Sub-processors
Last updated 8 September 2026
These are the service providers PatientMail (Kari Labs Ltd) uses to deliver the service, each bound by contract to process data only on our instructions unless noted as independently responsible. We tell every provider that the data includes health information so it is treated as sensitive, and we verify US providers' certifications quarterly. Practices receive 30 days' notice of any change to this list and may object under the data processing agreement.
| Provider | What it does | Data it touches | Where | Transfer safeguard |
|---|---|---|---|---|
| Supabase (on Amazon Web Services) | Database hosting | Everything PatientMail stores | European Union (Frankfurt) | No restricted transfer — the data stays in the EU |
| Vercel | Application hosting | Requests to the application | United States | UK Extension to the EU–US Data Privacy Framework, or an International Data Transfer Agreement with a documented risk assessment |
| Meta Platforms | WhatsApp message delivery | Message content (held up to 30 days to deliver it) and phone numbers | United States / EU | WhatsApp Business Data Processing Terms. The transfer route depends on which Meta company contracts with the practice: WhatsApp Ireland — no restricted transfer from the UK's point of view beyond the EU, covered by the UK Extension to the EU–US Data Privacy Framework for onward US processing; WhatsApp LLC — the WhatsApp Business UK Data Transfer Addendum, preceded by a documented data protection test. Being confirmed before WhatsApp goes live. Meta is independently responsible for some aspects of its platform |
| Twilio | Text message delivery | Message content and mobile numbers | United States | UK Extension to the EU–US Data Privacy Framework, or an International Data Transfer Agreement with a documented risk assessment |
| The SMS Works | Text message delivery (used in place of Twilio where a practice's account is configured for it) | Message content and mobile numbers | United Kingdom | No restricted transfer — the data stays in the UK |
| Resend | Email delivery | Email content and addresses | United States | UK Extension to the EU–US Data Privacy Framework, or an International Data Transfer Agreement with a documented risk assessment |
| Stripe | Deposit payments | Payment amounts and references. Card details go to Stripe directly and never reach PatientMail | United States / EU | Stripe's data processing agreement. Stripe is independently responsible for card, fraud-prevention and tax data under its own privacy policy |
Dentally, your practice management system, is your own provider and does not appear here — PatientMail reads from it on your instruction. See also our privacy policy and data processing agreement.