Australia & New Zealand

Sub-processor List

For organisations on the AU Sovereign profile · Version 1.13 — 30 September 2026

These are the providers that process data for the Small Mercy service in Australia and New Zealand, what each one does, and where it does it. Every external processing hop the service makes is recorded immutably and is disclosable to your practice in-product — this list cannot silently drift from what actually runs.

United Kingdom organisations run a separate deployment with its own providers and geography — that list is at UK sub-processors.

Clinical data sub-processors

Sub-processor	Purpose	Processing location	Safeguard
Amazon Web Services (AWS)	Cloud infrastructure: storage, database, compute	Australia (ap-southeast-2, Sydney)	Processing in-country; AWS DPA
Deepgram, Inc.	Automated speech-to-text of consult audio	Australia (Deepgram's Australian regional service)	Processing in-country; zero-retention configuration; model-improvement opt-out, enforced at start-up; Deepgram DPA
Amazon Web Services (AWS) — Bedrock	Automated drafting of clinical documentation from consult transcripts and, for organisations with clinical documents enabled, imported-document text and selected composition-source text (including source titles). Never receives audio	Australia: Sydney and Melbourne (cross-region inference, ap-southeast-2 and ap-southeast-4)	Processing in-country; AWS commitment that customer content is not used to train models; AWS DPA
Amazon Web Services (AWS) — Textract	Text extraction from uploaded PDF pages without a text layer trusted as typed text, for organisations with clinical documents (beta) enabled. Scanned pages are sent as images; request bytes only	Australia (ap-southeast-2, Sydney)	Processing in-country; AWS DPA

Note drafting spans two Australian states. The inference route covers Sydney and Melbourne, so a Victorian clinic's health information may be structured in New South Wales, and a New South Wales clinic's in Victoria. It never leaves Australia. We state this plainly rather than behind the word “Australia”, because it is the one fact an Australian clinic cannot infer from that word, and a practice assessing its own state obligations needs it.

Practice-management integrations (optional; only if your practice connects one)

The AU cell serves Australian and New Zealand organisations. Its optional Cliniko connection accepts Australian-hosted accounts, and its Nookal connection uses the Australian API service. Each reads today's appointments when a clinician asks, files a clinician-confirmed note as a draft treatment note, and files a clinician-confirmed letter as a PDF copy on the patient's record. Neither engages unless your practice connects it, and each only ever receives what the table says, and only when a clinician explicitly sends it — how connecting works. The United Kingdom deployment's UK list discloses its own Cliniko and Nookal routes.

Connecting one writes into your own practice-management account. Small Mercy checks a Cliniko key's shard against the Australian allowlist. For Nookal, Small Mercy uses its Australian API service; the Basic Key alone does not establish where Nookal stores the practice's account data. Check that with Nookal for your account before connecting clinical data.

Sub-processor	Purpose	Processing location	Safeguard
Cliniko	Practitioner and appointment identifiers, one linked patient's minimum demographics, and a confirmed note or letter when the clinician explicitly sends it	Australia — your practice's own Cliniko account in Cliniko's Australian region (shards au1–au5)	Your practice's own system under its own agreement with the vendor; approved-region allowlist enforced in code; only what the clinician explicitly sends
Nookal	Practitioner and appointment identifiers, one linked patient's minimum demographics, and a confirmed note or letter when the clinician explicitly sends it	Australian API service; the Basic Key does not prove the practice account's storage region	Your practice's own system under its own agreement with the vendor; Australian API zone selected in code; only what the clinician explicitly sends

Account data sub-processors (business operations; no clinical data)

Some of these operate outside Australia. None of them receives clinical data — no consult audio, no transcript, no note. What they handle is billing, sign-in and app-store plumbing — and, for Google and Microsoft, the ad-click sign-up measurement described in the privacy policy. Small Mercy's AU clinical processing routes listed above use Australian endpoints. An optional Cliniko or Nookal send reaches the practice's connected vendor account under the distinct conditions in their rows; for Nookal, Small Mercy cannot establish that account's storage region from its Basic Key.

Sub-processor	Purpose	Processing location	Safeguard
Amazon Web Services (AWS) — Simple Email Service	Transactional email (sign-in codes, billing notices). Contact-form enquiries are submitted to our inbox this way after a website record is saved; the form reports a notification failure if SES does not accept the message. Email may be processed outside Australia in transit	Australia (ap-southeast-2, Sydney)	Processing in-country; AWS DPA
Stripe	Subscription billing and payment processing	Stripe's standard locations (US/EU)	Stripe DPA and its transfer mechanisms
Cloudflare	Marketing site hosting; signup bot-protection (Turnstile); cookieless, aggregate web analytics for the marketing site; storage of website records — the updates list, contact-form enquiries and anonymous action counts — in a globally replicated store	Global edge; website records may be held outside Australia	No clinical data touches Cloudflare — the application hosts are deliberately not proxied
Apple	App Store purchases and App Attest device attestation for the iOS and macOS apps	Apple's standard locations	Apple's terms and its transfer mechanisms
Google	Google Play billing and Play Integrity attestation for the Android app. When the ad-click sign-up measurement described in the privacy policy is switched on, Google also receives a Google ad's own click identifier with a conversion time and a random reference — never a name, email address, IP address, account identifier or any clinical datum	Google's standard locations	Google's terms and its transfer mechanisms
Microsoft Advertising	Ad-click sign-up measurement for Microsoft (Bing) search ads, as described in the privacy policy: a Microsoft ad's own click identifier, with a conversion time and which conversion it was — never a name, email address, phone number, IP address, account identifier or any clinical datum	Microsoft's standard locations	Microsoft's terms and its transfer mechanisms

What this list also tells you

No model training on your data. The transcription provider's model-improvement programme is opted out, and the platform refuses to start if that opt-out is disabled while managed transcription is in use.
Consult audio never reaches the drafting model. Only the attributed transcript does, and only with consent.
No analytics, crash-reporting or advertising SDKs in the apps. This site uses Cloudflare Web Analytics for cookieless page counts and its own script for anonymous Demo action and signup-click counts; neither stores a visitor identifier on your device. The advertising-related flow is the click-ID sign-up measurement described in the privacy policy — a first-party exchange that tells Google or Microsoft that one of its own ad clicks converted, never who converted.

Questions about this list: privacy@smallmercy.app. How data is handled overall is in the privacy policy and privacy by design.