Sub-processors

This register supports security review and the proposed data processing agreement. It is not an executed DPA and does not make a provider active merely because the provider is listed.

Before real referrals flow, the Practice and Refera must execute a lawyer-reviewed DPA that incorporates an approved provider schedule, change-notice process and reasonable objection path. Provider scope must be updated here before it changes in the service.

Referral and patient processing stays on the AWS Sydney path. Real-referral Bedrock processing is conditional and inactive until its exact Australian model, route, logging, retention and release evidence passes. Every other provider below is restricted to business, payment, public-site, generic notification or optional support information and must not receive patient, referral or clinical information.

Across those separate business paths, the presently identified likely overseas recipient countries are the United States, United Kingdom, Ireland, Netherlands and Singapore. This is an overall public disclosure, not a claim that every provider uses every country. Provider-specific locations remain unresolved where the current provider evidence does not establish them, and must be settled in the executed DPA schedule.

Sub-processor	Service and scope	Lifecycle	Location or country	Patient or referral data
Amazon Web Services	Licensed platform: console/API compute, encrypted tenant and source storage, keys, privacy-safe logs and agreed infrastructure	Current	Sydney, Australia for the tenant and patient-data path	Permitted only after real-data activation within the approved Sydney boundary. Optional administrative setup email through Amazon SES remains separately conditional. AWS publishes certification coverage for ISO/IEC 27001, 27017, 27018 and 27701 across its in-scope services; those certifications belong to AWS, not Refera.
Amazon Bedrock	Future bounded source-document and administrative extraction request	Conditional	Sydney, Australia only if the exact activation evidence passes	Prohibited for real referral data until activation evidence passes. No clinical interpretation, patient marketing or model training.
Cloudflare	Public website, docs, status, analytics, business-only onboarding and authentication relays, billing API and private service checks. The portal record is DNS-only; Cloudflare does not proxy licensed referral traffic	Current	Global edge; provider-specific business-data country schedule unresolved	Prohibited
Stripe	Hosted practice subscription, invoice and payment processing when selected. Card and bank details stay on Stripe’s hosted surface	Current	Global platform; provider-specific country schedule unresolved	Prohibited
Resend	Account, agreement, sign-in and documented business email. Voice follow-up is limited to fixed generic intent and delivery metadata	Current	Provider-operated infrastructure; provider-specific country schedule unresolved	Prohibited
Amazon SES	Bounded practice/account setup email only if that exact path is activated	Conditional	Sydney service endpoint; downstream delivery locations require provider and counsel verification	Prohibited
Cloudflare D1	Explicit business contact, signup, billing, follow-up and delivery-state fields under a fixed allow-list	Current	Provider-operated infrastructure; provider-specific country schedule unresolved	Prohibited
Slack	Business follow-up and operational notifications	Current	Provider-operated infrastructure; provider-specific country schedule unresolved	Prohibited. Permitted content is requested business follow-up, business signup and billing state, bounded voice intent, and platform or release-health alerts. Assistant questions and replies, raw voice audio and transcript, free-text provider summaries, referral and patient material are prohibited.
Attio	Historical business-only CRM contact and lifecycle records; no new events. Records may remain until provider-confirmed export, closure and deletion evidence is complete	Retired	Historical provider location and deletion evidence unresolved	Prohibited
OpenRouter	Bounded product-request category, trusted Refera documentation extracts and bounded support-state enums/counts. No visitor-authored question, conversation history, contact identity or arbitrary page context	Current	Provider-operated infrastructure; provider-specific country schedule unresolved	Prohibited
ElevenLabs	Optional consented business sales/support audio and provider transcript only after explicit disclosure and consent	Conditional	Provider-operated infrastructure; provider-specific country schedule unresolved and must be verified before activation	Prohibited. Refera targets provider deletion within four hours after required delivery; provider retention is capped at one day, and deleted data may remain in provider backups for up to 30 days. Refera does not retain caller number, organisation, caller name, raw transcript or raw audio. ElevenLabs publishes ISO/IEC 27001 certification and an AICPA Type II system-and-organisation-controls report; those assurances belong to ElevenLabs.
Twilio	Retained fallback business telephone carrier for sales and product support audio and routing metadata. It is not a patient or referral line	Current	Provider-operated infrastructure; provider-specific country schedule unresolved	Prohibited
Telnyx	Candidate customer-visible business telephone carrier for sales and product support audio and routing metadata. Source configuration alone does not make the number customer-visible	Candidate	Provider-operated infrastructure; provider-specific country schedule unresolved and must be verified before activation	Prohibited. Use begins only after Refera verifies and publishes the active line.
Browser push providers	Optional generic delivery selected by the user’s browser: subscription endpoint, delivery timing and encrypted count-only payload	Current	Apple, Google, Mozilla or Microsoft global infrastructure; provider and country are device-dependent	Prohibited. No patient, referrer, practice, source, quoted timeframe or clinical content.

The Practice’s own mailbox, fax-to-email, secure-messaging and PMS providers are contracted by the Practice, not Refera. Each enabled capture arrangement must still appear in the Practice’s collection notice and the executed DPA schedule.

Web Push is optional and per device. Subscription records stay in AWS Sydney; the browser’s own push service is the only generic delivery hop outside that region. Inbox updates and device notifications documents the fixed lock-screen copy, iPhone Home Screen requirement, opt-out path and provider limits.

Web voice is optional. It loads only after the person reads the disclosure, consents and starts the session; the browser asks for microphone access after consent. A customer-visible phone number is shown only after Refera verifies and publishes the active line. Otherwise email and chat remain.

The text assistant follows a separate metadata-only rule. D1 may retain an explicit business contact name, work email, practice details and one bounded request category; Slack may receive the matching follow-up card. Neither receives the assistant question, reply, conversation history or an AI-generated summary. Attio is retired and receives no new events.

Related

• Data residency - the Australian patient-data boundary.
• Privacy and the APPs - APP 8 and the cross-border rule.
• Public privacy notice - current collection, use, disclosure and complaint information.