Who else processes UK data?

The authoritative answer is the UK sub-processor list — every provider, what it does for the service, the country it processes in, and the safeguard it operates under. It is incorporated into the UK Data Processing Schedule, so it is a contractual document rather than a marketing page.

It separates two things your privacy officer will want separated: the providers that touch clinical data (infrastructure, transcription and note drafting) and those that only touch account data (billing, transactional email, the marketing site).

How changes are handled

Akoua gives at least 30 days’ notice of any intended addition or replacement, by email to the practice owner. During that time you may object on reasonable data-protection grounds; if the objection can’t be resolved, you may terminate the affected service with a pro-rata refund.

Each sub-processor is placed under data-protection obligations materially equivalent to the Schedule before it begins processing clinical data for the UK service, and Akoua remains liable for their performance.

What we can and can’t evidence yet

Transcription runs on Deepgram’s EU regional service and note drafting on Amazon Bedrock, invoked from AWS London and served in AWS’s EU regions, for every consult. The transcription route is configured for zero retention of audio and transcripts and opted out of provider model-improvement programmes; Bedrock does not store prompts or outputs or use them to train models under AWS’s published commitments.

The transcription provider’s data-processing agreement is signed by both parties as of 4 September 2026, and it is what puts those controls on a contractual footing rather than a configuration one. The service is open to United Kingdom organisations.

Akoua does not yet collect independent deletion proof from those providers — see what happens to consult audio, which draws that line rather than letting a green tick imply more than we can show.