We've designed this page for people who have a background in Information Governance or data protection. It's quite heavy in legal language.

If you want to read more basic information about security and privacy first, you can go here.

What is a Sub-processor

A sub-processor is a third party organisation that:

  • we depend on to help deliver the accuRx software service

  • who will potentially have access to or process personal data of accuRx users, or their patients.

accuRx engages different types of sub-processors to perform different functions in our service.

In the rest of this article, we explain our approach to assuring and engaging them generally, and then we set out the sub-processors currently used, and for what function.

Due Diligence

accuRx undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed sub-processors that will or may have access to or otherwise process Service Data.

Contractual Safeguards

accuRx generally requires its sub-processors to satisfy equivalent obligations as those required from accuRx (as a Data Processor) as set forth in accuRx's Data Processing Agreement, including but not limited to the requirements to:

  • Process Personal Data in accordance with data controller’s documented instructions (as communicated in writing to the relevant sub-processor by accuRx);

  • In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;

  • Provide regular training in security and data protection to personnel to whom they grant access to Personal Data;

  • Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which accuRx is contractually committed to adhere to insofar as they are equally relevant to the sub-processor’s processing of Personal Data on accuRx's behalf);

  • Promptly inform accuRx about any actual or potential security breach; and

  • Cooperate with accuRx in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

This page any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate accuRx's engagement process for sub-processors as well as to provide the actual list of third party sub-processors and content delivery networks used by accuRx as of the date of this policy (which accuRx may use in the delivery and support of its Services).

Process to Engage New Sub-processors:

For all Subscribers who have executed accuRx's standard DPA, accuRx will provide notice via this policy of updates to the list of sub-processors that are used to deliver its Services. accuRx undertakes to keep this list updated regularly to enable its Subscribers to stay informed of the scope of sub-processing associated with the accuRx platform. IG Leads or Data Protection Officers, or anyone else who works for an accuRx customer may subscribe to receive notifications of updates to this policy by selecting the option in this form.

accuRx also commits to updating our catalogue listing on NHS Digital's Digital Care Service Catalogue website whenever we add a new sub-processor involved in any service covered by a relevant Call Off Agreement.

Pursuant to the DPA, a customer may object in writing to the processing of its Personal Data by a new sub-processor within thirty (30) days following the update of this policy and such objection shall describe customer's legitimate reason(s) for objection. If customers do not object during such time period the new sub-processor(s) shall be deemed accepted.

Termination rights, as applicable and agreed, are set forth exclusively in the DPA.

The following table provides an up-to-date list of the names and locations of accuRx sub-processors.


Platform specific sub-processors

These sub-processors are involved in the delivery of the accuRx software platform. The tables below explain which features these are used for.

Name

Nature and purpose

Geographical Location

Applicable features

Microsoft Azure

accuRx controls access to the infrastructure that we use to store and process the data on the platform. We use Microsoft Azure's secure cloud hosting service to securely store and process patient data. The Azure regions used are exclusively located in the UK, for both live and backup environments.

UK

All of accuRx

FireText Communications Ltd.

accuRx enables users to send SMS messages to patients. We use third party gateways for the delivery of those SMS messages. They provide APIs that the accuRx server uses to send these messages.

UK

Any accuRx messaging using SMS: SMS Plus, Florey Plus, Batch and Appointment Reminders, Video

BT Ltd.

accuRx enables users to send SMS messages to patients. We use third party gateways for the delivery of those SMS messages. They provide APIs that the accuRx server uses to send these messages.

UK

Any accuRx messaging using SMS: SMS Plus, Florey Plus, Batch and Appointment Reminders, Video

NHSMail

accuRx uses secure NHS Mail accounts to send emails between healthcare professionals using the accuMail feature.

UK

accuRx messaging using email: accuRx - email patients, accuMail

Whereby Ltd.

Whereby is a secure meeting room service that accuRx uses to host video consultations between healthcare and/or social care staff and their patients.

No content of the call is recorded or retained by accuRx, Whereby or any other service.

Technical logs are created to ensure accuRx and Whereby can monitor services. They are retained to allow accuRx and Whereby to investigate any issues with the service for up to 90 days.

EEA

Video

Sendgrid Inc.

Sendgrid is an email campaign service provider used within accuRx to send automated account emails to accuRx users only. This means Sendgrid only has access to email addresses of staff who use accuRx. No patient data is processed using Sendgrid.

US

All of accuRx

Support specific sub-processors

These sub-processors are only used when accuRx provides support to users or patient. accuRx support specialists are trained to minimise the processing of personal data across these platforms, but accuRx depend on them to deliver the high standard of live support provided. From time to time and only where necessary, this may include information about patients that the user was seeking help to communicate with via accuRx.

Name

Nature and purpose

Geographical Location

Intercom UK Ltd.

Intercom provides a live chat and email communications platform that we use to speak to users who are seeking help using our products. It is available in our product or on our public-facing website. Intercom queries our user database to ensure the user is logged in and which organisation they are affiliated with.

US

ActiveCampaign

ActiveCampaign is an email campaign service provider that we use to send out mass emails to our users only to inform them of changes in the product. No patient data is processed using ActiveCampaign.

US

TeamViewer UK Ltd.

TeamViewer provides a software service that allows Support specialists to connect and remotely view accuRx users' screens to provide technical support. This is only used when the live or email conversation has not resolved the problem, and only with the permission of the accuRx user (they have to install TeamViewer themselves in order to proceed).

Before connection, the accuRx Support specialist will advise the user to hide any personally identifiable information that's not pertinent to the support query. No content of the viewing session is retained beyond the end of it.

EEA

Did this answer your question?