Legal
Sub-processors and Service Providers
Last updated: October 2026
How we work with third-party providers
Atlacare Ltd uses the third-party service providers below to provide and operate parts of the Atlacare service.
Depending on the service and the data involved, these providers may act as our processors or as independent controllers. Where a provider acts as our processor, we require appropriate contractual data protection safeguards meeting UK GDPR Article 28, and we remain responsible to our customers for their performance. Where a provider acts as an independent controller for some or all of the data — for example a payment provider meeting its own regulatory obligations — that provider is responsible for its own processing under its own terms.
Data residency
Clinical and patient data is hosted and stored within the European Economic Area, apart from the two UK-based providers named below, subject to limited remote access from outside the UK/EEA where necessary for support, security or incident response and protected by appropriate safeguards.
Two providers operate in the UK rather than the EEA: The SMS Works (SMS delivery) and Daily.co, whose video rooms are pinned to its London (UK) region. Video consultations are never recorded.
One provider (Loops) is located in the United States. It is used only for marketing and lifecycle email to clinic account owners. No patient clinical data and no patient email addresses are sent to Loops. That transfer is covered by the Standard Contractual Clauses and the UK International Data Transfer Addendum.
Current providers
| Provider | Purpose | Categories of data | Region | Role |
|---|---|---|---|---|
| Railway | Application hosting and database | Practice and patient records held in the Service, and account data | EEA (configured hosting region) | Processor |
| Cloudflare | File storage, content delivery and DNS | Files uploaded by the clinic, and technical/network data | EEA / service-dependent | Role varies — processor for stored files; independent controller for certain network security data |
| Stripe | Subscription billing and payment processing | Billing contact and subscription details; card details are held by Stripe and never by Atlacare | EU / global (depending on Stripe service/entity) | Role varies — Stripe acts as an independent controller for parts of its payment processing under its own terms |
| The SMS Works | SMS delivery | Recipient mobile number and message content. No clinical data. | UK | Processor |
| Daily.co | Video consultations | Live audio and video during a consultation (not recorded), and participant names | UK (London) | Processor |
| Resend | Transactional email delivery | Recipient name and email address, and the content of the message sent | EU | Processor |
| Loops | Marketing and lifecycle email to clinic account owners. Never used for patient email. | Clinic account-owner contact details and subscription status. No patient data. | US — SCCs + UK IDTA | Role varies — processor for the sending of our communications |
| Google (Analytics) | Website and portal usage analytics, only with visitor consent | General page-usage data on public pages and the patient portal, with record identifiers removed. Never active on the clinic dashboard or admin area. | Global | Independent controller for its own analytics processing |
| Google (Calendar) and Microsoft (Outlook / Microsoft 365), only if a practitioner connects their calendar | Two-way calendar sync chosen by the practitioner | Start/end times of the practitioner's own events (read); Atlacare appointment times written to their calendar, titled "Atlacare appointment" by default with no patient data | Per the practitioner's own Google / Microsoft account | Independent controllers: the practitioner's own account provider, used at the practitioner's direction |
| Sentry | Error monitoring and diagnostics | Technical error data only — patient health information is filtered out before transmission | EU | Processor |
We describe each provider by the category of data it handles rather than listing the internal components of our system. Customers who need more detail for their own records or a due-diligence review can request it from us at the address below.
We do not use an AI provider
Atlacare does not send customer or patient data to any artificial intelligence provider. No AI feature is live, so there is no AI sub-processor on this list. If that changes, the provider will be added here before the feature ships, with the notice period below.
Changes to this list
We will update this page whenever we add or remove a provider. Clinics on a current Data Processing Addendum receive at least 30 days' notice before we add a new sub-processor that will process Customer Data on our behalf, and may object on reasonable and documented data protection grounds, as set out in the Data Processing Addendum.
Contact
For questions about our providers or your data rights, email [email protected].
ATLACARE LTD, 96 Sirius Close, Wokingham, England, RG41 3DT (company number 17284670).