Last updated: 10 August 2026
This page lists the sub-processors engaged by Charac Limited (“Charac”) to assist us in providing our platforms and associated services, including Charac, Pro Delivery Manager (PDM) and MHH. Charac remains responsible to its customers for the acts and omissions of its sub-processors in the same way as for its own acts and omissions.
The “Applies to” column indicates which of our platforms each sub-processor supports.
This list is incorporated by reference into Part D (Data Processing Addendum) of Charac’s Terms and Conditions, available at Charac Terms and Conditions.
How we add or change sub-processors
Charac may engage new sub-processors or change existing sub-processors from time to time. We will update this page at least 30 calendar days before any new sub-processor begins processing personal data. If you would like to be notified by email of changes, please subscribe by contacting dataprotectiondesk@charac.co.uk.
If you object to a change in our sub-processors, please contact us at the same email address within 30 days of the change being published (i.e. before it takes effect). We will work with you in good faith to resolve any objection, including, where reasonable, by offering an alternative configuration.
Categories of sub-processors
The sub-processors below are listed by category. The processing carried out by each is limited to the purposes described.
Infrastructure and security
| Sub-processor | Service | Location of processing | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud infrastructure hosting (compute, storage, database) and transactional email (Amazon SES) | United Kingdom (eu-west-2 region) | Not applicable — UK based | Charac, PDM |
| Microsoft Ireland Operations Limited (Microsoft Azure) | Cloud infrastructure hosting (compute, storage, database) | United Kingdom (UK South region) | Not applicable — UK based | PDM |
| Cloudflare, Inc. | Content delivery network, DDoS protection, web application firewall | United Kingdom, with global edge network | UK International Data Transfer Agreement (UK IDTA) for any data routed outside the UK | Charac, PDM |
Payment processing
| Sub-processor | Service | Location of processing | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Ryft Pay UK Limited | Payment processing for Patient transactions (primary payment processor) | United Kingdom | Not applicable — UK based | Charac |
| Stripe Payments UK, Ltd. | Payment processing for Patient transactions (being phased out in favour of Ryft Pay) | United Kingdom (with onward transfer to Stripe, Inc. in the United States) | UK IDTA / UK Addendum to the EU Standard Contractual Clauses | Charac |
| Mollie B.V. | Payment processing for Patient transactions, including contactless card payment at the door (PDM) | Netherlands (European Economic Area) | UK adequacy decision for transfers to the EEA | Charac, PDM |
| GoCardless Ltd | Bank-to-bank / Direct Debit collection for customer transactions and subscription billing | United Kingdom | Not applicable — UK based | PDM |
Patient notifications (where opted in)
| Sub-processor | Service | Location of processing | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Twilio Inc. (SendGrid) | Email notifications to patients (delivery updates) — PDM v2/v3/v4 | United States | UK IDTA / UK Addendum to the EU Standard Contractual Clauses | PDM |
| ClickSend Pty Ltd | SMS notifications to patients (delivery updates), where the default gateway is used | Australia | UK IDTA | PDM |
Address and mapping
| Sub-processor | Service | Location of processing | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Google LLC (Google Maps Platform) | Address geocoding for delivery routing (converts a delivery address to map coordinates) | United States | UK IDTA / UK Extension to the EU–US Data Privacy Framework | PDM |
Communications and customer support
| Sub-processor | Service | Location of processing | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Google Ireland Limited | Email infrastructure (Gmail / Google Workspace) and analytics | Ireland (European Economic Area) | UK adequacy decision for transfers to the EEA | Charac |
| monday.com Ltd | Project and account management, helpdesk and customer support, and secure communications between Charac and its customers | Israel | UK adequacy decision for transfers to Israel | Charac, PDM, MHH |
Delivery (where opted in)
| Sub-processor | Service | Location of processing | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Royal Mail Group Limited | Delivery of medicines and goods | United Kingdom | Not applicable — UK based | Charac, MHH |
Internal business operations (customer business data only — not Patient data)
| Sub-processor | Service | Location of processing | Transfer mechanism | Applies to |
|---|---|---|---|---|
| Chargebee, Inc. | Subscription billing administration (for customer billing — does not process Patient data) | United States (with EU regional option) | UK IDTA | Charac |
| Xero Limited | Financial accounting (for customer invoicing — does not process Patient data) | United Kingdom and New Zealand | UK adequacy decision for New Zealand | Charac |
Notes
- A sub-processor’s “transfer mechanism” describes the legal basis under the UK GDPR for any transfer of personal data outside the United Kingdom. Where the recipient country has a UK adequacy decision, no additional safeguard is required. Where it does not, an appropriate safeguard such as the UK IDTA or UK Addendum to the EU Standard Contractual Clauses is in place.
- Where a customer connects its own communications provider (for example, a pharmacy using its own SMS account), that provider acts as the customer’s processor under the customer’s own agreement, not as a Charac sub-processor, and is therefore not listed here.
- This list does not include Charac’s own internal tools that are self-hosted on Charac’s own cloud infrastructure (for example, our internal analytics and operational dashboards). Those tools do not constitute sub-processors as the underlying software vendor does not have access to the personal data.
- This list is reviewed periodically and may change. The current version is always available at Charac Sub Processors.
For questions, please contact: dataprotectiondesk@charac.co.uk