Subprocessors

Customers under a data processing agreement receive advance notice of any addition to this list, with a window to object. The notice period and objection mechanism are set out in the DPA.

This is what we deliver.

• Cloud infrastructure and hosting — compute, storage and networking, UK regions. Processes: platform data including patient identifiable data.
• Error and performance monitoring — application telemetry. Processes: operational metadata, configured to exclude patient identifiable data.
• Transactional email — delivery of account and notification email. Processes: business contact data only.
• Customer relationship management — sales and support records. Processes: business contact data only.

Only sub-processors explicitly designated as patient-data-handling receive patient identifiable data, and each is bound by a downstream agreement no less protective than our own Article 28 DPA. The remainder are contractually and technically scoped to business contact data and operational telemetry.