The following sub-processors are engaged by Project Line (קו פרויקטים, Israel business No. 310333984) to provide the Intelligent Clinic Management Platform. Material changes (addition or replacement) are notified to all clinics 30 days before they take effect.
| Sub-processor | Purpose | Data hosted | Region | Safeguards |
|---|---|---|---|---|
| Microsoft Azure (Microsoft Corp.) | Cloud hosting: App Service, SQL Database, Blob Storage, Key Vault | All clinic + patient records, file attachments, backups | Israel Central by default; other Azure regions per clinic contract | UK Addendum (ICO B1.0) to the SCCs; Azure Data Protection Addendum; ISO 27001/27018 |
| OpenAI, L.L.C. | Model inference for voice agent, chat agent, image OCR | Real-time audio stream (speech-to-speech, not retained), prompts, document/card images | US; EU residency where available | UK Addendum/IDTA; OpenAI DPA; zero-retention API tier; no model training on customer data |
| Twilio Inc. | Inbound + outbound voice + SMS; phone-number provisioning | Phone numbers, call routes, SMS bodies | US; EU regions available | UK Addendum/IDTA; Twilio DPA; UK-US Data Bridge where applicable |
| Stripe Payments Europe Ltd. | Card tokenisation, charge, refund (PCI SAQ-A scope) | Tokenised payment methods, payment metadata; no PAN ever stored at processor | UK/EU/US | UK Addendum/IDTA; Stripe DPA; PCI-DSS Level 1 |
| Meta Platforms Ireland Ltd. | WhatsApp Business Cloud API messaging | Patient phone, template body, delivery status | EU/Ireland | Meta DPA; WhatsApp Business Terms; UK Addendum for UK transfers |
| Google LLC | Google Workspace OAuth — the clinic attaches its own Drive / Gmail | Only what clinic shares; OAuth tokens stored encrypted | EU/US | UK Addendum/IDTA; Google Workspace DPA. Optional; clinic opt-in. |
| Microsoft (Azure AD / Microsoft Graph) | Optional clinic OAuth — Outlook / OneDrive | Only what clinic shares; OAuth tokens stored encrypted | EU/US | Microsoft 365 DPA; UK Addendum. Optional. |
| PayPal Holdings, Inc. | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) | Tokenised payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | UK/EU/US | Optional — clinic opt-in. UK Addendum/IDTA; processor DPA; PCI-DSS Level 1. |
| Cardcom Ltd. (Israel) | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) — Israeli clinics only; not engaged for UK clinics | Tokenised payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | Israel | Optional — clinic opt-in. Not engaged for UK clinics, so no UK transfer takes place; Israel is in any event covered by the UK adequacy regulations. Israeli PCI-DSS Level 1 acquirer; the clinic signs the vendor agreement directly with the provider. |
| Tranzila Ltd. (Israel) | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) — Israeli clinics only; not engaged for UK clinics | Tokenised payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | Israel | Optional — clinic opt-in. Not engaged for UK clinics, so no UK transfer takes place; Israel is in any event covered by the UK adequacy regulations. Israeli PCI-DSS Level 1 acquirer; the clinic signs the vendor agreement directly with the provider. |
| PayPlus Ltd. (Israel) | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) — Israeli clinics only; not engaged for UK clinics | Tokenised payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | Israel | Optional — clinic opt-in. Not engaged for UK clinics, so no UK transfer takes place; Israel is in any event covered by the UK adequacy regulations. Israeli PCI-DSS Level 1 acquirer; the clinic signs the vendor agreement directly with the provider. |
| Meshulam Ltd. (Israel) | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) — Israeli clinics only; not engaged for UK clinics | Tokenised payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | Israel | Optional — clinic opt-in. Not engaged for UK clinics, so no UK transfer takes place; Israel is in any event covered by the UK adequacy regulations. Israeli PCI-DSS Level 1 acquirer; the clinic signs the vendor agreement directly with the provider. |
| GreenInvoice Ltd. (Israel) | Electronic invoice generation for the Israeli tax authority (Heshbonit Mas / חשבונית מס) — Israeli clinics only; not engaged for UK clinics | Patient name, invoice line items, total, VAT (no clinical content) | Israel | Optional — clinic opt-in. Not engaged for UK clinics, so no UK transfer takes place; Israel is in any event covered by the UK adequacy regulations. Invoicing provider, not a card acquirer; the clinic signs the vendor agreement directly with the provider. |
| iCount Ltd. (Israel) | Electronic invoice generation for the Israeli tax authority (Heshbonit Mas / חשבונית מס) — Israeli clinics only; not engaged for UK clinics | Patient name, invoice line items, total, VAT (no clinical content) | Israel | Optional — clinic opt-in. Not engaged for UK clinics, so no UK transfer takes place; Israel is in any event covered by the UK adequacy regulations. Invoicing provider, not a card acquirer; the clinic signs the vendor agreement directly with the provider. |
| Stedi, Inc. (USA) | US insurance claims clearinghouse (electronic 837P claims, 277 status, 835 remittance) — US clinics only | Claim data: patient demographics, diagnoses (ICD-10), procedures (CPT), amounts | US | Optional — clinic opt-in, US clinics only; not engaged for UK clinics. The clinic holds its own Stedi account and API key and contracts with Stedi directly; the clinic is responsible for its own HIPAA business associate agreement with Stedi. Claim data leaves the platform only when the clinic submits a claim |
| Zoho Corporation (Zoho Mail) | Transactional email delivery: notifications to patients and clinics, sign-in codes, invoices | Recipient email address, recipient name, message content | US (zoho.com data centre) | UK Addendum/IDTA; Zoho DPA. |
UK transfer mechanism. For transfers of UK personal data outside the UK, the ICO's UK Addendum (B1.0) to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement (IDTA), applies together with a Transfer Risk Assessment. Israel is covered by the UK adequacy regulations; transfers to Microsoft and Twilio may additionally rely on the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge). Israeli payment sub-processors (Cardcom, Tranzila, PayPlus, Meshulam, Green Invoice, iCount) are engaged only for clinics that choose an Israeli acquirer and are not used for UK-market clinics.
When a sub-processor is added or replaced, Project Line records the change and gives at least 30 days' notice. A single email goes out to every clinic. Clinics that object may terminate the Service Agreement before the effective date (DPA §5).
To object to a sub-processor, email support@projectlineil.com before the effective date specified in the notice.
© 2026 Project Line. All rights reserved.