Sub-processors

A “sub-processor” is a third party that we engage to process personal data on behalf of our care home customers. Under UK GDPR Article 28, customers must be told who their data passes through and given a chance to object before any new sub-processor handles their residents’ data.

This page is the authoritative, public list. It mirrors Schedule 3 of our Data Processing Agreement and is the canonical reference when a customer or auditor asks us where resident data goes.

Every sub-processor below is bound by a written agreement imposing UK GDPR equivalent obligations and processes Personal Data only on our documented instructions.

Added sub-processors (v1.2 → v1.3, June 2026). Stripe Payments Europe Ltd (payment processing) and Resend (transactional email delivery) are newly listed as approved sub-processors under DPA v1.3. Both transfer personal data to the USA under UK-approved International Data Transfer Agreements (IDTAs). Existing customers were sent an Article 28 30-day advance notice by email; the effective date is 30 days from that send date. New customers accepting DPA v1.3 at sign-up receive general authorisation at onboarding.

Retired sub-processor. Amazon OpenSearch Service was previously listed for vector-search AI assistance. This processor has been retired; care-evidence retrieval now uses a deterministic ontology-tag projection. No personal data remains in OpenSearch.

All care-record and resident personal data processing takes place inside the AWS eu-west-2 (London) region; resident and care data does not leave the United Kingdom. The customer-facing exceptions are limited: a transfer to the EU/USA for our payment processor and transactional email delivery service, and identity verification via Google infrastructure when a user chooses Google Sign-In — in those cases we rely on UK-approved International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses, and the relevant safeguard is available on request from privacy@care-meter.co.uk.

AWS Bedrock model providers (Anthropic, Amazon Nova) operate inside the same UK region under the AWS Bedrock program. Bedrock does not use customer prompts or responses to train its models.

We do not engage sub-processors to do any of the following with resident or staff data:

• Marketing or product analytics on resident-identifiable data
• Licensing of anonymised resident cohorts to research bodies or commercial partners
• Behavioural advertising or third-party retargeting
• Cross-tenant analytics that mix one care home’s data with another’s
• Voice biometric profiling beyond optional voice-note transcription
• Profiling for any automated decision affecting a resident’s care

If we ever propose to add a sub-processor whose purpose falls outside the categories listed above, we will treat it as a material change and follow the notification process in Section 5.

We notify Controllers (care home operators) of any proposed addition to or replacement of a sub-processor with at least 30 days’ written notice via email and a prominent in-platform banner. The notice will include:

• The name and legal entity of the proposed sub-processor
• The processing activity it will perform
• The categories of personal data involved
• The location of processing
• The contractual basis on which it will process the data

During the notice period the Controller may object on reasonable grounds. We then either adjust scope, find an alternative provider, or — where the change is essential to continued provision of the Services and no alternative is reasonably available — work with the Controller on a wind-down or termination plan as set out in the DPA.

If you are a current Controller and want to formally object to a sub-processor — current or proposed — email privacy@care-meter.co.uk with the subject line Sub-processor objection. Include:

• The sub-processor name
• The grounds for objection (data residency, security posture, regulatory concern, etc.)
• Whether you are objecting to a current or proposed sub-processor

We acknowledge sub-processor objections within 2 working days and respond substantively within 14 working days, in line with the response targets in our Subscription Agreement §15.1.