Legal
Sub-processors
Clayform uses the companies below to run the platform. For each one: what it does, the data it sees and where that data is processed. Health information is stored only in the UK or EU. Processing in the US happens only under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the table says what that data is.
- Last updated
- Last updated
- On this list
- 14 sub-processors
The list
- Sub-processor
- Supabase
- Purpose
- Postgres, Auth, Realtime, Storage
- Data it sees
- Everything at rest
- Location
- London
- Sub-processor
- Amazon Web Services (via Laravel Forge)
- Purpose
- API host, Horizon, Redis
- Data it sees
- Everything in process; Redis holds request-context cache and queue payloads (ids only)
- Location
- London (eu-west-2)
- Sub-processor
- Vercel
- Purpose
- Web app functions
- Data it sees
- PHI in transit, nothing stored
- Location
- London
- Sub-processor
- Stripe
- Purpose
- Payments, Connect, Invoicing, Terminal
- Data it sees
- Patient name, email, card; Booking references; no clinical fields
- Location
- Global (no PHI)
- Sub-processor
- Twilio
- Purpose
- Clinic Numbers, SMS, voice transport
- Data it sees
- Phone numbers and Message bodies; a staff-composed or inbound text may be clinical; bodies redacted after delivery
- Location
- US (IDTA)
- Sub-processor
- ElevenLabs
- Purpose
- AI Receptionist
- Data it sees
- Caller audio and transcript for a short period; no audio kept by Clayform
- Location
- US (IDTA); residency Enterprise-only
- Sub-processor
- Deepgram
- Purpose
- Consultation transcription
- Data it sees
- Consultation audio and transcript
- Location
- EU endpoint
- Sub-processor
- OpenAI
- Purpose
- Note Draft structuring; the Assistant, where a Clinic turns it on
- Data it sees
- Transcript; for the Assistant, Patient identity and contact details and operational data (Bookings, Messages, Reviews, orders, figures), never clinical records
- Location
- US (transfer terms in the OpenAI DPA); kept up to 30 days to check for misuse, never used for training
- Sub-processor
- Mailgun
- Purpose
- All email: transactional and staff-composed email, and Patient replies to a Clinic's email
- Data it sees
- Email address, name, Message body, reply text and attachments; a staff-composed email or a reply may be clinical; replies forwarded, not stored
- Location
- EU region
- Sub-processor
- Odoo.sh
- Purpose
- The Pharmacy's Odoo
- Data it sees
- Patient name and address on named-patient orders, Prescription PDF as attachment, lots and expiry; on an over-limit order, the Supply Limit note (cross-Clinic count as a bare number, Limit Acknowledgement reason, Supply Limit version)
- Location
- EU
- Sub-processor
- Premier Chemist (the Pharmacy)
- Purpose
- Dispensing and shipping
- Data it sees
- Named-patient order details and Prescriptions; cross-Clinic Supply Limit count and Limit Acknowledgements, in Odoo and through the Pharmacist login
- Location
- UK
- Sub-processor
- The Wholesaler (WDA(H))
- Purpose
- POM stock supply
- Data it sees
- Clinic and prescriber identity, stock lines; no Patient data
- Location
- UK
- Sub-processor
- Didit
- Purpose
- Identity checks for staff, Owners and home-delivery Patients, and Patients’ age checks before booking online
- Data it sees
- ID document and liveness during the check; images never stored by Clayform
- Location
- UK/EU (to be confirmed before launch)
- Sub-processor
- Sentry, PostHog
- Purpose
- Errors, product analytics
- Data it sees
- No PHI: structured logs are scrubbed, clinical routes excluded from autocapture
- Location
- UK/EU (to be confirmed before launch)
Changes to this list
Clayform gives Organisations 30 days' notice before a sub-processor is added to this list.
Connections a Clinic makes itself
QuickBooks Online, Xero, Mailchimp, Google Calendar and each Webhook Endpoint consumer are not Clayform sub-processors. The Clinic chooses them, authorises the Connection itself, and holds its own processor arrangement with the vendor.