published contracting entity is in the United States. Lovable uses infrastructure and model providers in its delivery chain. The precise region and applicable support and model processing locations for this deployment remain to be confirmed. No UK only location promise is made.
Published terms · Published data processing agreement · Provider's subprocessor information
Supabase infrastructure through Lovable Cloud
Identified use: authentication, database and file storage services. The current backend is provisioned within Lovable Cloud. This entry does not state that Eyewear has a separate direct Supabase account agreement for that backend.
Information involved: account and session information, orders, prescription and job records, uploaded files, conversation records and relevant service logs.
Location information: Supabase's published customer data processing addendum identifies Supabase Pte. Ltd. and its provider list includes international support and infrastructure. A provider's corporate location is not the same as the project's primary storage region. The applicable legal entities, region and onward access arrangements in the Lovable service chain must be confirmed.
Published Supabase data processing information · Supabase provider list
Google Gemini through Lovable's AI gateway
Identified use: the provider in the current model configuration for the optional assistant and document extraction functions, which are currently paused for all staff and customer accounts.
Information involved before the pause: submitted prompts and conversation history, relevant order context and full uploaded documents. Automatic removal of all patient identifiers was not provided. Stored records of earlier use may remain.
Contract and location information: the receiving Google entity, service tier, retention settings, processing locations and applicable terms must be established through Lovable's arrangements. This entry does not assert that a particular Google regional hosting commitment, training exclusion or direct Eyewear contract applies.
2. Laboratories and suppliers
The portal supports connections to GKB and Deepcove / OptiSwiss supplier workflows, including Solenzara based order submission and status communication. The selected laboratory receives the information required for the job sent to it, such as order references, prescription values, lens specifications, frame information and relevant instructions.
The supplier shown on the job identifies the intended commercial recipient. Its exact legal entity, relevant service providers, location and role must be recorded for the processing arrangement. A supplier may process instructions on behalf of a customer or have independent responsibilities for particular activities. This inventory does not assign every laboratory one role without considering those activities.
The use of a Solenzara connection does not itself establish the contractual role of the software operator or prove where every supplier stores its information. We will provide the available confirmed recipient details for your jobs on request.
3. Other services and internal systems
Google Fonts. The main portal can request fonts from Google, disclosing the network and browser request information needed to retrieve them. This is an external resource service, not a recipient appointed to manufacture a lens. The static policy pages do not import Google Fonts. See cookies and browser storage.
Eyewear workshop and stock systems. Relevant work and stock information may move between the portal and Eyewear's own workshop systems. Eyewear Ltd remains the organisation handling that internal activity. The infrastructure used by each system must also be included in the provider review.
Accounting workflows. Necessary billing information may be exported or entered into the business's accounting records. Ask us which accounting service is used for your account if you need recipient details. This inventory does not state that patient records are routinely shared with an accounting provider.
4. Provider changes and authorisation
For processing covered by an agreed data processing agreement, the initial authorised provider schedule must be recorded with that agreement. Proposed new or replacement subprocessors will be communicated to the customer's recorded contact with a reasonable opportunity to raise data protection objections before the new processing begins.
Provider links above describe the provider's published information. They do not replace Eyewear's duty to establish the appropriate contract, assess the relevant service and confirm the requirements for international transfers.
5. Requests and objections
Email lab@itseyewear.com to request confirmed details for your service or to raise a reasoned data protection objection. Identify the business account and relevant service or supplier. Do not include unnecessary patient information in the request.