Effective Date: 16 June 2026 (last updated 11 September 2026) Version: v1.5
This page mirrors clause 7.2 and Annex 2 of the Data Processing Agreement — the up-to-date list of third-party sub-processors used by Implants Local Ltd trading as Dentalreel (company number 16197776, ICO registration ZB960243) to deliver the Dentalreel platform.
By accepting the Terms of Service, Customers grant the general authorisation for sub-processor engagement set out in clause 7.1 of the DPA.
Current sub-processors
| Sub-processor | Purpose | Location of Processing |
|---|---|---|
| Amazon Web Services EMEA SARL ("AWS") | Storage of patient photographs, face-landmark files and rendered outputs (S3); enquiry intake and rendering (Lambda); the patient's name, contact details and notes (DynamoDB); enquiry and simulation emails for practices in HIPAA mode (SES) | United Kingdom (London, eu-west-2); SES in Ireland (eu-west-1) |
| Supabase (Supabase, Inc) | Application database, authentication, and storage: practice accounts, job metadata and the enquiry record (for practices in HIPAA mode, without the patient's name, contact details or notes) | European Union (Ireland) |
| Stripe Payments UK, Ltd | Payment processing and subscription billing. No patient data. | United Kingdom and European Union |
| Resend (Resend, Inc) | Transactional email delivery: account emails (such as sign-in links); the enquiry notification to the practice (the patient's name, contact details and a crop of the mouth area cut from the patient's photograph); the patient's own simulation link when they ask for it | United States, with UK Standard Contractual Clauses in place |
| Google LLC (Google Workspace) | Dentalreel's team mailboxes. A copy of every enquiry notification email (the same content the practice receives) goes to Dentalreel's operator mailboxes. For practices in HIPAA mode, that copy goes only to mailboxes covered by our Google Workspace Business Associate Agreement. | Google's global infrastructure, with UK Standard Contractual Clauses in place |
| Google LLC (Gemini AI) | AI vision analysis of a screenshot of the practice's public website, to detect branding for widget configuration. No patient data. | United States, with UK Standard Contractual Clauses in place |
| Google Cloud Platform (Google LLC) — Vertex AI | AI smile simulation: a face-centred crop of the patient's photograph, for the simulated image (Gemini); the simulated image, not the photograph, for the video (Veo). For practices in HIPAA mode, only the models covered by our Google Cloud Business Associate Agreement are used. | Video: United States (us-central1). Image: Vertex AI's global endpoint, which serves the request from a Google Cloud region Google selects. UK Standard Contractual Clauses in place |
| Vercel, Inc | Application hosting, serverless functions and rendering orchestration | Functions in the European Union (Dublin, Ireland); static content and request routing on a global edge network. UK Standard Contractual Clauses in place |
| Upstash, Inc | Rate-limiting and quota counters (hashed identifiers only), plus short-lived delivery state: when a patient asks for their simulation video by email before it has finished rendering, the email address is held for up to 55 minutes and auto-expires | European Union (Frankfurt) |
| Cloudflare, Inc | Content delivery network, DDoS protection, and security; Turnstile bot-protection on the smile simulator (processes visitor IP, browser/device signals and the site identifier solely to distinguish humans from bots — see Cloudflare's Turnstile Privacy Addendum) | Global edge network with UK Standard Contractual Clauses in place |
| Functional Software, Inc (Sentry) | Error monitoring: server-side error reports from the platform, and browser error reports from signed-in operator screens (practice dashboard, agency console, admin, onboarding). Not loaded on public pages or inside the widget. Reports pass through a filter that removes email addresses, phone-number-like digit strings and signed links before they are sent. | European Union (Germany — Sentry's EU data region) |
| Telegram Messenger Inc | Operations alerts to Dentalreel's team. Alerts about practice accounts and simulator jobs carry the practice name and a job identifier, not a patient's name, contact details or images. For the dentalreel.com smile-simulator demo (/try) only, the demo visitor's before/after preview and form details are posted to a private operations channel and auto-deleted within ~60–120 minutes. | United Arab Emirates / distributed. The /try demo transfer relies on explicit consent (UK GDPR Art 49(1)(a)) recorded at the demo form |
Notice of change
We will give at least 30 days' written notice before adding or replacing a sub-processor (DPA clause 7.4). Notices go to the email address on each Customer account.
A Customer may object to a proposed change on reasonable data protection grounds within fifteen (15) days of the notice. If the objection cannot be resolved by reasonable accommodation:
(a) the Customer may terminate the Terms (without penalty) effective on the date the new sub-processor is engaged; or
(b) Dentalreel may, at its option, refrain from engaging the proposed sub-processor.
Where a sub-processor is engaged in response to an emergency security incident or to maintain service continuity, the 30-day notice may be shortened — but Dentalreel will notify the Customer as soon as reasonably practicable.
International transfers
Where a sub-processor is located outside the United Kingdom in a country not subject to a UK adequacy regulation, Dentalreel has entered into the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK IDTA where appropriate) with that sub-processor. See DPA clause 13 for the full transfer regime.
Sub-processor data protection obligations
Each sub-processor is contractually bound to data protection obligations no less protective than those Dentalreel owes its Customers under the DPA. Dentalreel remains liable to the Customer for the acts and omissions of its sub-processors as if they were its own (DPA clause 7.3).
Contact
For questions about this list or the safeguards in place for a specific sub-processor, email dpo@dentalreel.com.
Document version: v1.5 Last updated: 11 September 2026 v1.5 (11 September 2026): Google Workspace (operator copies of enquiry emails) and Sentry (error monitoring) added; Telegram's entry now covers its operations alerts as well as the /try demo; AWS, Supabase, Resend, Vertex AI, Vercel and Gemini entries now describe what each one processes and where. No analytics or advertising tag runs on any dentalreel.com page (since 10 September 2026), and no advertising platform appears on this list. Clause 7.2 of the DPA lists the same providers. v1.4 (6 August 2026): Meta Platforms removed — the server-side Conversions API send from the enquiry flow was removed from the product on 6 August 2026. This list is current as of the effective date above. Always check this page for the latest version.