Sub-processors

Last updated: 18 June 2026

This page lists the third-party providers ("sub-processors") that Haijahr Ltd engages to help provide Lysander. It supports our Data Processing Agreement and should be read alongside our Privacy Policy.

1. About This List

We keep this list current so that, as a controller, you can see exactly who may process your patients' personal data on our behalf. Each sub-processor is bound by a written contract imposing data-protection obligations no less protective than those in our DPA.

2. What Is a Sub-processor?

A sub-processor is a company we use to deliver part of the Service — for example, the provider that hosts our servers, or the service that sends transactional emails. They process personal data only on our instructions and only to the extent needed to perform their function.

3. Current Sub-processors

The following sub-processors are currently authorised:

Sub-processor	Purpose	Data processed	Location / transfer safeguard
Google Ireland Ltd (Google Fonts)	Serving the web fonts used in the Lysander interface.	IP address and browser request metadata (no patient data).	EU/UK; adequacy. See Google Privacy Policy.
[Hosting / infrastructure provider]	Hosting the application, database and backups.	All Customer Personal Data, including patient records.	[Region] — [UK / adequacy / IDTA]
[Email delivery provider]	Sending transactional emails (invitations, password resets, notifications).	Recipient name and email address; email content.	[Region] — [UK / adequacy / IDTA]
[File / object storage provider]	Storing files uploaded by patients to complete tasks.	Uploaded task files and associated metadata.	[Region] — [UK / adequacy / IDTA]

Note for Haijahr: the bracketed rows are placeholders. Replace each with the actual provider (e.g. your hosting company, and your chosen email provider — Postmark, Resend or AWS SES — and storage such as AWS S3), its processing region, and the transfer safeguard. Remove any row that does not apply, and remove this note before publishing.

4. Notification of Changes

When we intend to add or replace a sub-processor, we will update this page and update the "Last updated" date. If you have an account with us, we will give you reasonable prior notice — by email or an in-app notice — before the new sub-processor begins processing Customer Personal Data, so that you have time to object.

5. Objecting to a Sub-processor

If you have a reasonable, data-protection-based objection to a new sub-processor, contact us at privacy@haijahr.com within 30 days of the notice. We will work with you to address the concern. If we cannot, you may terminate the Service in respect of the processing that depends on that sub-processor, as set out in our Data Processing Agreement.

6. Contact

Haijahr Ltd
61 Alexandra Road, Lowestoft, Suffolk, NR32 1PL
Email: privacy@haijahr.com
Website: haijahr.com