Sub-processors
Agent-reviewed draft. Not legal advice and not in force until signed. A professional legal review is recommended once revenue allows.
These are the providers that process practice data for Turstone. Turstone gives practices 30 days' notice of any change (see the DPA). The machine-readable list is a machine-readable copy of this list; a test fails if code can reach a host that is not listed.
Turstone's sub-processors
| Name | Entity | Purpose | Data | Region | Transfer mechanism |
|---|---|---|---|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL | Hosting, database, storage, key management, secrets, logs, backups | All practice data, encrypted | eu-west-1 (Ireland); backups also in eu-central-1 (Frankfurt) | AWS DPA with SCCs; EU hosting; see TIA |
| Amazon CloudFront and AWS WAF (edge) | Amazon Web Services EMEA SARL | Serving the web app and links, TLS termination, request filtering | Request paths (a link path carries a single-use token), client IP address, TLS-terminated traffic; the firewall keeps metrics only, no request log | Edge locations in the EU and North America (price class 100); firewall and certificate control plane in us-east-1 | AWS DPA with SCCs; see TIA |
| Amazon SES | Amazon Web Services EMEA SARL | Sending the owner's own notice emails and verification codes; at onboarding, the owner's account-set-up email and the staff invite emails (a set-password link), and the practice's ComReg filing sheet to Turstone's own onboarding mailbox | Owner email address; an invited staff member's email address; for the ComReg sheet, the practice's legal name, business address and the owner's email address; fixed-text emails, never patient data | eu-west-1 | As above |
| Twilio | Twilio Ireland Ltd | Sending text messages, delivery status, and receiving patients' replies on the practice's own texting number | Patient mobile, first name, message text (including free text a patient sends to the practice's number) | IE1 (Ireland) | Twilio DPA with SCCs; Irish region; see TIA |
| Auth0 | Okta, Inc. (Auth0) [VERIFY the contracting entity for EU tenants] | Sign-in for owners, staff and agency users; creating their sign-in accounts and set-password links (Turstone's operator task only, through the tenant's canonical host turstone.eu.auth0.com) |
Sign-in identity (email, name), authentication events | EU tenant | Auth0 DPA with SCCs; see TIA |
| Stripe | Stripe Payments Europe Ltd | Billing of practices (subscriptions, invoices, VAT); and, through Stripe Connect, the practice's own patient payments, under the practice's own Stripe agreement | Practice billing details: the legal name, the business address (for a sole trader this may be a home address), the VAT number and the owner's verified email address, and invoices. Patient payments go to the practice's own Stripe account (the practice is the merchant; Turstone never holds funds), and card data stays with Stripe | EU; Stripe may use US affiliates | Stripe DPA with SCCs; Stripe is an independent controller for parts of payment processing [VERIFY]; see TIA |
| WhatsApp (optional: only for practices that switch WhatsApp on) | WhatsApp Ireland Limited | Delivering messages to and receiving replies from patients who chose WhatsApp (the WhatsApp Cloud API, hosted by Meta, at graph.facebook.com) | Patient mobile, first name, message text; what we send never has clinical detail, an appointment type or a staff member; a patient's reply is whatever the patient writes | Processed by WhatsApp Ireland Limited; transferred to WhatsApp LLC and Meta Platforms, Inc. (US) | EU-US Data Privacy Framework (SCCs reserved); see TIA |
| Google (Business Profile) (optional: only for Plus practices that connect their Google Business Profile) | Google Ireland Limited | Reading the practice's own Google reviews and monthly profile figures; publishing the review replies and posts the owner approved (mybusiness, mybusinessaccountmanagement, mybusinessbusinessinformation and businessprofileperformance.googleapis.com) | Public reviews (reviewer display name, rating, text), owner-approved reply and post texts, aggregate profile figures; never patient records | Google's own; the practice's Google account [VERIFY] | Google's data processing terms with SCCs [VERIFY]; see TIA |
| Amazon Bedrock (optional: only when a Plus practice's owner asks for an AI reply draft) | Amazon Web Services EMEA SARL | Classifying a Google review and choosing a reply from Turstone's fixed template bank (the model's own text is never used); the owner reviews it and nothing is posted without the owner's approval (bedrock-runtime.eu-west-1.amazonaws.com) | One public review's text and rating and the template ids to choose from (not the practice's name) | EU (eu-west-1; an EU inference profile may process in other EU regions) [VERIFY] | AWS DPA with SCCs; EU processing [VERIFY]; see TIA |
| Meta (lead ads) (optional: only for Plus practices that connect Facebook or Instagram lead ads) | Meta Platforms Ireland Limited | Reading each lead a person submitted to the practice's own ad form (graph.facebook.com) | The lead's name, phone number, email address and time; other form answers are discarded unread | Processed by Meta Platforms Ireland Limited; transferred to Meta Platforms, Inc. (US) | EU-US Data Privacy Framework (SCCs reserved) [VERIFY]; see TIA |
Practice-chosen sources (not Turstone sub-processors)
These are the practice's own accounts. Turstone reaches them only on the practice's instruction, with the practice's own credentials or consent, and only while the practice keeps them connected. They are listed so the practice knows exactly where Chairfill may connect.
| Name | Purpose | Data read | Region |
|---|---|---|---|
| Dentally | Practice management system sync (API token issued by the practice, or, from M8, the practice's grant to Turstone as a Dentally partner and its Dentally practice ID) | The administrative fields only | Provider-defined; the practice's own agreement |
| Cliniko | Practice management system sync (API key issued by the practice) | The administrative fields only | Provider-defined; the practice's own agreement |
| Google (Calendar, Sheets) | Read-only OAuth connection for a calendar or spreadsheet | Event start and end and guest emails for matching; sheet rows; never titles or descriptions | Google's own; the practice's Google account |
| Microsoft (Graph: Outlook and Microsoft 365 calendars) | Read-only OAuth connection for a calendar | Event start and end and guest emails for matching; never subject or body | Microsoft's own; the practice's Microsoft account |
Not sub-processors
- GitHub: source code and CI only; no customer or production data ever reaches it.
- Renovate: dependency-update pull requests on code; no customer data.
- Turstone Sync (M8): Turstone's own helper script, installed by the practice on its own PC; it contacts only
app.turstone.comand uses no third party, so it adds no sub-processor.