The following sub-processors are engaged by Project Line (קו פרויקטים, Israel business No. 310333984) to provide the Intelligent Clinic Management Platform. Material changes (addition or replacement) are notified to all clinics 30 days before they take effect.
| Sub-processor | Purpose | Data hosted | Region | Safeguards |
|---|---|---|---|---|
| Microsoft Azure (Microsoft Corp.) | Cloud hosting: App Service, SQL Database, Blob Storage, Key Vault | All clinic + patient records, file attachments, backups | Israel Central by default; other Azure regions per clinic contract | UK Addendum (ICO B1.0) to the SCCs; Azure Data Protection Addendum; ISO 27001/27018 |
| OpenAI, L.L.C. | Model inference for voice agent, chat agent, image OCR | Real-time audio stream (speech-to-speech, not retained), prompts, document/card images | US; EU residency where available | UK Addendum/IDTA; OpenAI DPA; zero-retention API tier; no model training on customer data |
| Twilio Inc. | Inbound + outbound voice + SMS; phone-number provisioning | Phone numbers, call routes, SMS bodies | US; EU regions available | UK Addendum/IDTA; Twilio DPA; UK-US Data Bridge where applicable |
| Stripe Payments Europe Ltd. | Card tokenisation, charge, refund (PCI SAQ-A scope) | Tokenised payment methods, payment metadata; no PAN ever stored at processor | UK/EU/US | UK Addendum/IDTA; Stripe DPA; PCI-DSS Level 1 |
| Meta Platforms Ireland Ltd. | WhatsApp Business Cloud API messaging | Patient phone, template body, delivery status | EU/Ireland | Meta DPA; WhatsApp Business Terms; UK Addendum for UK transfers |
| Google LLC | Google Workspace OAuth — clinic attaches their own Drive / Gmail | Only what clinic shares; OAuth tokens stored encrypted | EU/US | UK Addendum/IDTA; Google Workspace DPA. Optional; clinic opt-in. |
| Microsoft (Azure AD / Microsoft Graph) | Optional clinic OAuth — Outlook / OneDrive | Only what clinic shares; OAuth tokens stored encrypted | EU/US | Microsoft 365 DPA; UK Addendum. Optional. |
| PayPal Holdings, Inc. | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) | Tokenised payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | UK/EU/US | Optional — clinic opt-in. UK Addendum/IDTA; processor DPA; PCI-DSS Level 1. |
UK transfer mechanism. For transfers of UK personal data outside the UK, the ICO's UK Addendum (B1.0) to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement (IDTA), applies together with a Transfer Risk Assessment. Israel is covered by the UK adequacy regulations; transfers to Microsoft and Twilio may additionally rely on the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge). Israeli payment sub-processors (Cardcom, Tranzila, PayPlus, Meshulam, Green Invoice, iCount) are engaged only for clinics that choose an Israeli acquirer and are not used for UK-market clinics.
When a sub-processor is added or replaced, Project Line creates a SubProcessorChangeRecord with at least 30-day notice. A broadcast email goes to every clinic. Clinics that object may terminate the Service Agreement before the effective date (DPA §5).
To object to a sub-processor, email support@projectlineil.com before the effective date specified in the notice.
© 2026 Project Line. All rights reserved.