Sub-processor register
The first published list of the third parties Practor engages to process patient and practice personal information on a practice's behalf, with what each one processes and where.
Changing soon
Version 1.1 takes effect on 25 November 2026.Read version 1.1.
This register lists the third parties ("Sub-operators", called sub-processors under the GDPR) that Practor engages to process personal information on a practice's behalf, as clause 8 of the Data Processing Agreement describes. Every version is kept on this page with its effective date.
Practor hosts the platform and its databases on Amazon Web Services in Ireland. The services Practor runs inside that environment, such as search, the cache and background processing, are not separate Sub-operators. Files uploaded to the platform are stored by Cloudinary, listed below.
Sub-operators
| Sub-operator | What it does for Practor | Personal information it processes | Where | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services | Hosting: the application, database, search, background processing, logs and backups | All personal information held in Practor | Ireland (AWS eu-west-1). Requests pass through the Amazon CloudFront edge network | AWS data processing terms. Ireland is subject to the GDPR |
| Cloudflare | Domain name service, protection against attacks, and encryption of connections to Practor | All information sent to and from Practor, in transit | Global network, nearest location to the user | Cloudflare data processing terms, with the Standard Contractual Clauses |
| Cloudinary | Storage and delivery of files | Attachments to notes and messages, uploaded documents, recordings of consultations, profile photos and practice logos | United States | Cloudinary data processing terms, with the Standard Contractual Clauses |
| OpenAI | AI features: drafting clinical notes from consultation transcripts, Ava's chat replies, search over clinical notes, and summarising patient reviews | Consultation transcripts, clinical notes, messages and patient reviews | United States | OpenAI data processing terms, with the Standard Contractual Clauses. Information sent to OpenAI through its API is not used to train its models |
| Deepgram | Converting speech to text | Recordings of consultations, dictated notes and phone calls handled by Ava | United States | Deepgram data processing terms |
| LiveKit | Real-time audio for phone calls handled by Ava | Call audio | Global network, nearest location to the caller | LiveKit data processing terms |
| Modal | Running Ava's phone agent | Call audio, and the patient and appointment details Ava needs to handle a call | United States | Modal data processing terms |
| ElevenLabs | Turning Ava's replies into speech | The text of Ava's spoken replies, which can include patient and appointment details | United States | ElevenLabs data processing terms |
| Twilio | SMS, WhatsApp messages, phone numbers and call routing, for appointment reminders, sign-in codes and phone calls handled by Ava. WhatsApp messages are also processed by Meta | Phone numbers, message content and call audio | United States. WhatsApp messages also pass through Meta's global network | Twilio data processing terms, with the Standard Contractual Clauses |
| Twilio SendGrid | Sending and receiving email: invoices, appointment emails, sign-in links and replies to support requests | Email addresses and email content, including invoice attachments | United States | Twilio data processing terms, with the Standard Contractual Clauses |
| Google Maps Platform | Address suggestions as an address is typed, and finding a practice's location on a map | Addresses typed into address fields, including patients' addresses | United States | Google data processing terms, with the Standard Contractual Clauses |
| Fixie | A fixed outbound address for claims sent to the claims network | Claims and eligibility requests, in transit and encrypted end to end, so Fixie cannot read them | Ireland | Fixie data processing terms. Ireland is subject to the GDPR |
| Pusher | Live updates in the app, such as the calendar, messages and notifications | Notices of changes, which can include patient names and appointment details | European Union | Pusher data processing terms |
| Sentry | Error monitoring | Details of errors, which can include the request that caused them, and recordings of the screen when an error happens, with all text masked | Germany | Sentry data processing terms |
| PostHog | Product analytics on how people use the app, only for those who allow analytics cookies | Account identifiers and email addresses of staff, and of patients who use the patient portal, and the pages and features they use. Clinical information is excluded | United States | PostHog data processing terms, with the Standard Contractual Clauses |
Not Sub-operators
These receive personal information through Practor but are not Sub-operators, because they do not process it on a practice's behalf:
- Medical insurers, medical schemes and the claims network. A claim or eligibility request a practice sends through Practor is disclosed to its recipient on the practice's instruction. The recipient processes it as a responsible party in its own right.
- PayFast. Processes the payments a practice makes to Practor for the platform. Practor is the responsible party for that information, as the Privacy Policy describes.
Changes to the register
Practor gives at least 30 days' notice before it adds or replaces a Sub-operator, by publishing a new version of this register and emailing each practice's owners. The notice states when the change takes effect.
A practice may object to a change on reasonable data protection grounds by emailing [email protected] before it takes effect. Clause 8.4 of the Data Processing Agreement says what happens next.
| Version | Effective | Changes |
|---|---|---|
| 1.0 | 18 October 2026 | First published register. |
Version history
- Version 1.1, in effect from 25 November 2026. Practor now sends and receives email through Amazon Web Services in Ireland instead of Twilio SendGrid in the United States, so one fewer third party processes your practice's information.
- Version 1.0, in effect from 18 October 2026. The first published list of the third parties Practor engages to process patient and practice personal information on a practice's behalf, with what each one processes and where.