Effective Date: 16 June 2026 (last updated 6 August 2026) Version: v1.4
This page mirrors clause 7.2 and Annex 2 of the Data Processing Agreement — the up-to-date list of third-party sub-processors used by Implants Local Ltd trading as Dentalreel (company number 16197776, ICO registration ZB960243) to deliver the Dentalreel platform.
By accepting the Terms of Service, Customers grant the general authorisation for sub-processor engagement set out in clause 7.1 of the DPA.
Current sub-processors
| Sub-processor | Purpose | Location of Processing |
|---|---|---|
| Amazon Web Services EMEA SARL ("AWS") | Cloud hosting and storage of application data, images, and metadata | United Kingdom (eu-west-2 region primarily) |
| Supabase (Supabase, Inc) | Application database, authentication, and storage | European Union (Ireland / Frankfurt) |
| Stripe Payments UK, Ltd | Payment processing and subscription billing | United Kingdom and European Union |
| Resend (Resend, Inc) | Transactional email delivery (magic links, lead notifications, follow-up emails to patients) | United States, with UK Standard Contractual Clauses in place |
| Google LLC (Gemini AI) | AI vision analysis for brand detection and widget configuration | United States, with UK Standard Contractual Clauses in place |
| Google Cloud Platform (Google LLC) — Vertex AI | AI smile-simulation image generation from patient photographs (Gemini) and video generation from the patient's AI-rendered image (Veo) | United States (us-central1 region), with UK Standard Contractual Clauses in place |
| Vercel, Inc | Application hosting and edge function execution | Global edge network with UK Standard Contractual Clauses in place |
| Upstash, Inc | Rate-limiting and quota counters (hashed identifiers only), plus short-lived delivery state: when a patient asks for their simulation video by email before it has finished rendering, the email address is held for up to 55 minutes and auto-expires | European Union (Frankfurt) |
| Cloudflare, Inc | Content delivery network, DDoS protection, and security; Turnstile bot-protection on the smile simulator (processes visitor IP, browser/device signals and the site identifier solely to distinguish humans from bots — see Cloudflare's Turnstile Privacy Addendum) | Global edge network with UK Standard Contractual Clauses in place |
| Telegram Messenger Inc | Short-lived operations notification for the dentalreel.com smile-simulator demo (/try) only: the demo visitor's before/after preview and form details are posted to a private operations channel and auto-deleted within ~60–120 minutes. Never used for patient data from practice widgets. | United Arab Emirates / distributed — consent-based transfer (UK GDPR Art 49(1)(a)) recorded at the demo form |
Notice of change
We will give at least 30 days' written notice before adding or replacing a sub-processor (DPA clause 7.4). Notices go to the email address on each Customer account.
A Customer may object to a proposed change on reasonable data protection grounds within fifteen (15) days of the notice. If the objection cannot be resolved by reasonable accommodation:
(a) the Customer may terminate the Terms (without penalty) effective on the date the new sub-processor is engaged; or
(b) Dentalreel may, at its option, refrain from engaging the proposed sub-processor.
Where a sub-processor is engaged in response to an emergency security incident or to maintain service continuity, the 30-day notice may be shortened — but Dentalreel will notify the Customer as soon as reasonably practicable.
International transfers
Where a sub-processor is located outside the United Kingdom in a country not subject to a UK adequacy regulation, Dentalreel has entered into the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK IDTA where appropriate) with that sub-processor. See DPA clause 13 for the full transfer regime.
Sub-processor data protection obligations
Each sub-processor is contractually bound to data protection obligations no less protective than those Dentalreel owes its Customers under the DPA. Dentalreel remains liable to the Customer for the acts and omissions of its sub-processors as if they were its own (DPA clause 7.3).
Contact
For questions about this list or the safeguards in place for a specific sub-processor, email dpo@dentalreel.com.
Document version: v1.4 Last updated: 6 August 2026 v1.4: Meta Platforms removed — the server-side Conversions API send from the enquiry flow was removed from the product on 6 August 2026, and the consent-gated pixel on Dentalreel's own marketing pages is Dentalreel acting as controller of its own site, not a sub-processor of Customer patient data. No advertising platform appears on this list. (DPA Annex 2 mirror to be updated under director signature.) This list is current as of the effective date above. Always check this page for the latest version.