Last updated: June 2026
Atlacare uses the third-party service providers below (“sub-processors”) to deliver its service. Each one processes personal data on our behalf under a Data Processing Agreement that meets UK GDPR and EU GDPR Article 28 requirements. We store data exclusively in EU regions and require the same of our sub-processors wherever possible.
| Sub-processor | Purpose | Data processed | Region | DPA |
|---|---|---|---|---|
| Railway | Application hosting, PostgreSQL database & Redis | All application data — patient records, clinical notes, appointments, invoices, account data | EU (West) | View DPA → |
| Cloudflare | File storage (R2), CDN & DNS | Uploaded files (patient documents, clinic logos), static assets | EU | View DPA → |
| Stripe | Subscription billing & payment processing | Billing contact, payment card details (held by Stripe, never by Atlacare), subscription status | EU / global (Stripe Payments Europe) | View DPA → |
| The SMS Works | SMS appointment reminders & notifications | Recipient mobile number + message content (patient first name, appointment date/time, clinic name, reschedule link). No clinical data. | UK (Cyber Essentials certified) | View DPA → |
| Daily.co | Video consultations | Live audio/video stream during a consultation (not recorded), participant names | EU only (Frankfurt) — eu_region_only enforced | View DPA → |
| Resend | Transactional email (confirmations, reminders, magic links, invoices) | Recipient name & email address, email content (appointment details) | EU | View DPA → |
| Loops | Clinic-facing marketing & lifecycle email (onboarding, product updates, waitlist). Never used for patient email. | Clinic account-owner name & email, plan/subscription status, product engagement. No patient data. | US (transfers under SCCs / DPA) | View DPA → |
| Anthropic | AI features (clinical note assistance) | Text submitted to AI features. Not used to train models. No persistent storage of patient data. | EU / US (zero-retention API) | View DPA → |
| Sentry | Error monitoring & application diagnostics | Technical error data only — PHI is explicitly excluded from all logs | EU (sentry.io EU data residency) | View DPA → |
We will update this page whenever we add or remove a sub-processor. Clinics on a current Data Processing Agreement can request advance notice of material changes to our sub-processors.
For questions about our sub-processors or your data rights, email hello@atlacare.com.