Article 28 UK GDPR & EU GDPR
Last Updated: July 8th, 2026
This register is the authoritative list of all sub-processors engaged by DAN to process personal data (including patient special category data) on behalf of dental practices.
It is incorporated by reference into Schedule 2 of the DAN Practice Data Processing Agreement (DPA) and into Section 3 of the DAN Records of Processing Activities (RoPA).
The current version is always available at https://dentalaudionotes.com/app/privacy.
| Field | Detail |
| Organisation | Dental Audio Notes Ltd (DAN) |
| Register owner | DAN Data Protection Officer |
| Version | 1.0 |
| Effective date | 10 June 2026 |
| Published at | https://dentalaudionotes.com/app/privacy |
| Incorporated into | DAN Practice DPA — Schedule 2 (by reference);
DAN RoPA — Section 3 (by reference) |
| Notice period for changes | 30 days' written notice to practices before adding or changing any sub-processor (Practice DPA clause 5.2) |
| Next review due | 10 June 2027 |
| Sub-Processor | Amazon Web Services (AWS) |
| Role | Cloud infrastructure and AI processing |
| Status | Active |
| Location | UK: eu-west-2 (London);
EU: eu-west-3 (Paris); |
| Service Provided | Cloud infrastructure: compute (EC2), storage (S3), AI processing (Bedrock), transactional email delivery (Simple Email Service – SES). |
| Data Processed | All patient and end user data stored and processed within DAN's AWS environment. Clinical records stored as encrypted objects in S3. End user (clinician) email addresses and transactional email content (e.g. account notifications, password resets) processed via AWS SES within the same AWS environment. |
| Safeguards | AWS GDPR DPA in place.
SOC 2 Type 2; ISO 27001 certified. Patient data does not leave DAN's VPC for Bedrock processing. AWS confirmed: no customer data used for Bedrock model training. |
| Agreement in Place | AWS Customer Agreement
AWS GDPR DPA (automatic, download and retain from AWS console at aws.amazon.com/agreement). Bedrock is invoked from DAN’s AWS environment in the United Kingdom, using an EU cross-region inference profile. Requests may be processed in eu-west-2, eu-west-3 or other EU regions. Anthropic is the model provider, accessed through AWS Bedrock. Anthropic does not receive customer data under a separate contract with DAN. |
| Sub-Processor | AssemblyAI, Inc. |
| Role | Sub-Processor Fallback |
| Status | Approved for future use. Not in use. Not enabled. |
| Location | Dublin, Ireland, once EU residency is configured and confirmed in writing. |
| Service Provided | Transcription. Sub-Processor Fallback. |
| Data Processed | Patient audio and transcripts. Special category health data. Transmitted only if enabled under DPA clause 5.4. |
| Safeguards | Business Associate Agreement (BAA) in place.
Zero Data Retention configured and enforced. EU data residency (Dublin) enabled and evidenced. Audio not used for model training. SOC 2 Type 2; ISO 27001:2022; PCI DSS v4.0 certified. |
| Agreement in Place | Signed BAA on file.,
AssemblyAI Data Processing Addendum on file. EU data residency configuration, dated screenshot on file. Model training opt-out - dated screenshot on file. SOC 2 / ISO 27001 certificates on file.
|
| Sub-Processor | OpenAI, L.L.C. |
| Role | Sub-Processor Fallback |
| Status | Not in use. Not enabled for any Controller. |
| Location | US (EU data residency selected for DAN account) |
| Service Provided | Transcription. Sub-Processor Fallback. |
| Data Processed | Patient audio and transcripts. Special category health data. Transmitted only if enabled under DPA clause 5.4. |
| Safeguards | Business Associate Agreement (BAA) in place.
Zero Data Retention (ZDR) configured on all eligible endpoints used by DAN. Audio not used for model training. SOC 2 Type 2; ISO 27001/17/18/27701 certified. |
| Agreement in Place | Signed BAA on file.
OpenAI Data Processing Addendum on file. ZDR configuration — dated screenshot retained. SOC 2 certificate on file. |
Sub-Processor Fallbacks are made available only as a last resort, where DAN cannot provide transcription through its own infrastructure. It is used for a Controller only after that Controller has confirmed in writing, by ticking the confirmation in the DAN account settings, that it wishes it enabled. The confirmation records the name of the person confirming, the date and time, the account and the version of the DPA. No Sub-Processor Fallback is enabled for any Controller at the date of this register.
Where no fallback is enabled, all transcription is performed within DAN’s own AWS infrastructure and no patient audio is sent to any third party.
Practices are responsible for informing patients through their patient privacy notice. UM0080 provides examples of suitable wording.
When DAN proposes to add, replace, or remove a sub-processor, the following process applies in accordance with clause 5.2–5.3 of the Practice DPA:
| Step | Action | Who | Timing |
| 1 | Update this register with proposed new/changed sub-processor details. | DAN DPO | Before notice is sent |
| 2 | Send Sub-Processor Change Notice to all affected practices, providing the name, location, and nature of processing of the proposed sub-processor. | DAN Legal / Operations | At least 30 days before change takes effect |
| 3 | Allow a 14-day objection window. If a practice objects in writing with reasonable grounds, DAN must work in good faith to resolve the objection. | DAN DPO / Legal | Days 1–14 after notice |
| 4 | If no objection is received within 14 days, the change is deemed accepted. Update the Practice DPA reference and this register. | DAN DPO | Day 15 after notice |
| 5 | Obtain and file all required agreements for the new sub-processor (BAA, DPA, ZDR confirmation, certifications) in the physical file (Section 4). | DAN Legal / Engineering | Before sub-processor goes live |
| 6 | Update DPIA 72, Privacy Policy, and EULA references to reflect the change. | DAN Legal / DPO | At time of change |
| 7 | Publish updated register at https://dentalaudionotes.com/app/privacy. | DAN DPO | At time of change |
DAN maintains a physical evidence file for each sub-processor — a dedicated folder in the DAN document management system, accessible to the Data Protection Officer and Legal team only. This file contains the signed agreements and evidence of compliance measures for each provider.
This register will be reviewed and updated: