Sub-Processors

What are sub-processors?

Alliance for Better Care (“we”, “us”, or “our”) uses certain third-party service providers (“sub-processors”) to assist in delivering our services to you. These sub-processors may process personal data on our behalf in accordance with our instructions and in compliance with UK GDPR and other applicable data protection laws. 

We carefully select and monitor our sub-processors to ensure they provide appropriate technical and organisational measures to protect your data and meet our high standards for data security and privacy. 

Our commitment to data protection

When engaging sub-processors, we ensure that: 

  • Each sub-processor is bound by data protection obligations consistent with UK GDPR requirements  
  • Appropriate technical and organisational security measures are in place  
  • Data processing agreements are established that clearly define responsibilities and limitations  
  • Regular assessments are conducted to ensure ongoing compliance  
  • Sub-processors only process data for the specific purposes we have authorised  

List of sub-processors

Below is our current list of sub-processors, including information about the data they process and their location: 

Clinical & Patient Data Systems 

SystmOne (TPP) 

  • Purpose: Electronic health records system  
  • Data Processed: Patient health data, demographics, clinical records  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(c) – Legal obligation, Article 6(1)(e) – Public task, Article 9(2)(h) – Health or social care purposes, Article 6(1)(b) – Contract 
  • Retention Schedule: Lifetime plus 10 years after death 

EMIS Web 

  • Purpose: Electronic health records system  
  • Data Processed: Patient health data, demographics, clinical records  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(c) – Legal obligation, Article 6(1)(e) – Public task, Article 9(2)(h) – Health or social care purposes, Article 6(1)(b) – Contract 
  • Retention Schedule: Lifetime plus 10 years after death 

GP Connect 

  • Purpose: Clinical system interoperability  
  • Data Processed: Patient clinical data for system integration  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(c) – Legal obligation, Article 6(1)(e) – Public task, Article 9(2)(h) – Health or social care purposes, Article 6(1)(b) – Contract 
  • Retention Schedule: Does not store data  

APEX Insight 

  • Purpose: Clinical reporting and analytics  
  • Data Processed: Aggregated clinical data, patient records  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public task, Article 9(2)(h) – Health or social care purposes, Article 6(1)(b) – Contract 
  • Retention Schedule: Lifetime plus 10 years after death (Clinical Record Linked) 

Spiro Connect 

  • Purpose: Spirometry data management 
  • Data Processed: Respiratory test results, patient identifiers  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(c) – Legal obligation, Article 6(1)(e) – Public task, Article 9(2)(h) – Health or social care purposes, Article 6(1)(b) – Contract 
  • Retention Schedule: Lifetime plus 10 years after death (Clinical Record Linked) 

Meddbase 

  • Purpose: Occupational health management system  
  • Data Processed: Employee health records, occupational health data  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(c) – Legal obligation, Article 6(1)(e) – Public task, Article 9(2)(h) – Health or social care purposes, Article 6(1)(b) – Contract 
  • Retention Schedule: 40 years from last entry 

Heidi Health

  • Purpose: Ambient Voice Technology
  • Data Processed: Patient health data, demographics, clinical records  
  • Location: Ireland, Germany
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public task, Article 9(2)(h) – Health or social care purposes
  • Retention Schedule: 15 Days

Business and operational systems

Microsoft 365 

  • Purpose: Productivity suite, reporting, operational data processing  
  • Data Processed: Business communications, patient data for operational purposes, documents  
  • Location: United Kingdom/European Union  
  • Lawful Bases Under UK-GDPR: Article 6(1)(c) – Legal Obligation, Article 9(2)(b) – Employment, social security, and social protection law 
  • Retention Schedule: 180 Days – Exceptions of data flagged for legal hold. 

Microsoft Copilot 

  • Purpose: AI-powered operational assistance  
  • Data Processed: Business data, operational system data  
  • Location: European Union  
  • Lawful Bases Under UK-GDPR: Article 6(1)(c) – Legal Obligation, Article 9(2)(b) – Employment, social security, and social protection law 
  • Retention Schedule: 180 Days – Exceptions of data flagged for legal hold. 

Salesforce 

  • Purpose: Customer relationship and account management  
  • Data Processed: Customer contact details, account information, communication history  
  • Location: European Union  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract 
  • Retention Schedule: 6 Years 

DocuSign 

  • Purpose: Electronic signature and contract management  
  • Data Processed: Contract documents, signatory information, email addresses  
  • Location: European Union  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract 
  • Retention Schedule: 6 Years 

Adobe Acrobat 

  • Purpose: PDF Management 
  • Data Processed: Contract documents, signatory information, email addresses  
  • Location: European Union 
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract 
  • Retention Schedule: 6 Years 

Monday.com

  • Purpose: Referral and Support management for Veterans and Armed Forces Service
  • Data Processed: Patient health data, demographics
  • Location: United Kingdom/European Union  
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public task, Article 9(2)(h) – Health or social care purposes
  • Retention Schedule: 2 years from last contact

Financial systems

Sage 

  • Purpose: Payroll processing  
  • Data Processed: Employee payroll data, tax information, bank details  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract, Article 6(1)(c) – Legal Obligation, Article 6(1)(f) – Legitimate Interests 
  • Retention Schedule: 6 Years 

Xero 

  • Purpose: Accounting and financial management  
  • Data Processed: Financial transactions, invoices, supplier information  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract, Article 6(1)(c) – Legal Obligation, Article 6(1)(f) – Legitimate Interests 
  • Retention Schedule: 6 Years 

HR and staff management

Cezanne HR 

  • Purpose: Human resources management  
  • Data Processed: Employee personal data, employment records, performance data  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract, Article 9(2)(b) – Employment, social security, and social protection law 
  • Retention Schedule: 6 Years 

Ulysses 

  • Purpose: Incident reporting and management  
  • Data Processed: Incident reports, staff information, event data  
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public Task / Public Interest, Article 9(2)(h) – Health or social care 
  • Retention Schedule: 20 Year (Serious Incidents), 10 Years (Non-Serious Incidents) 

Access – Currently Decommissioning in Progress (April 2026) 

  • Purpose: Learning Management System  
  • Data Processed: Staff information, Training Records 
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 9(2)(b) – Employment, social security, and social protection law 
  • Retention Schedule: 6 Years 

Kallidus – Replacing Access (April 2026) 

  • Purpose: Learning Management System  
  • Data Processed: Staff information, Training Records
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 9(2)(b) – Employment, social security, and social protection law 
  • Retention Schedule: 6 Years 

Security and IT management

Bitwarden 

  • Purpose: Password and credential management  
  • Data Processed: Encrypted passwords, login credentials  
  • Location: United States (EU data centres available)  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract 
  • Retention Schedule: Permanent – Until user deletion 

Communications and marketing

Mailchimp 

  • Purpose: Email newsletter distribution and masterclass marketing
  • Data Processed: Email addresses, names, engagement data  
  • Location: United States (UK-GDPR-compliant)  
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public Task / Public Interest, Article 6(1)(f) – Legitimate Interests, Article 9(2)(g) – Substantial public interest 
  • Retention Schedule: 12 Months after last meaningful interaction/immediate if consent withdrawn 

Hootsuite 

  • Purpose: Social media management  
  • Data Processed: Social media content, engagement metrics  
  • Location: Canada (UK-GDPR-compliant)  
  • Lawful Bases Under UK-GDPR: Article 6(1)(f) – Legitimate Interests 
  • Retention Schedule: 12 Months 

Google Business 

  • Purpose: Business profile and review management  
  • Data Processed: Business information, customer reviews, engagement data  
  • Location: United States (UK-GDPR-compliant)  
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public Task / Public Interest, Article 6(1)(f) – Legitimate Interests 
  • Retention Schedule: 2 Years 

UK Relay 

  • Purpose: Telephone relay service for accessibility  
  • Data Processed: Call data, conversation transcripts
  • Location: United Kingdom  
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public Task / Public Interest, Article 9(2)(a) – Explicit consent, Article 9(2)(h) – Health or social care
  • Retention Schedule: 6 Years 

Event and survey management

Eventbrite 

  • Purpose: Event management and ticketing  
  • Data Processed: Attendee names, email addresses, registration data  
  • Location: United States (UK-GDPR-compliant)  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract, Article 6(1)(e) – Public Task / Public Interest, Article 6(1)(f) – Legitimate Interests 
  • Retention Schedule: 12 Months post event 

SurveyMonkey 

  • Purpose: Survey creation and management  
  • Data Processed: Survey responses, respondent contact information  
  • Location: United States (UK-GDPR-compliant)  
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public Task / Public Interest, Article 6(1)(f) – Legitimate Interests, Article 9(2)(h) – Health or social care, Article 9(2)(g) – Substantial public interest
  • Retention Schedule: 12 Months 

Mentimeter 

  • Purpose: Interactive presentations and quizzes  
  • Data Processed: Quiz responses, participant identifiers  
  • Location: Sweden  
  • Lawful Bases Under UK-GDPR: Article 6(1)(e) – Public Task / Public Interest, Article 6(1)(f) – Legitimate Interests 
  • Retention Schedule: 6 Months 

Website hosting and management

Wix 

  • Purpose: Website hosting and management  
  • Data Processed: Website analytics, form submissions, visitor data  
  • Location: United States (UK-GDPR-compliant)  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract 
  • Retention Schedule: 6 Years 

SiteGround 

  • Purpose: Website hosting  
  • Data Processed: Website files, visitor logs, form submissions  
  • Location: European Union  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract, Article 9(2)(g) – Substantial public interest 
  • Retention Schedule: 6 Years 

WordPress 

  • Purpose: Website content management  
  • Data Processed: Website content, user accounts, comments  
  • Location: United States (UK-GDPR-compliant)  
  • Lawful Bases Under UK-GDPR: Article 6(1)(b) – Contract 
  • Retention Schedule: 6 Years 

Software development and testing

Anthropic AI Suite 

  • Purpose: Software Development (Non-Production development only) 
  • Data Processed: Code (No commercial or special category data) 
  • Location: United States 
  • Lawful Bases Under UK-GDPR: N/A 
  • Retention Schedule: 30 Days 

International data transfers

Where sub-processors are located outside the United Kingdom or European Economic Area (EEA), we ensure that appropriate safeguards are in place to protect your data, including: 

  • Standard Contractual Clauses approved by the UK Information Commissioner’s Office  
  • Adequacy decisions where applicable  
  • Additional security measures and contractual protections  
  • Data processing addendum  
  • All sub-processors located outside the UK/EEA have committed to GDPR-equivalent data protection standards.

Changes to sub-processors

We may add, remove, or replace sub-processors from time to time as our business needs evolve. When we make changes to our list of sub-processors that may affect the processing of personal data, we will: 

  • Update this page with the current information  
  • Notify affected customers of any material changes where required  
  • Provide reasonable notice prior to any new sub-processor processing data  

We recommend checking this page periodically for updates. The “Last Updated” date at the top of this page indicates when changes were last made.

Your rights and questions

If you have questions about our sub-processors or how your data is processed, please contact us. You have the right to: 

  • Request information about how your data is processed  
  • Object to specific data processing activities  
  • Request access to your personal data  
  • Request correction or deletion of your personal data  

Contact information

  • Data Controller

    Alliance for Better Care CIC
    Horley Health Hub
    120 Victoria Road
    Horley
    RH6 7BL

    Contact for general privacy enquiries

  • Data Protection Officer

    For Alliance for Better Care Head Office and Non-Practice Functions:
    Richard Newell (Your-DPO)
    Contactable via Alliance for Better Care Head Office (Horley Health Hub)

Making a complaint

If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with: 

Information Commissioner’s Office (ICO) 

Website: www.ico.org.uk 

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate) 

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

Alliance for Better Care CIC ICO Registration Number: ZA505659

Link to record: Alliance For Better Care CIC | ICO 

Document control

This sub-processors statement is reviewed annually and updated as necessary to reflect changes in our practices, regulatory requirements, or organisational structure. 

Version: 1.0 

Last Updated: February 2026 

Next Review Date: January 2027 

Owner: Information Governance Lead 

Approved By: Senior Information Risk Officer and Data Protection Officer