Sub-processors
Last updated: 23 October 2026
Remy (Armada Labs Studio Ltd) uses the third-party service providers below to help us
deliver the Remy platform. Each is a "sub-processor": they may process personal
data on our behalf, only to provide their service to us, and each is bound by a
contract (a Data Processing Agreement) requiring appropriate security and
confidentiality. Where a provider processes data outside the UK/EEA, we rely on
the safeguard shown ("SCCs" = the UK Addendum to the EU Standard Contractual
Clauses; "DPF" = EU-US Data Privacy Framework and UK extension).
A change to our AI providers
Remy's AI features (call and voicemail transcription, dictation, drafting help
and summaries) are moving from OpenAI and Anthropic, which process data in the
United States, to Amazon Web Services in London. From the switch date, the audio
and text these features handle is processed only in the UK (AWS region
eu-west-2) on an account we control, and the model providers themselves do not
see it. OpenAI and Anthropic remain listed below while the two providers run
side by side for a short comparison period, after which they are removed from
this page. Customers on our update list are told the switch date in advance.
Stay informed of changes
We will update this page before adding a new sub-processor that materially
affects how customer data is processed. To be notified of changes, email
privacy@remy.health and ask to join our sub-processor update list.
Core infrastructure
| Provider | Purpose | Region | Transfer safeguard |
|---|
| Supabase | Database, authentication, file storage | London, UK | None needed (UK) |
| Vercel | Application hosting and content delivery | London (lhr1) for application functions; global edge network for static content | SCCs / DPF (verify) |
| Sentry | Error monitoring for the application (technical error reports; Remy is built not to place patient or staff details in them) | EU / US (verify) | SCCs / DPF (verify) |
Communications
| Provider | Purpose | Region | Transfer safeguard |
|---|
| Twilio | SMS, voice calls, call recording, legacy transcription | Dublin (EU) edge; US parent | SCCs / DPF |
| Postmark (ActiveCampaign) | Transactional and marketing email delivery | US | SCCs / DPF (verify) |
| Google | OAuth sign-in and Gmail mailbox sync (where a practice connects it) | US/global | SCCs / DPF |
| Microsoft | OAuth sign-in and Outlook/Graph mailbox sync (where connected) | EU/US | SCCs / DPF |
| Expo | Push notification delivery for the Remy practitioner app (device tokens and notification text) | US | SCCs / DPF (verify) |
AI features
| Provider | Purpose | Region | Transfer safeguard |
|---|
| Amazon Web Services (Amazon Web Services EMEA SARL) | From the switch: call and voicemail transcription and live dictation (Amazon Transcribe); AI drafting, summaries, referral extraction and programme planning (Claude models on Amazon Bedrock). Audio is held in a private UK bucket for at most one day. AWS does not use this data to train models and the model provider does not see it. | London, UK (eu-west-2) | None needed (UK) |
| OpenAI | Being retired. Call/voicemail transcription and dictation (Whisper and Realtime) until the switch, then removed after the comparison period | US (OpenAI Ireland Ltd contracting entity) | SCCs + DPF; API data not used for training |
| Anthropic | Being retired. AI summaries and drafting (Claude) until the switch, then removed after the comparison period | US | SCCs + DPF; API data not used for training; short retention |
Payments and finance
| Provider | Purpose | Region | Transfer safeguard |
|---|
| Stripe | Card payments for patient invoices, agreements and payment links (Remy does not bill practices through Stripe) | US/global | SCCs / DPF |
| Xero | Accounting / invoice sync (where a practice connects it) | US / NZ | SCCs (verify) |
Optional integrations (only when a customer connects or enables them)
| Provider | Purpose | Region | Transfer safeguard |
|---|
| Cliniko | Practice-management two-way sync (patients, appointments, documents) | UK or AU shard | Depends on shard |
| HubSpot | One-time CRM data import chosen by the customer | US | SCCs / DPF |
| Google Maps Platform | Maps in the day planner and the People map, where a practice has it switched on (addresses and map positions) | US/global | SCCs / DPF |
Location services
| Provider | Purpose | Region | Transfer safeguard |
|---|
| postcodes.io | UK postcode geocoding | UK | None needed (UK) |
| OpenStreetMap | Map tiles | EU | None needed |
Not currently active but will be listed here if enabled: ElevenLabs (AI voice),
Zoom (phone), Daily (video rooms), Deepgram (enhanced transcription).