UK GDPR Article 28(2) · Last reviewed 17 May 2026
Sub-processors
The third parties below process personal data on behalf of attune Therapeutics Ltd in order to deliver the platform. Each is bound by a written processing agreement that mirrors the controls in our Data Processing Agreement.
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting + Postgres + self-hosted Jitsi video bridge | EU (Helsinki, Finland; Falkenstein, Germany for backups) | EU/UK GDPR, no international transfer |
| Stripe Payments Europe Ltd | Payment processing, Connect payouts | EU (Ireland) | EU/UK GDPR + SCCs for US support access |
| Google Ireland Ltd (Workspace SMTP Relay) | Primary transactional email delivery (booking confirmations, reminders, password resets) | EU (Ireland), with US support fallback | UK IDTA + EU SCCs |
| Resend, Inc. | Transactional email fallback when SMTP Relay is unavailable | United States | UK IDTA + EU SCCs |
| Apple Distribution International Ltd | Apple Push Notification service (APNs) for the iOS app | EU (Ireland) | EU/UK GDPR, only an opaque device token is sent |
| Cloudflare, Inc. | Authoritative DNS for attune-therapeutics.uk | United States | UK IDTA + EU SCCs |
| PostHog Inc. | Product analytics (anonymised event stream, no PII) | EU (Frankfurt) | EU/UK GDPR, no international transfer |
| Sentry (Functional Software, Inc.) | Server-side error tracking and uptime monitoring | EU (German region) | EU/UK GDPR |
| Cal.com, Inc. (per-therapist opt-in only) | Optional external-calendar OAuth bridge: when an individual therapist clicks "Connect Cal.com" on their availability page, attune fetches their published slot availability from Cal.com Platform v2. Therapists who don’t connect never have any data sent. No client data crosses to Cal.com, only the therapist’s own event-type / slot config is read back. | EU | EU/UK GDPR |
Right to object to a new sub-processor
Where attune appoints a new sub-processor, or replaces an existing one, we give therapists at least 30 days' written notice. During that window you may object in writing - contact [email protected]. If we cannot reasonably mitigate the objection within the notice period you may terminate the affected services without penalty.
This page is the canonical sub-processor list; we do not maintain a separate register elsewhere. Material changes are mirrored to the version-controlled DPA on /legal/dpa.