When providing software services to you, for the patient data you enter within the platform, you are the Data Controller and we are the Data Processor.

To deliver our service, there are occasions where we use sub-contractors (known as sub-processors). Sub-processors may potentially have access to or process personal data of patients you've interacted with when using the Hero platform.

This page sets out the Sub-processors we use, for what function/s we use them, and how they help us to deliver our services.

Please note, this webpage should not be taken as a binding agreement. The information provided here is to illustrate our engagement process for sub-processors and the actual list of third party sub-processors.

We evaluate the security practices of our Sub-processors that will or may process Personal Data to ensure they have acceptable security, privacy and confidentiality practices.

Our Sub-processor contracts ensure that Sub-processors will:

From time to time we may update or add suppliers to our list of sub-processors. As per the DPA, we will give you 14 days notice for you to object to your Personal Data being processed by the proposed changes to our sub-processors list.

The list of sub-processors we engage to help us deliver services to NHS and private providers. We may process patient identifiable data through these providers:

The list of additional sub-processors we engage to help us deliver our services to only our private providers. We may process patient identifiable data through these providers:

Where Hero Doctor Limited is the Data Controller, we work with additional sub-processors. These sub-processors won't have visibility of patient identifiable data.

These sub-processors may be able to see data for which Hero Doctor is the data controller. This could include a limited set of data on Hero administrators or practitioners. Example use cases would be where we store identifiable data to manage our customer relationships or understand how our services are used. The list of processors is:
​