Sub-processor List
Every external processing hop the service makes is recorded immutably and is disclosable to your practice in-product — this list cannot silently drift from what actually runs. Organisations in Australia and New Zealand run a separate deployment with its own geography — that list is at Australian sub-processors. Practices receive advance notice of changes per the Schedule and may object on reasonable data-protection grounds.
For every consult, the ordinary transcription and note-drafting routes are Deepgram's EU regional service and Amazon Bedrock, invoked from AWS London (eu-west-2) and served in Amazon Web Services' United Kingdom or European Union regions under its EU inference profile. When clinical documents (beta) are enabled for an organisation, uploaded PDFs may also be sent to Textract in London for pages without a text layer trusted as typed text. Small Mercy is the processor, and the record itself stays in the United Kingdom. AWS supplies the underlying London infrastructure.
Clinical Data sub-processors
| Sub-processor | Purpose | Processing location | Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure: storage, database, compute for the UK deployment | United Kingdom (eu-west-2, London) | Processing in-country; AWS DPA |
| Deepgram, Inc. | Automated speech-to-text of consult audio — the transcription route for every consult | European Union (Frankfurt, Germany — Deepgram EU regional service) | UK→EU under UK adequacy for the EEA; zero-retention configuration and model-improvement opt-out (live configuration); anonymous diarisation only; Deepgram DPA |
| Amazon Web Services (AWS) — Amazon Bedrock | Automated drafting of clinical documentation from consult transcripts and, when the clinical-documents feature is enabled for an organisation, imported-document text and selected composition-source text (including source titles), for clinician review. Never receives audio | Invoked from the United Kingdom (eu-west-2, London); served in Amazon Web Services' United Kingdom or European Union regions under the EU cross-region inference profile | Any UK→EU processing falls under UK adequacy for the EEA; Bedrock does not store prompts or outputs or use them to train models under AWS's published commitments; AWS DPA |
| Amazon Web Services (AWS) — Textract | Text extraction from uploaded PDF pages without a text layer trusted as typed text, for organisations with clinical documents (beta) enabled. Scanned pages are sent as images; request bytes only | United Kingdom (eu-west-2, London) | Processing in-country; AWS DPA |
Practice-management integrations
United Kingdom organisations can connect Cliniko accounts in Cliniko's UK region (shards uk1, uk2 and uk3), and Nookal through Nookal's European API service. Each reads today's appointments when a clinician asks, files a clinician-confirmed note as a draft treatment note, and files a clinician-confirmed letter as a PDF copy on the patient's record. Neither engages unless your practice connects it, and each receives only practitioner and appointment identifiers, one linked patient's minimum demographics, and a confirmed note or letter when the clinician explicitly sends it — never your patient list, and never anything you have not confirmed. Nookal's European API service alone does not establish where the practice's Nookal account stores its data; check that with Nookal for your account before connecting Clinical Data. How connecting works.
| Sub-processor | Possible Clinical Data | Destination | Current position |
|---|---|---|---|
| Cliniko | A selected patient's minimum demographics and practitioner/appointment identifiers on connection; a confirmed note or letter only on an explicit send | United Kingdom — your practice's own Cliniko account in Cliniko's UK region (shards uk1, uk2 and uk3) | Live: today's appointments, confirmed notes filed as draft treatment notes, and confirmed letters filed as a PDF copy on the patient's record. |
| Nookal | A selected patient's minimum demographics and practitioner/appointment identifiers on connection; a confirmed note or letter only on an explicit send | European Union — Nookal's European API service; the Basic Key does not prove the practice account's storage region | Live: today's appointments, confirmed notes filed as draft treatment notes, and confirmed letters filed as a PDF copy on the patient's record. |
Account Data sub-processors (business operations; no Clinical Data)
| Sub-processor | Purpose | Processing location | Safeguard |
|---|---|---|---|
| Stripe | Subscription billing and payment processing | Stripe's standard locations (US/EU) | Stripe DPA and its transfer mechanisms |
| Cloudflare | Marketing site hosting; signup bot-protection (Turnstile); cookieless page analytics; anonymous Demo and signup-link counts (event type, fictional story name and day in Workers KV for 90 days) | Global edge | No Clinical Data touches Cloudflare — the application hosts are deliberately not proxied; the counts contain no visitor, session or account identifier |
| Amazon Web Services (AWS) — Simple Email Service | Transactional email (sign-in codes, billing notices) | United Kingdom (eu-west-2, London) | Processing in-country; AWS DPA |
| Apple | App Store purchases and App Attest device attestation for the iOS and macOS apps | Apple's standard locations | Apple's terms and its transfer mechanisms |
| Google Play billing and Play Integrity attestation for the Android app | Google's standard locations | Google's terms and its transfer mechanisms |
Questions about this list: privacy@smallmercy.app.