Start free trial

Sub-processors

Last updated 31 October 2026 · Version 2026-10-31

The companies Hizmedia Ltd uses to run Drawn that handle personal data, what each one does, and where. Nobody else receives your clinic's or your patients' data from us, except where the law requires it.

Our sub-processors

  • Vercel Inc.

    What they do
    Hosting. Runs Drawn's pages, server code and nightly jobs.
    Personal data they handle
    Everything passing through Drawn while it's in use, and server logs that include IP addresses.
    Where
    London, United Kingdom. Vercel is a US company.

  • Neon, Inc.

    What they do
    The database.
    Personal data they handle
    Every record in Drawn: clinic accounts, staff, patients, bookings, consents and the audit log. Report files are stored separately.
    Where
    London, United Kingdom (on Amazon Web Services). Neon is a US company.

  • Amazon Web Services EMEA SARL

    What they do
    File storage (Amazon S3), and a record of every access to those files (CloudTrail).
    Personal data they handle
    Test report PDFs that clinics upload, clinic logos, and logs of who opened, added or deleted each file.
    Where
    Stockholm, Sweden.

  • Resend

    What they do
    Sending emails.
    Personal data they handle
    Names, email addresses and email content: booking confirmations, reminders, results-ready notices, sign-in codes and invoices.
    Where
    Ireland. Resend is a US company.

  • Stripe

    What they do
    Payments. Drawn's own subscription billing and, for clinics that turn it on, patients paying when they book.
    Personal data they handle
    Billing contact details for clinics. For patient payments: the patient's email address, the booking reference and the amount. Never test names.
    Where
    Ireland and the United States.

Each one is bound by a written data protection agreement with us, with duties at least as strict as ours to you.

Data outside the UK

Drawn's pages, server code and database run in London. Report files are stored in Sweden and emails are sent from Ireland, both of which UK law treats as giving adequate protection.

Some of these companies are based in the United States, or may handle data there. For those transfers we rely on the UK Extension to the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the UK's International Data Transfer Addendum to the EU standard contractual clauses.

Changes to this list

Before we add or replace a sub-processor that handles your patients' data, we update this page and email your clinic's admins at least 30 days in advance. If you object on reasonable data protection grounds, tell us at director@hizmedia.com. If we can't resolve it, you may end your subscription and we'll refund any period you've paid for and won't use.

This list forms part of our data processing agreement (version 2026-10-31).

Questions about this document? Email director@hizmedia.com. Drawn is a product of Hizmedia Ltd.