A sub-processor is a third party that Atlacare uses to process data on your behalf. Under UK GDPR you're entitled to know who they are. Here's a plain-language summary of each one and what it handles.
Atlacare's sub-processors
- Hosting & database (Railway, EEA region). Runs the Atlacare application and stores your core records — patients, appointments, notes, and invoices — within the EEA.
- File storage (Cloudflare R2, EU region). Stores uploaded files, letters, and logos in the EU. Files are only ever served through short-lived signed links, never public URLs.
- Email (Resend, EU). Sends the transactional email Atlacare sends on your behalf — confirmations, reminders, invoices, and magic links.
- SMS (The SMS Works, UK). Sends text-message reminders and messages. Only relevant if you switch SMS on. No clinical data is included.
- Payments (Stripe). Processes your clinic's Atlacare subscription payments. Card details go to Stripe, not to Atlacare. Taking card payments from patients isn't available yet.
- Error monitoring (Sentry, EU region). Captures technical error reports so we can fix problems. Patient health information is filtered out before anything is sent.
- Calendar sync (Google). Only if a practitioner connects their own Google Calendar. Atlacare reads the start and end times of their events to block busy slots, and adds Atlacare appointments titled "Atlacare appointment" with no patient details by default. Microsoft Outlook sync is coming soon and will work the same way.
- Video (Daily.co, UK: London). Runs video consultations. Live audio and video pass through it during a call, with the participants' names. Calls are never recorded.
- Lifecycle email to clinic owners (Loops, US). Product and account email to clinic account owners only. No patient data and no patient email addresses are ever sent to Loops. The transfer is covered by the Standard Contractual Clauses and the UK International Data Transfer Addendum.
- Website analytics (Google Analytics). Only on public pages and the patient portal, only with the visitor's consent, and never on the clinic dashboard or admin area.
- No AI provider. Atlacare has no AI features and sends nothing to any AI service.
What these providers never receive
Atlacare does not send patient health information to marketing tools, and never uses patient data to train AI. Transactional providers (email, SMS) receive only what's needed to deliver a message — a name, an appointment time, an amount.
Keeping this current
The formal, up-to-date list — with each provider's role, data categories and region — is on our sub-processors page. That's the page to check for a due-diligence request or your own records. Clinics on our Data Processing Addendum get at least 30 days' notice before we add a new sub-processor.
Need this confirmed in writing for a client or a data protection impact assessment? Use the Help button in the top bar and we'll help.