Sub-processor List
Every external processing hop the service makes is recorded immutably and is disclosable to your practice in-product — this list cannot silently drift from what actually runs. Organisations in Australia and New Zealand run a separate deployment with its own geography — that list is at Australian sub-processors. Practices receive advance notice of changes per the Schedule and may object on reasonable data-protection grounds.
Automated transcription and note drafting for the United Kingdom service run on the two clinical-data sub-processors below as the ordinary route for every consult: transcription on Deepgram's EU regional service, and note drafting on Amazon Bedrock, invoked from AWS London (eu-west-2) and served in Amazon Web Services' European Union regions under its EU inference profile. Akoua is the processor, and the record itself stays in the United Kingdom. AWS supplies the underlying London infrastructure.
Clinical Data sub-processors
| Sub-processor | Purpose | Processing location | Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure: storage, database, compute for the UK deployment | United Kingdom (eu-west-2, London) | Processing in-country; AWS DPA |
| Deepgram, Inc. | Automated speech-to-text of consult audio — the transcription route for every consult | European Union (Frankfurt, Germany — Deepgram EU regional service) | UK→EU under UK adequacy for the EEA; zero-retention configuration and model-improvement opt-out (live configuration); anonymous diarisation only; Deepgram DPA |
| Amazon Web Services (AWS) — Amazon Bedrock | Automated drafting of clinical documentation from the transcript, for the clinician's review — the note-drafting route for every consult | Invoked from the United Kingdom (eu-west-2, London); served in Amazon Web Services' European Union regions under the EU cross-region inference profile | UK→EU under UK adequacy for the EEA; Bedrock does not store prompts or outputs or use them to train models under AWS's published commitments; AWS DPA |
Practice-management integrations (optional; only if your practice connects one)
Cliniko is enabled for the United Kingdom deployment; Nookal is currently disabled, and listed here ahead of any activation. Neither engages unless your practice connects it, and each receives only practitioner and appointment identifiers, one linked patient's minimum demographics, and a confirmed note or letter when the clinician explicitly sends it — never your patient list, and never anything you have not confirmed. How connecting works. The service is open to United Kingdom organisations.
| Sub-processor | Purpose | Processing location | Safeguard |
|---|---|---|---|
| Cliniko | Practitioner and appointment identifiers, one linked patient's minimum demographics, and a confirmed note or letter when the clinician explicitly sends it | United Kingdom or the European Union — your practice's own Cliniko account, which must sit in a region approved for the United Kingdom deployment | Your practice's own system under its own agreement with the vendor; approved-region allowlist enforced in code; only what the clinician explicitly sends |
| Nookal | Same as Cliniko. Integration currently disabled; listed for completeness ahead of any activation. | United Kingdom or the European Union — your practice's own Nookal account, which must sit in a region approved for the United Kingdom deployment | Your practice's own system under its own agreement with the vendor; approved-region allowlist enforced in code; only what the clinician explicitly sends |
Account Data sub-processors (business operations; no Clinical Data)
| Sub-processor | Purpose | Processing location | Safeguard |
|---|---|---|---|
| Stripe | Subscription billing and payment processing | Stripe's standard locations (US/EU) | Stripe DPA and its transfer mechanisms |
| Cloudflare | Marketing site hosting; signup bot-protection (Turnstile) | Global edge | No Clinical Data touches Cloudflare — the application hosts are deliberately not proxied |
| Amazon Web Services (AWS) — Simple Email Service | Transactional email (sign-in codes, billing notices) | United Kingdom (eu-west-2, London) | Processing in-country; AWS DPA |
| Apple | App Store purchases and App Attest device attestation for the iOS and macOS apps | Apple's standard locations | Apple's terms and its transfer mechanisms |
| Google Play billing and Play Integrity attestation for the Android app | Google's standard locations | Google's terms and its transfer mechanisms |
Questions about this list: privacy@akoua.ai.