SendScript India — Third-Party Sub-processors Register
Data Residency & Processing Architecture
All Indian patient and customer data is hosted and processed locally within India in the AWS Mumbai region (ap-south-1) and Azure Central India (Pune) for search indexing.
Domain Name System (DNS) is managed natively in AWS Route 53 and web delivery is handled by AWS Application Load Balancer and AWS CloudFront. System and application logs are monitored in Amazon CloudWatch within the Mumbai region. Online payments are processed exclusively through Razorpay (UPI, Netbanking, cards). Video consultations are conducted via Zoom Video Communications. Neither Stripe nor Onfido are used for the India platform.
All sub-processors operate under formal Data Processing Agreements (DPAs) in compliance with the Digital Personal Data Protection Act (DPDPA) and healthcare data security standards.
Sub-processors that Process Indian Patient and Special Category Health Data
| Sub-processor / Product | Legal Entity | Jurisdiction / Data Location | Data Processed | Purpose of Processing |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Amazon Web Services India Pvt Ltd / AWS EMEA SARL | India (Mumbai ap-south-1) | All customer and patient data input into SendScript India including medical records, prescriptions, consultation notes, user credentials, encrypted database backups, and system audit logs (CloudWatch). | Core cloud hosting, container compute (ECS Fargate), relational database (RDS PostgreSQL), encrypted storage (S3), DNS routing (Route 53), CDN (CloudFront), log management (Amazon CloudWatch), and audit trail (AWS CloudTrail). |
| Elastic Cloud | Elasticsearch B.V. (Netherlands / Ireland) | India (Azure Pune centralindia) | Search index data, patient and clinical query records, radiology report index, and audit search metadata. | Application indexing and high-performance search engine for medical records, clinical registries, and radiology reporting. |
| Razorpay | Razorpay Software Private Limited (India) | India | Patient/clinic billing name, contact details, payment amounts, UPI IDs, and transaction metadata. Card numbers are processed directly by Razorpay and never stored by SendScript. | Payment acquiring, UPI, Netbanking, and card processing for Indian consultations, clinic appointments, and prescriptions. (Exclusively used for India). |
| Amazon SES (Simple Email Service) | Amazon Web Services EMEA SARL | United Kingdom (London eu-west-2 relay) | Recipient email addresses, patient and clinician names, appointment reminder text, and prescription download links. | Transactional email delivery for consultation confirmations, prescription ready notices, and account alerts. |
| Twilio | Twilio Ireland Limited / Twilio, Inc. (USA) | Global (under DPA) | Mobile telephone numbers, verification codes (MFA / OTP), and automated SMS notification text. | SMS transmission for patient appointment reminders, prescription dispense alerts, and two-factor authentication OTPs. |
| Zoom Video Communications | Zoom Video Communications, Inc. (USA) | Global (transient audio/video media routing to nearest geographic edge) | Clinician and patient names, live audio/video streams (transient/real-time), meeting timestamps, and technical call telemetry. Video streams are not stored permanently. | Telehealth consultations and secure video appointments between clinicians and patients. |
| Stream (GetStream.io) | Stream.io Inc. (USA / Netherlands) | Global (under DPA) | In-consultation secure chat messages, timestamps, clinician/patient display names, and clinical attachments shared during active care sessions. | Secure real-time messaging and in-consultation clinical communication between patients and care teams. |
| Google Firebase | Google Ireland Limited / Google LLC | Global (under DPA) | Mobile device push notification tokens, notification titles, and mobile app instance IDs. | Mobile application push notifications for prescription status updates and urgent appointment alerts. |
| Google Maps API | Google Ireland Limited / Google LLC | Global | User-entered address query strings for autocomplete, clinic and pharmacy geographic coordinates. | Address autocomplete and geographical mapping of dispensing pharmacies and clinic locations. |
Sub-processors that Process Operational, Design, and Technical Data (Not Patient Data)
| Sub-processor / Product | Legal Entity | Jurisdiction / Data Location | Data Processed | Purpose of Processing |
|---|---|---|---|---|
| Microsoft (Office 365 / Entra ID) | Microsoft Ireland Operations Limited | United Kingdom and EU | SendScript staff corporate email addresses, authentication credentials, and internal administrative communications. | Internal team communication, single sign-on (SSO), workforce access controls, and office productivity suite. |
| GitHub | GitHub, Inc. (USA) | USA and Global | Software source code, Terraform infrastructure definitions, automated build scripts, and developer account identifiers. No patient records stored. | Source code version control, software release tracking, and continuous integration pipeline definitions. |
| Figma | Figma, Inc. (USA) | USA and Global | Application UI wireframes, prototypes, design tokens, user flow specifications, and designer/developer work emails. No patient records. | Product design, user experience wireframing, interface component libraries, and collaborative design reviews. |
| Postman | Postman, Inc. (USA) | USA and Global | API endpoint definitions, schemas, mock request templates with synthetic test data, and engineering account details. No live patient records. | API design, endpoint documentation, integration testing, and automated backend test collection execution. |