Legal

Sub-processors

The third parties we rely on to run Leafnotes, what each one is used for, and where your data is processed. This page is the authoritative version of Annex III to our Data Processing Agreement.

Last updated 17 August 2026

Leaf AI Ltd processes personal data in Leafnotes as a processor, on behalf of our customers, who are the controllers of the records they keep. A sub-processor is a company we engage to carry out part of that processing. Every one below is bound by a written contract with data protection terms no less protective than those in our own agreement with you, and we remain responsible to you for what they do.

Care records, including the AI features that summarise and transcribe them, are hosted and processed in the United Kingdom. Personal data is never used to train generative AI models.

Swipe sideways to see every column →

Sub-processor
Purpose
Personal data processed
Location
Transfer mechanism
Microsoft Azure
Cloud hosting — application, database, file and audio storage, queues, backups, logging and identity
All categories of personal data held in Leafnotes
United Kingdom (UK South)
Microsoft Data Protection Addendum, incorporating the UK Addendum to the EU SCCs
Microsoft Azure OpenAI Service
AI features — summaries, drafting, insights and questions about a person's record
Care record content submitted to the model, including health data
United Kingdom (UK South)
As above. Inputs and outputs are not used to train Microsoft's or OpenAI's models, and are not shared with OpenAI
Microsoft Azure AI Speech
Transcription of dictated case notes
Voice recordings and the resulting transcripts, including health data
United Kingdom (UK South)
As above
Microsoft Azure Communication Services
Transactional and notification email
Recipient name and email address, and the content of the notification
United Kingdom
As above
Microsoft 365 / Teams
Internal operational and incident alerting to Leaf staff
Operational alerts, which may contain the names of people supported and of care staff
United Kingdom
As above
Twilio
SMS delivery of login codes and notifications
Mobile telephone number and message content
Ireland and United States
Twilio Data Protection Addendum, incorporating the EU SCCs and the UK Addendum
Sentry (Functional Software, Inc.)
Application error and performance monitoring
Technical diagnostic data. Configured to exclude personal data; users appear as identifiers only
European Union (Germany)
Sentry Data Processing Addendum, incorporating the EU SCCs and the UK Addendum
Microsoft Azure Static Web Apps
Delivery of the Leafnotes web dashboard
No personal data at rest — connection metadata only
European Union (West Europe)
As Microsoft above

When this list changes

We give customers at least 14 days' notice before a new sub-processor is given access to personal data. We update this page and email the data protection contact you have given us. If you object on reasonable data protection grounds, tell us within 7 days and we will work through it with you.

Questions or objections

Write to us at privacy@lolabyleaf.com. If you need a copy of our Data Processing Agreement, our security documentation, or details of a specific sub-processor's safeguards, ask and we will send them.