Radiant Science UG uses the subprocessors below to provide its services. A provider marked conditional processes data only when that integration is configured for a customer.
Each entry states the region in which that provider processes data for us. Where we state a UK or EU region, that is the region our service is configured to use. It does not by itself mean no international transfer occurs: several providers below are incorporated outside the UK and EEA, and under the UK GDPR a transfer is assessed by reference to where the receiving entity is established, not where the servers are. Transfers from the United Kingdom to the EEA rely on the adequacy decision under Article 45 of the UK GDPR. For every other restricted transfer we rely on an appropriate mechanism — an adequacy decision, Standard Contractual Clauses, or the UK International Data Transfer Addendum — and record a transfer risk assessment covering the destination country, the applicable UK or EU transfer regime, and the legal basis before the provider is enabled.
Listing a technically available provider does not by itself authorize its use. Before a provider processes patient or other customer personal data, Radiant's DPO must confirm the DPA, transfer mechanism, processing location, retention and training settings, and any controller authorization required by the customer contract.
No provider below may use customer personal data to train, fine-tune or otherwise improve its models; this is prohibited by contract or by the provider's enterprise terms, and switched off where the provider offers a setting. Each provider is configured to the shortest data retention it offers for the services we use, and we keep a record of these settings for each provider.
Systems a clinic connects to the service, such as its practice management or electronic health record system, its calendar (for example Google Calendar) or its telephony, are the clinic's own Third-Party Applications under our Terms of Service and are not listed here.
Patient and service-user data
The data in this section may include contact details, call audio, transcripts, appointments, and special-category health data, depending on the configured workflow.
-
Twilio Ireland Limited
Telephony and messaging between the service, clinics, and service users.
Processing region: European Union (Ireland). Voice traffic runs over an Ireland-hosted SIP trunk using the Dublin edge, so call media is carried within the EU.
-
Microsoft Corporation (Azure)
Core cloud platform: infrastructure, databases, storage, caching, messaging, communications, and hosted AI processing.
Processing region: United Kingdom (UK South) for the platform, its data stores and operational telemetry. Hosted AI processing runs in Microsoft's European Union data zone.
-
Amazon Web Services EMEA SARL
Hosted AI processing.
Processing region: European Union (Ireland), using EU-resident inference only.
-
Soniox Inc.
Primary speech-to-text processing for call audio.
Processing region: European Union, using Soniox's EU regional endpoint.
-
Deepgram Inc. — conditional
Fallback speech-to-text processing for call audio, used when the primary provider is unavailable.
Processing region: European Union, using Deepgram's EU regional endpoint.
-
Cartesia AI, Inc.
Text-to-speech processing for generated call audio.
Processing region: European Union, using Cartesia's EU regional endpoint.
-
Mistral AI SAS — conditional
Fallback text-to-speech processing when the primary provider is unavailable.
Processing region: European Union. Mistral is established in France.
-
LiveKit Inc.
Real-time audio transport and managed call-session infrastructure.
Processing region: European Union. Call media is transported rather than stored; recordings are written to Radiant's own United Kingdom storage.
-
X.AI LLC — conditional
Hosted AI processing when an xAI enterprise model is configured.
Processing region: European Union, using xAI's EU regional endpoint.
Optional patient communications
-
Meta Platforms Ireland Limited (WhatsApp Business) — conditional
Encrypted patient messaging only when the customer has enabled sending links or messages through WhatsApp.
Processing region: European Union (Ireland), by the Irish Meta entity.
Customer and operational data
These providers process customer contacts, staff account data, support information, sanitized operational metadata, or the request metadata that necessarily arises from hosting our dashboard and website. They are not part of the call path. Radiant policy prohibits placing raw patient data, call recordings, transcripts, credentials, tokens, or request bodies in Slack, Linear, Plain, or similar business systems. Each entry states whether any patient data reaches the provider.
-
WorkOS, Inc.
Dashboard authentication and staff account management.
Processing region: United States only, as stated in WorkOS's data processing agreement.
Patient data: None.
-
Vercel Inc.
Hosts and serves our dashboards and websites.
Processing region: United States.
Patient data: None.
-
Slack Technologies, LLC
Internal and customer communication using sanitized business and incident data.
Processing region: United States.
Patient data: None.
-
Microsoft Corporation (Microsoft 365 and SharePoint)
Business communication, controlled documents, and restricted incident-evidence storage.
Processing region: European Union, under Microsoft's EU Data Boundary, with the continuing transfers Microsoft documents for support and security operations.
Patient data: Only in the restricted incident-evidence store, where an incident investigation requires it.
-
Google LLC (Google Workspace)
Internal business communication and documents.
Processing region: Global.
Patient data: None.
-
Linear Orbit, Inc.
Product delivery and incident coordination using sanitized data and restricted evidence links.
Processing region: United States.
Patient data: None.
-
Not Just Tickets Ltd (Plain)
Customer request management. Processes customer and clinic staff contact details and support correspondence using sanitized business data.
Processing region: European Union.
Patient data: None.
-
Plus Five Five, Inc. (trading as Resend)
Transactional email delivery for enquiry and contact forms submitted through our public website. Processes the name, email address, optional phone number, subject and message text that the sender chooses to submit.
Processing region: United States. Resend offers no EU processing region.
Patient data: None. Not used for patient communications.
-
PostHog, Inc.
Product and website analytics and error tracking: usage telemetry, performance metrics and aggregated behavioural data. Analytics are disabled until a visitor accepts them, and no analytics are collected where a visitor declines.
Processing region: European Union, using PostHog's EU Cloud region.
Patient data: None.
-
Browserbase, Inc. — conditional
Renders a clinic's public website so we can import its content.
Processing region: United States.
Patient data: None.
-
Functional Software, Inc. (Sentry)
Application error monitoring, performance monitoring, and operational telemetry using sanitized data.
Processing region: European Union for operational data. Limited account-level data, such as authentication data, is stored in the United States.
Patient data: None.