These are the providers that process data for Chronix Scribe. A new provider is added here, with at least 30 days' notice to account owners, before it receives any data (clause 9 of the data processing agreement).
Audio is never stored on our servers or by any provider below. The optional offline mode of the Chronix Scribe mobile app (when the mobile app is released) holds audio encrypted on the clinician's own device only until it has been transcribed, and then deletes it.
In use
| Provider | What it does for Chronix Scribe | Where | What data it sees |
|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database, sign-in and file storage (clinical images) | Stored in London, UK | Everything the app stores: accounts, transcripts, notes, summaries, documents, patients, images, consent records |
| Speechmatics (Cantab Research Ltd) | Speech-to-text transcription | Europe | Consultation audio, in memory and in transit only; the text transcript it returns. Batch jobs are deleted as soon as the transcript comes back |
| Anthropic Ireland, Limited | AI drafting of notes, summaries, letters, translations and other text; and the AI support assistant that answers the support chat and email to support@ | United States | Text only — transcript and note text needed for the task; for support, the question and help-centre articles (messages with patient details are refused before they reach it). Never audio. Not used to train Anthropic's models |
| Vercel Inc. | Hosting of the app and website, and the app's server functions | Server functions: London, UK; content delivery worldwide | Requests and responses passing through the app's servers, in transit only; not stored |
| Railway Corporation | Malware scanning of uploaded clinical photos | Netherlands (EU) | Each uploaded photo, in transit, for the scan only; not stored |
| Stripe (Stripe Payments Europe, Limited; the United States entity is Stripe, LLC) | Payments, subscriptions, invoices and refunds | Ireland (EU) and United States | Billing contact, organisation name, plan and payment details — never patient information |
| Resend (Plus Five Five, Inc.) | Sending our emails, and receiving email sent to support@ | Ireland (EU) | Recipient address and the email's content; for received mail, the sender's message — never patient information |
| Google Cloud EMEA Limited (Google Workspace) | The support@ mailbox, where our staff read and reply to support email | United States and other Google locations | Support emails and our replies — never patient information |
Planned — not in use today
| Provider | What it will do | Where |
|---|---|---|
| Amazon Web Services (Amazon Bedrock) | AI drafting inside the UK, replacing the United States service above for note drafting | London, UK (eu-west-2) |
| Microsoft (Azure AI Speech) | Speech-to-text for languages Speechmatics does not cover | UK South (London) |
| Twilio | Sending a patient-summary link by SMS or WhatsApp (the message holds only the link) | To be confirmed when switched on |
When any of these is switched on we will update this page first and give account owners the notice clause 9 of the data processing agreement requires.
Transfers outside the UK
Each provider is judged by where the company is established, not where its servers are. We transfer data to a provider established outside the UK only under UK adequacy regulations, the UK–US data bridge where the provider is certified under it, or the UK International Data Transfer Addendum to the European Commission's standard contractual clauses (for which we keep a transfer risk assessment). To get a copy of the safeguards, email privacy@chronixhealthgroup.com.
| Provider | Established | Safeguard |
|---|---|---|
| Supabase Pte. Ltd. | Singapore (data stored in London) | The Addendum; Singapore has no UK adequacy regulations |
| Vercel Inc., Railway Corporation, Plus Five Five, Inc. (Resend) | United States | The UK–US data bridge where the provider is certified under it; UK transfer clauses in its agreement as a second safeguard |
| Stripe, LLC | United States | The UK–US data bridge |
| Anthropic Ireland, Limited | Ireland (it processes in the United States) | UK adequacy regulations (Ireland) |
| Google Cloud EMEA Limited | Ireland | UK adequacy regulations |
Speechmatics is a United Kingdom company, so no transfer arises; it receives speech in France, Germany and Switzerland, which UK adequacy regulations cover.
Changes
We record every change to this page with its date. Account owners are told by email at least 30 days before a new provider starts processing data.
| Date | Change |
|---|---|
| 29 September 2026 | Version 2026-10 published |
| 29 September 2026 | Version 2026-11 published |
| 3 October 2026 | Version 2026-12 published: speech-to-text location stated as Europe and the countries named under transfers |
| 4 October 2026 | Version 2026-13 published: provider names corrected to the contracting company (Supabase Pte. Ltd. in Singapore, Anthropic Ireland, Limited, Stripe, LLC, Railway Corporation, Plus Five Five, Inc., Google Cloud EMEA Limited); transfers stated by where each provider is established. No provider was added or replaced |
Chronix Health Group Ltd · company number 16663224 · registered in England and Wales · registered office 11-13 Upper High Street, Epsom, Surrey, KT17 4QY · ICO registration ZB962513 · privacy@chronixhealthgroup.com