This is a previous version, superseded on 14 Oct 2026. View the current version.
Legal
Subprocessors
Last updated · 17 Sep 2026
Download PDFRadiant Science UG uses the subprocessors below to provide its services. A provider marked conditional processes data only when that integration is configured for a customer.
Each entry states the region in which that provider processes data for us. Where we state a UK or EU region, that is the region our service is configured to use. It does not by itself mean no international transfer occurs: several providers below are incorporated outside the UK and EEA, and under the UK GDPR a transfer is assessed by reference to where the receiving entity is established, not where the servers are. Transfers from the United Kingdom to the EEA rely on the adequacy decision under Article 45 of the UK GDPR. For every other restricted transfer we rely on an appropriate mechanism — an adequacy decision, Standard Contractual Clauses, or the UK International Data Transfer Addendum — and record a transfer risk assessment covering the destination country, the applicable UK or EU transfer regime, and the legal basis before the provider is enabled.
Listing a technically available provider does not by itself authorize its use. Before a provider processes patient or other customer personal data, Radiant's DPO must confirm the DPA, transfer mechanism, processing location, retention and training settings, and any controller authorization required by the customer contract.
Patient and service-user data
The data in this section may include contact details, call audio, transcripts, appointments, and special-category health data, depending on the configured workflow.
-
Twilio Ireland Limited
Telephony and messaging between the service, clinics, and service users.
Processing region: European Union (Ireland). Voice traffic runs over an Ireland-hosted SIP trunk using the Dublin edge, so call media is carried within the EU.
-
Microsoft Corporation (Azure)
Core cloud platform: infrastructure, databases, storage, caching, messaging, communications, and hosted AI processing.
Processing region: United Kingdom (UK South) for the platform, its data stores and operational telemetry. Hosted AI processing runs in Microsoft's European Union data zone.
-
Amazon Web Services EMEA SARL
Hosted AI processing.
Processing region: European Union (Ireland), using EU-resident inference only.
-
Soniox Inc.
Primary speech-to-text processing for call audio.
Processing region: European Union, using Soniox's EU regional endpoint.
-
Deepgram Inc. — conditional
Fallback speech-to-text processing for call audio, used when the primary provider is unavailable.
Processing region: European Union, using Deepgram's EU regional endpoint.
-
Cartesia AI, Inc.
Text-to-speech processing for generated call audio.
Processing region: European Union, using Cartesia's EU regional endpoint.
-
Mistral AI SAS — conditional
Fallback text-to-speech processing when the primary provider is unavailable.
Processing region: European Union. Mistral is established in France.
-
LiveKit Inc.
Real-time audio transport and managed call-session infrastructure.
Processing region: European Union. Call media is transported rather than stored; recordings are written to Radiant's own United Kingdom storage.
-
X.AI LLC — conditional
Hosted AI processing when an xAI enterprise model is configured.
Processing region: European Union, using xAI's EU regional endpoint.
Optional patient communications
-
Meta Platforms Ireland Limited (WhatsApp Business) — conditional
Encrypted patient messaging only when the customer has enabled sending links or messages through WhatsApp.
Processing region: European Union (Ireland), by the Irish Meta entity.
Customer and operational data
These providers process customer contacts, staff account data, support information, sanitized operational metadata, or the request metadata that necessarily arises from hosting our dashboard and website. Radiant policy prohibits placing raw patient data, call recordings, transcripts, credentials, tokens, or request bodies in Slack, Linear, Plain, or similar business systems.
-
WorkOS, Inc.
Dashboard authentication and staff account management.
Processing region: United States only, as stated in WorkOS's data processing agreement. No patient data is ever sent to WorkOS.
-
Vercel Inc.
Hosts and serves our dashboards and websites.
Processing region: United States. No patient data is ever sent to Vercel.
-
Slack Technologies, LLC
Internal and customer communication using sanitized business and incident data.
Processing region: United States.
-
Microsoft Corporation (Microsoft 365 and SharePoint)
Business communication, controlled documents, and restricted incident-evidence storage.
Processing region: European Union, under Microsoft's EU Data Boundary, with the continuing transfers Microsoft documents for support and security operations.
-
Google LLC (Google Workspace and Google Calendar)
Business communication, and calendar synchronisation where a clinic has connected a Google calendar.
Processing region: global. Google Calendar offers no UK or EU residency control, so appointment data synchronised to a clinic's Google calendar may be processed outside the UK and EEA.
-
Linear Orbit, Inc.
Product delivery and incident coordination using sanitized data and restricted evidence links.
Processing region: United States.
-
Not Just Tickets Ltd (Plain)
Customer request management. Processes customer and clinic staff contact details and support correspondence using sanitized business data.
Processing region: European Union.
-
Plus Five Five, Inc. (trading as Resend)
Transactional email delivery for enquiry and contact forms submitted through our public website. Processes the name, email address, optional phone number, subject and message text that the sender chooses to submit. Not used for patient communications and not part of the call path.
Processing region: United States. Resend offers no EU processing region.
-
PostHog, Inc.
Product and website analytics and error tracking: usage telemetry, performance metrics and aggregated behavioural data. Analytics are disabled until a visitor accepts them, and no analytics are collected where a visitor declines.
Processing region: European Union, using PostHog's EU Cloud region.
-
Browserbase, Inc. — conditional
Renders a clinic's public website so we can import its content.
Processing region: United States. No patient data is ever sent to Browserbase.
-
Functional Software, Inc. (Sentry)
Application error monitoring, performance monitoring, and operational telemetry using sanitized data.
Processing region: European Union for operational data. Limited account-level data, such as authentication data, is stored in the United States.