TLScare sub-processors
Last updated: [date of sign-off]
Contracting entity: THE INERTIA GROUP LTD (company number 12622619), trading as TLScare. Registered office: 167 Great Portland Street, London W1W 5PF.
When a care provider uses the TLScare care-management product, TLScare acts as a processor. To deliver the service we use the sub-processors below. We list what each does, what categories of data it handles and where the data is held.
A1. Sub-processors for the TLScare care-management product
| Sub-processor | Purpose | Data involved | Location | Transfer mechanism |
|---|---|---|---|---|
| Google Cloud — Cloud Run | Runs the TLScare application programming interface (API), which processes all product requests | All product data in transit through the API, including special-category health data | Deployment config targets europe-west1 (Belgium) [UNVERIFIED — confirm in console once billing is restored] | [UNVERIFIED — confirm the Google contracting entity and that the Google Cloud data-processing terms are accepted on our account] |
| Google Cloud — Firestore (via Firebase Admin SDK) | Primary database | Provider, staff, care-recipient and care-record data | [UNVERIFIED — Firestore location is fixed at database creation and is not in the code] | As above |
| Google Cloud — Cloud Storage for Firebase | File storage (uploads and generated documents) | Documents and images uploaded by providers; may include special-category data | [UNVERIFIED — bucket location not in code] | As above |
| Google Cloud — Pub/Sub | Internal message queue for notifications and timesheets | Identifiers and visit times (account, staff and client IDs, start and end times) | [UNVERIFIED] | As above |
| Google Maps Platform (Geocoding API) | Converts addresses to coordinates | Care-recipient and staff postal addresses sent as a text query | Google-operated, location not controllable by us [UNVERIFIED] | [UNVERIFIED] |
| Brevo (formerly Sendinblue) | Transactional email: sign-up links, password reset, timesheets, missed-visit and new-visit notices | Recipient email address, business name, and visit/timesheet details in the templates | [UNVERIFIED — check the Brevo account's data-hosting setting] | [UNVERIFIED] |
| Typesense | Search index for the staff and client lists | Name, email, team and permitted-staff IDs of staff and care recipients | [UNVERIFIED — host is held in encrypted deployment secrets; could be self-hosted or Typesense Cloud. Engineering to state which] | [UNVERIFIED] |
| Stripe | Subscription billing, where enabled | Provider billing contact and payment details. Card data goes to Stripe directly and does not touch TLScare | Stripe-operated [UNVERIFIED which Stripe entity applies] | [UNVERIFIED] |
| Vercel Inc. | Hosts the client dashboard front end | Session and request metadata (IP address, user agent). Dashboard pages are static assets; care data is fetched from the API, not stored by Vercel | Edge network is global; function region [UNVERIFIED] | [UNVERIFIED] |
A2. Providers used only for TLScare's own website and sales enquiries (TLScare is the controller)
| Provider | Purpose | Data involved | Location | Notes |
|---|---|---|---|---|
| Vercel Inc. | Hosts www.tlscare.com and runs its form-handling routes | Visitor IP address and form content in transit | [UNVERIFIED] | |
| Twilio SendGrid | Sends demo, quote and toolkit emails, and the internal lead notification | Name, email, company, phone, country, notes | US-headquartered; [UNVERIFIED] data location |
A3. What is not used
Based on review of the current code, TLScare does not currently use website analytics, advertising pixels, tag managers or error-tracking services, and does not load fonts from Google's servers. The Tawk.to live-chat widget was removed from www.tlscare.com in TLS-61 (PR #55) and is no longer a sub-processor of the website once that change is live. [VERIFY after TLS-61 deploys: load www.tlscare.com in a clean browser profile and confirm zero requests to
tawk.to.] If this changes, this list changes first.A4. Changes
We will give providers [30] days' written notice before adding or replacing a sub-processor that handles product data. A provider may object on reasonable data-protection grounds in that period. [OFFICER DECISION: notice period and the mechanism — email to the account's registered contact is the practical default.]
A5. International transfers
[HOLD — cannot be written until the
[UNVERIFIED] locations above are filled. The text must state for each non-UK/EEA provider which transfer mechanism applies (UK adequacy/UK-US Data Bridge participation, or the UK International Data Transfer Addendum), checked against each vendor's current terms. Do not publish "all data stays in the UK/EEA".]