Legal & compliance documents.

Provider	Purpose and data handled	Location
Supabase	Database, authentication and file storage. All patient and practice data; stored exclusively in Australia.	Australia (Sydney)
Anthropic	Pro plan AI: reading patient SMS replies (shortened reply text only), wording recall messages (practice name, timing and your template only), summarising the ROI report (practice totals only), and, for Pro practices that turn it on, replying to simple patient questions from the practice's own FAQ. For AI replies: the last few messages exchanged with that patient (each shortened to 500 characters, with e-mail addresses and long numbers removed), the practice's own FAQ text and booking link, and the practice name; patient names, phone numbers and dates of birth are never attached, though a message may contain whatever the patient typed.	USA
OpenAI	Backup SMS reply classification if Anthropic is unavailable (Pro plan). Shortened reply text only; no patient name, phone number or practice identity.	USA
ClickSend	SMS delivery and inbound replies. Patient mobile numbers, SMS content and delivery receipts.	Australia
Resend	Email delivery: recall emails to patients (email address and message content, where email sending is enabled for a practice); account emails to practices (sign-up confirmation, welcome, password and billing notices); delivery, bounce and complaint notifications about the emails it sends; and, where a practice turns it on, a staff digest of patient replies that need attention, sent to the practice's nominated contact address (patient name and a short reply excerpt).	USA
Stripe	Billing (no patient data). Practice billing contact and payment details.	USA (Stripe Australia entity)
Vercel	Website and portal hosting; cookieless web analytics (no patient data stored). The portal handles patient data on screen for logged-in practice staff.	USA (Sydney edge)
Railway	Application servers — patient data in transit only, never stored.	Singapore
Sentry	Error monitoring. Patient information is scrubbed from error reports before they are sent.	EU
Google Workspace	Our own business mailboxes (contact@, privacy@ and the unsubscribe@ address patients can write to). Whatever a sender includes in an email to us; an emailed unsubscribe request always includes the patient's own email address.	USA or other countries

RecallQ discloses every sub-processor that handles personal information, in line with APP 1.4 and APP 8. Our Data Processing Agreement describes how cross-border handling is managed. RecallQ relies on each provider's published data-processing terms.

Built but not yet in use

The following services are not handling any personal information today. We will update this page before any of them is switched on.

Provider	Planned purpose and data	Location
RecallQ booking page (self-hosted cal.diy)	Patient self-booking links. Designed to receive only an opaque booking reference and appointment times — no patient name, phone number or email.	Planned: Australia (Sydney)
Cal.com	Booking a sales call with RecallQ from our website (prospective customers only): the name, email address and practice details the person enters. No patient data.	Planned: USA
Upstash	Short-lived rate-limiting counters for sign-up and confirmation-email requests: a network address (kept for 60 seconds) and a keyed hash of the email address (kept for 1 hour). No patient data.	Region to be published before use

For Pro practices that turn on AI replies, the AI may answer simple questions from the practice's own FAQ (for example opening hours, address, parking, what a check-up involves, or how to book). For this, Anthropic receives the last few messages exchanged with that patient (each shortened to 500 characters, with e-mail addresses and long numbers removed), the practice's own FAQ text and booking link, and the practice name. The AI can never change bookings or opt-outs, never gives clinical advice, and hands anything clinical, urgent, or a complaint to practice staff. Every AI message is identified with the practice name and carries the STOP instruction.

After a patient replies, RecallQ may also send a short acknowledgement (for example, that the practice will call to arrange a time). These acknowledgements are fixed messages chosen by the outcome of the reply; no AI provider is involved in them. If a reply looks like an emergency, RecallQ sends a fixed safety message telling the patient to call 000 if it is an emergency and otherwise to call the practice, and flags the message for practice staff. That check is a fixed word match rather than AI, and it runs for every practice on every plan.