SendScript UK & EU — Third-Party Sub-processors Register

Data Residency & Processing Architecture

All UK and European customer and patient data is hosted and processed exclusively within the United Kingdom in the AWS London region (eu-west-2) and Azure UK South (London) for search indexing.

In-app document editing is provided via self-hosted OnlyOffice Document Server deployed on private AWS EC2 (office.sendscript.com). Domain Name System (DNS) is managed natively in AWS Route 53 and web delivery is handled by AWS Application Load Balancer and AWS CloudFront. System and application logs are monitored in Amazon CloudWatch within the London region. Payment transactions are processed via Stripe. Video consultations are conducted via Zoom Video Communications.

All external sub-processors operate under executed Data Processing Agreements (DPAs) incorporating Standard Contractual Clauses (SCCs) and UK transfer addenda.

Sub-processors that Process UK/EU Patient and Special Category Health Data

Sub-processor / Product	Legal Entity	Jurisdiction / Data Location	Data Processed	Purpose of Processing
Amazon Web Services (AWS)	Amazon Web Services EMEA SARL (Luxembourg)	United Kingdom (London eu-west-2)	All customer and patient data input into SendScript including medical records, prescriptions, consultation notes, user credentials, encrypted database backups, and system/application audit logs (CloudWatch).	Core cloud hosting, container compute (ECS Fargate), relational database (RDS PostgreSQL), encrypted storage (S3), DNS routing (Route 53), CDN (CloudFront), log management (Amazon CloudWatch), and audit trail (AWS CloudTrail).
Elastic Cloud	Elasticsearch B.V. (Netherlands / Ireland)	United Kingdom (Azure London uksouth)	Search index data, patient and clinical query records, radiology report index, and audit search metadata.	Application indexing and high-performance search engine for medical records, clinical registries, and radiology reporting.
OnlyOffice Document Server (Self-Hosted on AWS EC2)	Ascensio System SIA (Software) / Operated by SendScript	United Kingdom (London eu-west-2 AWS Private EC2)	Clinical letters, consultation report drafts, referral forms, and document templates edited or viewed within the platform.	In-app document editing and viewing server (Self-hosted on private AWS EC2 behind ALB; zero data sent to external OnlyOffice cloud servers).
Stripe	Stripe Payments UK Limited / Stripe Payments Europe Limited	UK and EU (transfers under SCCs)	Billing name, billing address, card tokens, transaction amounts, and invoice reference metadata. Card details are tokenized directly by Stripe.	Credit/debit card payment processing and recurring subscription billing for UK/EU patients and healthcare practices.
Amazon SES (Simple Email Service)	Amazon Web Services EMEA SARL	United Kingdom (London eu-west-2)	Recipient email addresses, patient and clinician names, appointment reminder text, and prescription download links.	Transactional email delivery for consultation confirmations, prescription ready notices, and account alerts.
Twilio	Twilio Ireland Limited / Twilio, Inc. (USA)	UK, EU, and USA (under DPA & SCCs)	Mobile telephone numbers, verification codes (MFA / OTP), and automated SMS notification text.	SMS transmission for patient appointment reminders, prescription dispense alerts, and two-factor authentication OTPs.
Zoom Video Communications	Zoom Video Communications, Inc. (USA)	Global (transient audio/video media routing to nearest geographic edge)	Clinician and patient names, live audio/video streams (transient/real-time), meeting timestamps, and technical call telemetry. Video streams are not stored permanently.	Telehealth consultations and secure video appointments between clinicians and patients.
Stream (GetStream.io)	Stream.io Inc. (USA / Netherlands)	EU and USA (under DPA & SCCs)	In-consultation secure chat messages, timestamps, clinician/patient display names, and clinical attachments shared during active care sessions.	Secure real-time messaging and in-consultation clinical communication between patients and care teams.
Onfido	Onfido Limited (United Kingdom)	United Kingdom and EU	Government-issued photographic identification documents, facial biometric verification data, and identity check results.	Identity verification (KYC) and clinician credentialing verification for prescribers and healthcare professionals.
Google Firebase	Google Ireland Limited / Google LLC	EU and USA (under DPA)	Mobile device push notification tokens, notification titles, and mobile app instance IDs.	Mobile application push notifications for prescription status updates and urgent appointment alerts.
Google Maps API	Google Ireland Limited / Google LLC	Global	User-entered address query strings for autocomplete, clinic and pharmacy geographic coordinates.	Address autocomplete and geographical mapping of dispensing pharmacies and clinic locations.

Sub-processors that Process Operational, Design, and Technical Data (Not Patient Data)

Sub-processor / Product	Legal Entity	Jurisdiction / Data Location	Data Processed	Purpose of Processing
Microsoft (Office 365 / Entra ID)	Microsoft Ireland Operations Limited	United Kingdom and EU	SendScript staff corporate email addresses, authentication credentials, and internal administrative communications.	Internal team communication, single sign-on (SSO), workforce access controls, and office productivity suite.
GitHub	GitHub, Inc. (USA)	USA and Global	Software source code, Terraform infrastructure definitions, automated build scripts, and developer account identifiers. No patient records stored.	Source code version control, software release tracking, and continuous integration pipeline definitions.
Figma	Figma, Inc. (USA)	USA and Global	Application UI wireframes, prototypes, design tokens, user flow specifications, and designer/developer work emails. No patient records.	Product design, user experience wireframing, interface component libraries, and collaborative design reviews.
Postman	Postman, Inc. (USA)	USA and Global	API endpoint definitions, schemas, mock request templates with synthetic test data, and engineering account details. No live patient records.	API design, endpoint documentation, integration testing, and automated backend test collection execution.

SendScript UK & EU — Third-Party Sub-processors Register

Data Residency & Processing Architecture

All UK and European customer and patient data is hosted and processed exclusively within the United Kingdom in the AWS London region (eu-west-2) and Azure UK South (London) for search indexing.

All external sub-processors operate under executed Data Processing Agreements (DPAs) incorporating Standard Contractual Clauses (SCCs) and UK transfer addenda.

Sub-processors that Process UK/EU Patient and Special Category Health Data

Sub-processor / Product	Legal Entity	Jurisdiction / Data Location	Data Processed	Purpose of Processing
Amazon Web Services (AWS)	Amazon Web Services EMEA SARL (Luxembourg)	United Kingdom (London eu-west-2)	All customer and patient data input into SendScript including medical records, prescriptions, consultation notes, user credentials, encrypted database backups, and system/application audit logs (CloudWatch).	Core cloud hosting, container compute (ECS Fargate), relational database (RDS PostgreSQL), encrypted storage (S3), DNS routing (Route 53), CDN (CloudFront), log management (Amazon CloudWatch), and audit trail (AWS CloudTrail).
Elastic Cloud	Elasticsearch B.V. (Netherlands / Ireland)	United Kingdom (Azure London uksouth)	Search index data, patient and clinical query records, radiology report index, and audit search metadata.	Application indexing and high-performance search engine for medical records, clinical registries, and radiology reporting.
OnlyOffice Document Server (Self-Hosted on AWS EC2)	Ascensio System SIA (Software) / Operated by SendScript	United Kingdom (London eu-west-2 AWS Private EC2)	Clinical letters, consultation report drafts, referral forms, and document templates edited or viewed within the platform.	In-app document editing and viewing server (Self-hosted on private AWS EC2 behind ALB; zero data sent to external OnlyOffice cloud servers).
Stripe	Stripe Payments UK Limited / Stripe Payments Europe Limited	UK and EU (transfers under SCCs)	Billing name, billing address, card tokens, transaction amounts, and invoice reference metadata. Card details are tokenized directly by Stripe.	Credit/debit card payment processing and recurring subscription billing for UK/EU patients and healthcare practices.
Amazon SES (Simple Email Service)	Amazon Web Services EMEA SARL	United Kingdom (London eu-west-2)	Recipient email addresses, patient and clinician names, appointment reminder text, and prescription download links.	Transactional email delivery for consultation confirmations, prescription ready notices, and account alerts.
Twilio	Twilio Ireland Limited / Twilio, Inc. (USA)	UK, EU, and USA (under DPA & SCCs)	Mobile telephone numbers, verification codes (MFA / OTP), and automated SMS notification text.	SMS transmission for patient appointment reminders, prescription dispense alerts, and two-factor authentication OTPs.
Zoom Video Communications	Zoom Video Communications, Inc. (USA)	Global (transient audio/video media routing to nearest geographic edge)	Clinician and patient names, live audio/video streams (transient/real-time), meeting timestamps, and technical call telemetry. Video streams are not stored permanently.	Telehealth consultations and secure video appointments between clinicians and patients.
Stream (GetStream.io)	Stream.io Inc. (USA / Netherlands)	EU and USA (under DPA & SCCs)	In-consultation secure chat messages, timestamps, clinician/patient display names, and clinical attachments shared during active care sessions.	Secure real-time messaging and in-consultation clinical communication between patients and care teams.
Onfido	Onfido Limited (United Kingdom)	United Kingdom and EU	Government-issued photographic identification documents, facial biometric verification data, and identity check results.	Identity verification (KYC) and clinician credentialing verification for prescribers and healthcare professionals.
Google Firebase	Google Ireland Limited / Google LLC	EU and USA (under DPA)	Mobile device push notification tokens, notification titles, and mobile app instance IDs.	Mobile application push notifications for prescription status updates and urgent appointment alerts.
Google Maps API	Google Ireland Limited / Google LLC	Global	User-entered address query strings for autocomplete, clinic and pharmacy geographic coordinates.	Address autocomplete and geographical mapping of dispensing pharmacies and clinic locations.

Sub-processors that Process Operational, Design, and Technical Data (Not Patient Data)

Sub-processor / Product	Legal Entity	Jurisdiction / Data Location	Data Processed	Purpose of Processing
Microsoft (Office 365 / Entra ID)	Microsoft Ireland Operations Limited	United Kingdom and EU	SendScript staff corporate email addresses, authentication credentials, and internal administrative communications.	Internal team communication, single sign-on (SSO), workforce access controls, and office productivity suite.
GitHub	GitHub, Inc. (USA)	USA and Global	Software source code, Terraform infrastructure definitions, automated build scripts, and developer account identifiers. No patient records stored.	Source code version control, software release tracking, and continuous integration pipeline definitions.
Figma	Figma, Inc. (USA)	USA and Global	Application UI wireframes, prototypes, design tokens, user flow specifications, and designer/developer work emails. No patient records.	Product design, user experience wireframing, interface component libraries, and collaborative design reviews.
Postman	Postman, Inc. (USA)	USA and Global	API endpoint definitions, schemas, mock request templates with synthetic test data, and engineering account details. No live patient records.	API design, endpoint documentation, integration testing, and automated backend test collection execution.