Last updated: 5 October 2026
Neulife Therapy Limited engages the third-party sub-processors listed below to help us deliver the NoteItAll platform to clinics. Each sub-processor is bound by a data processing agreement. Where personal data is transferred outside the UK, we rely on appropriate safeguards: the UK adequacy regulations for the EU, the UK-US Data Bridge, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as applicable. We will notify clinic administrators by email at least 30 days before adding a new sub-processor, giving you the opportunity to object.
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase Inc. | Database hosting, authentication, and file storage (audio recordings, imported documents, chat images) | All clinic and patient data, clinical notes, audio recordings, uploaded documents, account credentials | Ireland (EU) | UK GDPR adequacy decision (EU) |
| Vercel Inc. | Application hosting and global edge delivery | All application requests and responses, including client data in transit. Server functions run in London. No client data stored at rest. Application logs and request metadata may be processed in the USA. | UK (London) / global edge / USA | UK-US Data Bridge / SCCs |
| Groq Inc. | Audio transcription of clinical session recordings (Whisper-large-v3-turbo) | Raw audio recordings of clinical consultations and the resulting transcripts | USA | SCCs + UK Addendum |
| Anthropic PBC | AI-generated clinical note drafting, heading summaries, and parsing of imported medical documents | Consultation transcripts and uploaded medical document content | Global (data stored in the USA) | SCCs + UK Addendum |
| Resend (Resend Inc.) | Transactional email: appointment reminders, invites, cancellations, password resets | Patient names, email addresses, appointment details | USA | SCCs |
| Twilio Inc. | SMS appointment reminders, inbound SMS handling, delivery status webhooks | Patient names, phone numbers, appointment details, SMS content | USA | SCCs |
| Stripe Payments Europe Ltd | Subscription billing and payment processing | Clinic billing contact name and email only; no patient data; no card data stored by Noteitall | Ireland (EU) / USA | UK GDPR adequacy / SCCs |
| Cloudflare, Inc. | Encrypted off-site backup storage for imported clinical documents (Cloudflare R2) | Backup copies of uploaded clinical documents | Western Europe (EU) | UK GDPR adequacy decision (EU) |
| Upstash, Inc. | Rate limiting and abuse prevention | IP addresses and request counters only; no patient data | Ireland (EU) | UK GDPR adequacy decision (EU) |
| Functional Software, Inc. (Sentry) | Application error and crash monitoring for the web and mobile apps | Error and diagnostic traces (text and inputs masked; no patient data intended, residual technical data possible) | European Union (EU) | UK GDPR adequacy decision (EU) |
Questions about our sub-processors? Contact hello@noteitall.io