Our suppliers
The companies that process personal information for SQEDULE, what each receives, where it is processed and how information that leaves the UK is protected.
- Last updated 6 November 2026
- Version suppliers-2026-11-06
On this page (14 sections)
About this list
SQEDULE uses these suppliers to run its service. Most act only on SQEDULE's instructions. Stripe also has its own legal duties as a payment provider, and Companies House and the CQC are public registers SQEDULE checks clinics against. Clinics you book with receive your booking details as healthcare providers in their own right; they are not on this list. How SQEDULE uses your information is set out in the privacy notice.
Latest change: First published list.
Amazon Web Services (AWS)
- What it does
- Hosts SQEDULE: the website and API, the database, file storage for clinics' verification documents and photographs, background work and technical logs.
- What it receives
- Everything SQEDULE keeps, stored encrypted in its London data centres. AWS processes it only on our instructions.
- Where
- London (eu-west-2). Pages are delivered through AWS data centres near each visitor, whose short technical logs can be written in that region.
- Safeguard
- Stored in the UK. Delivery logs outside the UK are covered by the AWS Data Processing Addendum and its standard contractual clauses with the UK addendum.
Amazon Bedrock (AWS)
- What it does
- Runs the language model that reads the words typed into search to work out which services they mean, and reads the text of clinics' verification documents to fill in onboarding.
- What it receives
- The search words only: never your name, email, account or location. AWS does not use them to train models, and SQEDULE keeps prompt logging switched off.
- Where
- The European Union. SQEDULE calls it from Ireland through the EU cross-region profile, which may process a request in any EU region.
- Safeguard
- UK adequacy regulations for the European Economic Area.
Amazon Rekognition (AWS)
Clinic information only.
- What it does
- Checks the photographs clinics publish on their SQEDULE pages and websites for unsuitable content before they are shown.
- What it receives
- The photographs a clinic uploads for its public pages. It returns content labels only: SQEDULE never uses face search or face collections, and AWS may not use the photographs to improve its services (SQEDULE has opted out).
- Where
- London (eu-west-2).
- Safeguard
- Processed in the UK.
Amazon Location Service (AWS)
- What it does
- Finds a place name typed into Where when it is not a postcode or a place SQEDULE already knows.
- What it receives
- The place text you typed. Never your device location: "Use current location" is worked out by SQEDULE itself.
- Where
- London (eu-west-2).
- Safeguard
- Processed in the UK.
Amazon Simple Email Service (AWS)
- What it does
- Sends SQEDULE emails: booking confirmations, reminders, alerts and account notices.
- What it receives
- Your email address and the content of each email, which can name the service you booked.
- Where
- London (eu-west-2).
- Safeguard
- Processed in the UK.
Amazon Cognito (AWS)
- What it does
- Handles sign-in: stores each account's email address and password (as a one-way hash) and clinic staff's authenticator set-up.
- What it receives
- Your email address, password and sign-in events.
- Where
- London (eu-west-2).
- Safeguard
- Processed in the UK.
Stripe
- What it does
- Takes card payments for clinics, holds each clinic's payout account and collects SQEDULE's invoices to clinics.
- What it receives
- Card details, entered directly with Stripe and never seen by SQEDULE; the amount and booking reference; your name, email and the service booked if a payment is disputed; clinic business and owner details for payouts.
- Where
- The United States, the European Union and the UK.
- Safeguard
- The UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), and Stripe's standard contractual clauses with the UK addendum.
Google Analytics (Google)
Only for visitors who accept analytics cookies.
- What it does
- Measures how selected public SQEDULE pages are used.
- What it receives
- Only if you accept analytics cookies: the type of page, your browser and device type and an approximate location from your network address. Never search words, account details or pages about your bookings.
- Where
- The United States.
- Safeguard
- The UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge).
Have I Been Pwned: Pwned Passwords
- What it does
- Checks whether a new password has appeared in a known data breach.
- What it receives
- The first five characters of a one-way code made from the password. Never the password, your email or your name.
- Where
- Cloudflare's global network.
- Safeguard
- Nothing that identifies anyone is sent.
Companies House
Clinic information only.
- What it does
- Confirms a clinic's company when it applies to join.
- What it receives
- The clinic's company number or name. No patient information.
- Where
- The UK.
- Safeguard
- Processed in the UK.
Care Quality Commission (CQC)
Clinic information only.
- What it does
- Confirms a clinic's CQC registration when it applies to join, once SQEDULE switches on live CQC lookups. Until then nothing is sent to the CQC.
- What it receives
- The clinic's name or CQC location and provider details. No patient information.
- Where
- The UK.
- Safeguard
- Processed in the UK.
Google Fonts (through SQEDULE)
- What it does
- Supplies the typefaces a clinic chooses for its SQEDULE website.
- What it receives
- Nothing about visitors. SQEDULE's own server fetches the fonts and serves them from SQEDULE's address, so your browser never contacts Google for them.
- Where
- Google, worldwide.
- Safeguard
- No personal information is sent.
Changes to this list
Each version of this list has an identifier, shown at the top of this page. Clinic owners can ask to be emailed when it changes. Anyone can ask about a supplier through the contact form.