Effective Date: 22 May 2026 Version: v1.0
This page mirrors clause 7.2 and Annex 2 of the Data Processing Agreement — the up-to-date list of third-party sub-processors used by Implants Local Ltd trading as Dentalreel (company number 16197776, ICO registration ZB960243) to deliver the Dentalreel platform.
By accepting the Terms of Service, Customers grant the general authorisation for sub-processor engagement set out in clause 7.1 of the DPA.
Current sub-processors
| Sub-processor | Purpose | Location of Processing |
|---|---|---|
| Amazon Web Services EMEA SARL ("AWS") | Cloud hosting and storage of application data, images, and metadata | United Kingdom (eu-west-2 region primarily) |
| Supabase (Supabase, Inc) | Application database, authentication, and storage | European Union (Ireland / Frankfurt) |
| Stripe Payments UK, Ltd | Payment processing and subscription billing | United Kingdom and European Union |
| Resend (Resend, Inc) | Transactional email delivery (magic links, lead notifications, follow-up emails to patients) | United States, with UK Standard Contractual Clauses in place |
| Google LLC (Gemini AI) | AI vision analysis for brand detection and widget configuration | United States, with UK Standard Contractual Clauses in place |
| fal.ai, Inc | AI smile-preview generation from patient photographs | United States, with UK Standard Contractual Clauses in place |
| Vercel, Inc | Application hosting and edge function execution | Global edge network with UK Standard Contractual Clauses in place |
| Upstash, Inc | Rate-limiting and quota counter storage (no Personal Data stored) | European Union (Frankfurt) |
| Cloudflare, Inc | Content delivery network, DDoS protection, and security | Global edge network with UK Standard Contractual Clauses in place |
Notice of change
We will give at least 30 days' written notice before adding or replacing a sub-processor (DPA clause 7.4). Notices go to the email address on each Customer account.
A Customer may object to a proposed change on reasonable data protection grounds within fifteen (15) days of the notice. If the objection cannot be resolved by reasonable accommodation:
(a) the Customer may terminate the Terms (without penalty) effective on the date the new sub-processor is engaged; or
(b) Dentalreel may, at its option, refrain from engaging the proposed sub-processor.
Where a sub-processor is engaged in response to an emergency security incident or to maintain service continuity, the 30-day notice may be shortened — but Dentalreel will notify the Customer as soon as reasonably practicable.
International transfers
Where a sub-processor is located outside the United Kingdom in a country not subject to a UK adequacy regulation, Dentalreel has entered into the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK IDTA where appropriate) with that sub-processor. See DPA clause 13 for the full transfer regime.
Sub-processor data protection obligations
Each sub-processor is contractually bound to data protection obligations no less protective than those Dentalreel owes its Customers under the DPA. Dentalreel remains liable to the Customer for the acts and omissions of its sub-processors as if they were its own (DPA clause 7.3).
Contact
For questions about this list or the safeguards in place for a specific sub-processor, email dpo@dentalreel.com.
Document version: v1.0 Last updated: 22 May 2026 This list is current as of the effective date above. Always check this page for the latest version.