Schedule 2 — Sub-Processors

This Schedule forms part of the Client Service Agreement. It lists the suppliers who process data for HealSuite, what each receives, where, and what covers the data. Your records are stored in the UK. Some of these suppliers work elsewhere, and each row says where.

Amazon Web Services (AWS)

Purpose: Hosting, database, file storage, email sending (SES) and encryption keys. AI models through Amazon Bedrock in London, for any AI feature HealSuite moves there: Claude Sonnet 5 only, pinned in HealSuite’s code.
Data processed: All Platform data. On Bedrock: the text a feature sends to the model.; AWS states that prompts and answers on Bedrock are not shared with the model’s maker, Anthropic.
Location: UK (London, eu-west-2).
Transfer safeguard: Not needed: the data stays in the UK.

Ryft Payments

Purpose: Payment processing and subscriptions.
Data processed: Payment and billing data.
Location: Ryft Pay Ltd is authorised by the UK’s Financial Conduct Authority. Its published privacy policy does not say where data is held.
Transfer safeguard: None stated in its published privacy policy.

Twilio

Purpose: SMS delivery.
Data processed: Phone numbers, message content.
Location: US.
Transfer safeguard: Twilio’s published Data Protection Addendum: the UK Extension to the Data Privacy Framework, otherwise the UK International Data Transfer Addendum.

Meta Platforms

Purpose: WhatsApp Business messaging, where the Client connects its account.
Data processed: Phone numbers, message content, attachments.; Meta says messages are kept for up to 30 days.
Location: Meta’s data centres, which it says may be international. HealSuite does not set Meta’s local storage option.
Transfer safeguard: The WhatsApp Business UK Data Transfer Addendum, in Meta’s published terms.

OpenAI

Purpose: Healy, clinical note assistance, AI suggestions, document digitisation, writing help and drug checks.
Data processed: Clinical text, uploaded documents and what staff type (see Clause 8.4).; OpenAI says API data is not used for training unless the customer opts in, and that abuse-monitoring logs are kept for up to 30 days.
Location: OpenAI’s global address, which is not limited to a region. OpenAI OpCo, LLC in the US handles UK data.
Transfer safeguard: The EU Standard Contractual Clauses with the UK Addendum, in OpenAI’s published Data Processing Addendum.

AssemblyAI

Purpose: Transcription of consultations, dictation and voice notes.
Data processed: Audio recordings and transcripts (see Clause 8.4).; AssemblyAI says data sent to its EU servers is never used for training, that uploaded audio is deleted within 48 hours, and that transcripts are kept for 30 days by default.
Location: AssemblyAI’s EU data zone, pinned in HealSuite’s code. AssemblyAI is a US company, and its Data Processing Addendum says its primary operations are in the US.
Transfer safeguard: The UK Extension to the Data Privacy Framework or the UK Addendum to the EU Standard Contractual Clauses, in AssemblyAI’s published Data Processing Addendum.

Anthropic: API

Purpose: The in-app guide assistant’s answers to staff questions.
Data processed: What staff type into the guide assistant, which could include a patient’s name, and passages from the user guide.; Anthropic’s Commercial Terms say it may not train models on this content. It says content is kept for up to 30 days, content its systems flag for up to 2 years, and classification scores for up to 7 years.
Location: US, or wherever Anthropic’s global routing sends it.
Transfer safeguard: The UK Addendum to the EU Standard Contractual Clauses, in Anthropic’s published Data Processing Addendum. That addendum lists special categories of personal data as “None”.

Anthropic: Claude subscription

Purpose: HealSuite’s team uses Claude, including Claude Code, in support and engineering work, on Anthropic’s Max subscription plan (see Clause 8.4(e)).
Data processed: What a Client sends HealSuite, and the Platform records, messages and files the work opens. This can include Patient Data.; The setting that lets Anthropic train its models on this data is off. With it off, Anthropic says data is kept for 30 days, content its systems flag for up to 2 years, classification scores for up to 7 years, and feedback a user chooses to send for 5 years.
Location: Anthropic’s Privacy Policy says data is transferred to its servers in the US, or to other countries outside the European Economic Area. It names Anthropic Ireland, Limited as the data controller for UK users.
Transfer safeguard: No separate data processing agreement, UK International Data Transfer Agreement or UK Addendum between HealSuite and Anthropic covers this use. The plan is under Anthropic’s Consumer Terms.

Resend

Purpose: Standby email delivery, when SES does not take a message.
Data processed: Email addresses, message content.
Location: Sent from the EU (Ireland). Resend’s Data Processing Addendum says its primary operations are in the US.
Transfer safeguard: The UK Extension to the Data Privacy Framework and the UK Addendum to the EU Standard Contractual Clauses, in Resend’s published Data Processing Addendum.

Google

Purpose: Google Workspace for HealSuite’s own email. Calendar and Gmail only where a Client’s user connects them.
Data processed: Correspondence with clinics, which can contain patient details. Where connected: mail, and calendar entries, whose title shows the patient’s name and treatment.
Location: Google’s Cloud Data Processing Addendum says data may be processed in any country where Google or its subprocessors have facilities.
Transfer safeguard: Standard Contractual Clauses or another transfer solution, under Google’s Cloud Data Processing Addendum.

Microsoft

Purpose: Calendar and mail, only where a Client’s user connects them.
Data processed: Calendar entries, whose title shows the patient’s name and treatment, and mail.
Location: As set by the user’s own Microsoft account.
Transfer safeguard: The user’s or Client’s own agreement with Microsoft.

Stripe

Purpose: Klarna payments, where the Client offers them, through the Client’s own Stripe account.
Data processed: Payer and payment data.
Location: Stripe’s Data Processing Agreement names Stripe, LLC in the US for transfers.
Transfer safeguard: Stripe’s published Data Processing Agreement and Data Transfers Addendum, which name the Data Privacy Framework, the EU Standard Contractual Clauses and the UK Addendum.

Mailchimp

Purpose: Marketing lists, where the Client connects its own Mailchimp account.
Data processed: Contact details the Client sends to its list.
Location: As set by the Client’s own Mailchimp account.
Transfer safeguard: The Client’s own agreement with Mailchimp.

Atlassian (Trello)

Purpose: HealSuite’s record of clinic support requests.
Data processed: Clinic names and what was asked. HealSuite’s rule is no patient details, though a clinic’s own words may contain them.
Location: Outside the UK, including the US.
Transfer safeguard: The Data Privacy Framework, and the EU Standard Contractual Clauses with the UK Addendum, in Atlassian’s published Data Processing Addendum.

PostHog

Purpose: Product analytics for staff screens and public booking pages.
Data processed: User and clinic identifiers, clinic name, usage. Screen text is masked.
Location: EU (Frankfurt). PostHog’s Data Processing Agreement allows processing in the US and elsewhere.
Transfer safeguard: The UK Extension to the Data Privacy Framework and the UK Addendum, in PostHog’s published Data Processing Agreement.

Oopsy (StreamChat AI Ltd)

Purpose: Error monitoring.
Data processed: Technical error reports, which can quote data from the page or request that failed.
Location: Received at oopsy.dev, on Amazon Web Services in Frankfurt, through Cloudflare.
Transfer safeguard: UK adequacy regulations (EU).

Cloudflare

Purpose: Bot checks (Turnstile) on public forms.
Data processed: IP address, browser details.
Location: Cloudflare’s global network.
Transfer safeguard: The Data Privacy Framework, and the EU Standard Contractual Clauses with the UK Addendum, in Cloudflare’s published Data Processing Addendum.

Xero

Purpose: Accounting integration, where the Client connects it.
Data processed: Invoice and payment data.
Location: Xero says its services are hosted on Amazon Web Services in the US, and that some data is processed in New Zealand and Australia.
Transfer safeguard: The UK Addendum to the EU Standard Contractual Clauses, in Xero’s published data processing terms.

SignatureRx

Purpose: Electronic prescribing, where the Client uses it.
Data processed: Patient details, prescriptions.
Location: A UK service. Its privacy policy says data may be stored or accessed outside the UK and EEA.
Transfer safeguard: Adequacy regulations or standard contractual clauses, as its privacy policy says.

The Doctors Laboratory (TDL)

Purpose: Pathology requests and results, where the Client uses it.
Data processed: Patient details, requests, results.
Location: A UK laboratory. Its patient privacy notice says samples may be referred to specialist laboratories outside the UK and EEA where the test needs it.
Transfer safeguard: TDL’s notice says it usually uses contractual clauses approved under data protection law.

Scan.com

Purpose: Imaging referrals, where the Client uses it.
Data processed: Patient details, requests, results.
Location: National MRI Scan Ltd, a UK company. HealSuite connects to its UK address.
Transfer safeguard: None known to HealSuite beyond the Client’s own agreement with Scan.com.

Sub-Processor	Purpose	Data Processed	Location	Transfer Safeguard
Amazon Web Services (AWS)	Hosting, database, file storage, email sending (SES) and encryption keys. AI models through Amazon Bedrock in London, for any AI feature HealSuite moves there: Claude Sonnet 5 only, pinned in HealSuite’s code.	All Platform data. On Bedrock: the text a feature sends to the model. AWS states that prompts and answers on Bedrock are not shared with the model’s maker, Anthropic.	UK (London, eu-west-2).	Not needed: the data stays in the UK.
Ryft Payments	Payment processing and subscriptions.	Payment and billing data.	Ryft Pay Ltd is authorised by the UK’s Financial Conduct Authority. Its published privacy policy does not say where data is held.	None stated in its published privacy policy.
Twilio	SMS delivery.	Phone numbers, message content.	US.	Twilio’s published Data Protection Addendum: the UK Extension to the Data Privacy Framework, otherwise the UK International Data Transfer Addendum.
Meta Platforms	WhatsApp Business messaging, where the Client connects its account.	Phone numbers, message content, attachments. Meta says messages are kept for up to 30 days.	Meta’s data centres, which it says may be international. HealSuite does not set Meta’s local storage option.	The WhatsApp Business UK Data Transfer Addendum, in Meta’s published terms.
OpenAI	Healy, clinical note assistance, AI suggestions, document digitisation, writing help and drug checks.	Clinical text, uploaded documents and what staff type (see Clause 8.4). OpenAI says API data is not used for training unless the customer opts in, and that abuse-monitoring logs are kept for up to 30 days.	OpenAI’s global address, which is not limited to a region. OpenAI OpCo, LLC in the US handles UK data.	The EU Standard Contractual Clauses with the UK Addendum, in OpenAI’s published Data Processing Addendum.
AssemblyAI	Transcription of consultations, dictation and voice notes.	Audio recordings and transcripts (see Clause 8.4). AssemblyAI says data sent to its EU servers is never used for training, that uploaded audio is deleted within 48 hours, and that transcripts are kept for 30 days by default.	AssemblyAI’s EU data zone, pinned in HealSuite’s code. AssemblyAI is a US company, and its Data Processing Addendum says its primary operations are in the US.	The UK Extension to the Data Privacy Framework or the UK Addendum to the EU Standard Contractual Clauses, in AssemblyAI’s published Data Processing Addendum.
Anthropic: API	The in-app guide assistant’s answers to staff questions.	What staff type into the guide assistant, which could include a patient’s name, and passages from the user guide. Anthropic’s Commercial Terms say it may not train models on this content. It says content is kept for up to 30 days, content its systems flag for up to 2 years, and classification scores for up to 7 years.	US, or wherever Anthropic’s global routing sends it.	The UK Addendum to the EU Standard Contractual Clauses, in Anthropic’s published Data Processing Addendum. That addendum lists special categories of personal data as “None”.
Anthropic: Claude subscription	HealSuite’s team uses Claude, including Claude Code, in support and engineering work, on Anthropic’s Max subscription plan (see Clause 8.4(e)).	What a Client sends HealSuite, and the Platform records, messages and files the work opens. This can include Patient Data. The setting that lets Anthropic train its models on this data is off. With it off, Anthropic says data is kept for 30 days, content its systems flag for up to 2 years, classification scores for up to 7 years, and feedback a user chooses to send for 5 years.	Anthropic’s Privacy Policy says data is transferred to its servers in the US, or to other countries outside the European Economic Area. It names Anthropic Ireland, Limited as the data controller for UK users.	No separate data processing agreement, UK International Data Transfer Agreement or UK Addendum between HealSuite and Anthropic covers this use. The plan is under Anthropic’s Consumer Terms.
Resend	Standby email delivery, when SES does not take a message.	Email addresses, message content.	Sent from the EU (Ireland). Resend’s Data Processing Addendum says its primary operations are in the US.	The UK Extension to the Data Privacy Framework and the UK Addendum to the EU Standard Contractual Clauses, in Resend’s published Data Processing Addendum.
Google	Google Workspace for HealSuite’s own email. Calendar and Gmail only where a Client’s user connects them.	Correspondence with clinics, which can contain patient details. Where connected: mail, and calendar entries, whose title shows the patient’s name and treatment.	Google’s Cloud Data Processing Addendum says data may be processed in any country where Google or its subprocessors have facilities.	Standard Contractual Clauses or another transfer solution, under Google’s Cloud Data Processing Addendum.
Microsoft	Calendar and mail, only where a Client’s user connects them.	Calendar entries, whose title shows the patient’s name and treatment, and mail.	As set by the user’s own Microsoft account.	The user’s or Client’s own agreement with Microsoft.
Stripe	Klarna payments, where the Client offers them, through the Client’s own Stripe account.	Payer and payment data.	Stripe’s Data Processing Agreement names Stripe, LLC in the US for transfers.	Stripe’s published Data Processing Agreement and Data Transfers Addendum, which name the Data Privacy Framework, the EU Standard Contractual Clauses and the UK Addendum.
Mailchimp	Marketing lists, where the Client connects its own Mailchimp account.	Contact details the Client sends to its list.	As set by the Client’s own Mailchimp account.	The Client’s own agreement with Mailchimp.
Atlassian (Trello)	HealSuite’s record of clinic support requests.	Clinic names and what was asked. HealSuite’s rule is no patient details, though a clinic’s own words may contain them.	Outside the UK, including the US.	The Data Privacy Framework, and the EU Standard Contractual Clauses with the UK Addendum, in Atlassian’s published Data Processing Addendum.
PostHog	Product analytics for staff screens and public booking pages.	User and clinic identifiers, clinic name, usage. Screen text is masked.	EU (Frankfurt). PostHog’s Data Processing Agreement allows processing in the US and elsewhere.	The UK Extension to the Data Privacy Framework and the UK Addendum, in PostHog’s published Data Processing Agreement.
Oopsy (StreamChat AI Ltd)	Error monitoring.	Technical error reports, which can quote data from the page or request that failed.	Received at oopsy.dev, on Amazon Web Services in Frankfurt, through Cloudflare.	UK adequacy regulations (EU).
Cloudflare	Bot checks (Turnstile) on public forms.	IP address, browser details.	Cloudflare’s global network.	The Data Privacy Framework, and the EU Standard Contractual Clauses with the UK Addendum, in Cloudflare’s published Data Processing Addendum.
Xero	Accounting integration, where the Client connects it.	Invoice and payment data.	Xero says its services are hosted on Amazon Web Services in the US, and that some data is processed in New Zealand and Australia.	The UK Addendum to the EU Standard Contractual Clauses, in Xero’s published data processing terms.
SignatureRx	Electronic prescribing, where the Client uses it.	Patient details, prescriptions.	A UK service. Its privacy policy says data may be stored or accessed outside the UK and EEA.	Adequacy regulations or standard contractual clauses, as its privacy policy says.
The Doctors Laboratory (TDL)	Pathology requests and results, where the Client uses it.	Patient details, requests, results.	A UK laboratory. Its patient privacy notice says samples may be referred to specialist laboratories outside the UK and EEA where the test needs it.	TDL’s notice says it usually uses contractual clauses approved under data protection law.
Scan.com	Imaging referrals, where the Client uses it.	Patient details, requests, results.	National MRI Scan Ltd, a UK company. HealSuite connects to its UK address.	None known to HealSuite beyond the Client’s own agreement with Scan.com.

The list is dated 5 November 2026. On that date, every AI feature that handles Patient Data runs on OpenAI, apart from transcription and the guide assistant; none has moved to Amazon Bedrock. “Safeguard” says what a supplier’s published terms provide. It does not mean HealSuite has signed a separate agreement with that supplier. HealSuite shall notify the Client in writing at least 30 days before engaging any new sub-processor in accordance with Clause 5.4(d). “UK Addendum” means the addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner.