Sub-processor List
Version v1.2 — 19 April 2026
This page lists the key third-party sub-processors used by Lumina Care Therapy (Company No. 16797732) to deliver Platform services. All sub-processors are bound by written data processing agreements consistent with UK GDPR Article 28 requirements. This list is updated when sub-processors are added, removed, or changed — therapists and enterprise clients are given at least 30 days' prior notice of material changes in accordance with our Data Processing Agreement.
Current Sub-processors
| Sub-processor | Purpose | Data categories processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing and therapist payouts | Financial transaction data, identity data, bank account details | United States / EU | SCCs + UK Addendum (IDTA); TRA completed |
| MongoDB, Inc. | Primary database hosting | All platform data including account, session, clinical, and health data | EU (AWS Frankfurt) | Data stored in EU — no UK international transfer. SCCs in place for incidental US entity access |
| Daily.co (Daily.co, Inc.) | Encrypted video conferencing for therapy sessions | Video/audio data during sessions (ephemeral; not stored by Daily.co by default), IP address, session metadata | United States | SCCs + UK Addendum (IDTA); TRA completed |
| Resend | Transactional email delivery (account notifications, booking confirmations) | Email address, name, email content | United States | SCCs + UK Addendum (IDTA); TRA completed |
| OpenAI, Inc. | AI language model processing for Lumi AI and AI Note Assist session summaries | Lumi conversation inputs (general wellbeing text); and where AI Note Assist is active and the patient has consented, session transcript content used to generate draft clinical note summaries for therapist review. No raw audio is sent to OpenAI. Therapists review all AI-generated content before saving to the clinical record. | United States | SCCs + UK Addendum (IDTA); OpenAI Data Processing Addendum in place; TRA completed. Data not used for model training under our agreement |
| Deepgram, Inc. | Real-time speech-to-text transcription for AI Note Assist (therapist sessions only, with patient consent) | Real-time audio stream during therapy sessions where AI Note Assist is active and patient has consented. Audio is processed ephemerally — Deepgram does not store session audio. Speaker-labelled transcript turns are held in memory only and cleared at session end | United States | SCCs + UK Addendum (IDTA); TRA completed. Deepgram Data Processing Agreement in place. Audio not retained by Deepgram after processing under our agreement. See deepgram.com/privacy |
| Emergent Agent | Cloud hosting and infrastructure | All platform data as hosted by the underlying infrastructure | EU | Data stored in EU — no UK international transfer |
International Transfer Safeguards
Where personal data is transferred outside the UK, Lumina relies on the following safeguards in accordance with UK GDPR Articles 44–49:
- Standard Contractual Clauses (SCCs) as approved by the European Commission, with the UK Addendum (International Data Transfer Agreement — IDTA) as issued by the ICO under Section 119A of the Data Protection Act 2018
- Transfer Risk Assessments (TRAs) conducted for each US-based sub-processor in accordance with ICO International Transfer Guidance (2022), assessing the legal framework and practical risks of transfer to each destination country
Copies of our Transfer Risk Assessment summaries are available to therapists and enterprise clients upon written request.
Updates to This List
We update this page whenever sub-processors are added, removed, or materially changed. Therapists and enterprise clients subject to our DPA are given at least 30 days' prior written notice of any changes to sub-processors handling clinical data, and have the right to object in accordance with our Data Processing Agreement.
If you have questions about our sub-processors or international transfers, please contact privacy@luminacaretherapy.co.uk.
Lumina Care Therapy
Company No. 16797732
Office 132, Unit 5, 399-405 Oxford Street, Mayfair, London, W1C 2BU, United Kingdom