Third-party data processors that help us deliver Pharmacy HQ.
This is the authoritative list. Where the Terms of Service or Privacy Policy reference sub-processors generally, they defer to this page. We update this page whenever a sub-processor is added, removed, or changes its role.
Pharmacy HQ is operated by Pharmacy HQ Pty Ltd (ACN 698 203 164 · ABN 86 698 203 164), with registered office C/- Perrier Ryan Business Advisors, Level 1, 30 Lisburn Street, East Brisbane QLD 4169 (hello@pharmacyhq.com.au). To deliver the service we rely on the third-party data processors listed below. Each provides a specific infrastructure or processing capability that Pharmacy HQ itself does not run in-house.
These process data for every Pharmacy HQ pharmacy.
| Provider | Role | Purpose / data handled |
|---|---|---|
| Google Cloud (Firebase) Australia (Sydney) · United States |
Hosting, authentication, database, file storage, Cloud Functions, scheduled jobs, backups | All operational data (tasks, patients, deliveries, orders, staff records, audit logs). Live data sits in Cloud Firestore in Sydney (australia-southeast1), where our Cloud Functions also run; file uploads (slips, certificates, photos) sit in Firebase Storage in Sydney, and database backups are kept in Sydney. A limited set of records is still in the Firebase Realtime Database in the United States while it is moved to Sydney (listed in Section 5 of the Privacy Policy). Firebase Authentication, a Google global service, handles staff sign-in and two-step verification. |
| Stripe, Inc. United States · global presence |
Subscription billing + payment processing | Customer billing email, payment method, subscription state, invoice history. Stripe is the source of truth for which tier each pharmacy is on; we mirror only the non-sensitive subscription state into Pharmacy HQ. |
| Resend United States, with emails sent from Japan (Tokyo) |
Transactional email delivery | Welcome emails, password resets, invitation emails, claim-nag reminders. Domain pharmacyhq.com.au is verified in Resend. |
| Cloudflare, Inc. United States · global edge |
DNS, Email Routing, Workers | DNS hosting for pharmacyhq.com.au. Email Routing receives inbound automated reports (fridge temperature logs from Clever Logger, dead-stock wholesaler emails). The Worker parses these and forwards to our Cloud Functions for ingestion. |
| Anthropic PBC United States |
AI assistant (Claude API) | AI model for the AI features in Section 4a of the Privacy Policy: Help Chat, Policy Chat, Workflow Chat, AI Scribe, incident auto-tagging, the QSPP writing tools, invoice reading and reading emailed scripts. PreCheck does not use this service. Prompts and contextual data are sent on each request; Anthropic does not store or use these for model training under its commercial terms. The pharmacy's Owner can turn AI features off in Pharmacy settings → AI features. |
| Mobile Message (ABN 56 669 495 916) Australia (Sydney) · OpenAI, United States, for its scam check |
SMS sending and receiving (main provider) | Outbound SMS to patients (delivery and collection notifications, holiday-hours cohort SMS) and to staff (sick-call alerts, which name the staff member and the shift and never include the reason), and inbound SMS replies (automatic STOP handling, manual replies). Each SMS includes the recipient phone number and the message body. To prevent scams, Mobile Message has some outgoing message content checked by OpenAI in the United States, used only for that check and never to train AI models. Mobile Message keeps message records for the life of our account and deletes them on request, except where the law requires it to keep them; deleted records leave its backups within about six months. |
| Twilio Inc. United States |
SMS sending and receiving (backup provider, also used for replies in text conversations that began on it) | Outbound SMS to patients (delivery and collection notifications, holiday-hours cohort SMS) and to staff (sick-call alerts, which name the staff member and the shift and never include the reason), and inbound SMS replies (automatic STOP handling, manual replies). If our main provider refuses a text or is unavailable, that text is sent through Twilio instead. Each SMS includes the recipient phone number and the message body in the Twilio request. Twilio processes and stores each message in the United States. |
These process data only when a pharmacy explicitly enables the relevant integration. If your pharmacy hasn't enabled the integration, none of your data flows to that provider.
| Provider | Trigger | Purpose / data handled |
|---|---|---|
| Pharmacy Programs Administrator (PPA) Per-claim Australia |
8CPA claim submission | When you submit a MedsCheck, NIPVIP, CVCP, DAA, or Staged Supply claim via Pharmacy HQ, patient identifiers (name, DOB, Medicare/DVA), vaccine batch/lot data, and the service particulars are sent to PPA under your existing Service Provider Agreement. Pharmacy HQ is a technical conduit; the data relationship is between you and PPA. |
| Xero When connected New Zealand |
Payroll integration | When you connect Xero via OAuth (Pharmacy Settings → Integrations → Xero), approved timesheet data + staff identity fields are pushed to Xero on demand. Pharmacy HQ does not pull data from Xero. Disconnect at any time in Pharmacy Settings. |
| Google Maps Platform When enabled United States · global |
Geocoding + route optimisation | When you enable Deliveries route optimisation (Pharmacy Settings → Integrations → Google Maps), delivery addresses are geocoded via Google's Geocoding API + routed via the Directions API. Address strings are sent; no patient names. Per-pharmacy opt-in + monthly call budget. |
| Google My Business API When connected United States · global |
Trading-hours sync | If you connect your Google Business Profile (Pharmacy Settings → Integrations → GMB), Pharmacy HQ pushes public-holiday hours updates to GMB on your behalf. Read-write OAuth scope. |
| Google Cloud Vision and an Australian-hosted AI model When enabled Global (text check) · Australia (pill count) |
PreCheck pack photo check | Only for pharmacies whose Owner has turned PreCheck on; PreCheck is not yet enabled for live pharmacies. Google Cloud Vision reads any printed text on the cropped pack photo to stop photos that show a patient identifier; Google does not offer this service in Australia. If that check passes, the photo and the expected counts go to an AI model hosted in Australia; the model and provider are still being chosen and will be named here before PreCheck is enabled. Never the patient's name, date of birth, Medicare number, or any patient or pharmacy ID. See Section 4b of the Privacy Policy. |
| Clever Logger When connected Data source, read only |
Fridge temperature readings | If your pharmacy connects its Clever Logger account, with your pharmacy's permission we read the temperature readings of the fridges your pharmacy chooses, about once an hour, through a read-only viewer login your pharmacy adds for us. We send Clever Logger nothing except that read request, and never change anything in Clever Logger. |
These handle enquiries from our public website only. They never receive pharmacy, staff or patient data, no record from inside Pharmacy HQ passes to them.
| Provider | Role | Purpose / data handled |
|---|---|---|
| Calendly LLC United States |
Walkthrough bookings | Booking a walkthrough on pharmacyhq.com.au uses an embedded Calendly scheduler. Calendly receives the name, email address and chosen time entered on that form, plus anything typed into its own fields, and it sets cookies in the visitor's browser. It is loaded only on the pages that offer a booking, and only when that section is scrolled into view. No pharmacy account, staff record or patient information is involved at any point. |
Under the Australian Privacy Act, we are required to disclose where personal information crosses national borders. The tables above identify the primary jurisdiction of each sub-processor, including the website-only provider, whose data is limited to enquiry details a visitor types themselves. Where a US-based sub-processor has Australian or regional infrastructure (Google Cloud, Cloudflare), processing may occur in those regions; data still crosses into US-controlled infrastructure for replication, billing, or support purposes. Section 5 of the Privacy Policy sets out which of your pharmacy's data is stored in Sydney and what is processed outside Australia.
We do not transfer personal information to any sub-processor whose primary jurisdiction is the United Kingdom, the European Union, or jurisdictions without an adequate-protection finding under Australian privacy law, except to the extent the US-based providers above maintain edge infrastructure in those regions for performance reasons.
Material changes to this list (adding a new always-on sub-processor, or expanding the data category a current sub-processor handles) are reflected here. The "Last updated" date at the top of this page changes on each edit.
Banner-group customers and pharmacies with a signed Data Processing Agreement may request 30 days' advance notice on material changes; the standard subscriber tier does not include this commitment.
Terms of Service · Privacy Policy
This is the canonical sub-processor list. Where Terms or Privacy reference sub-processors generally, they defer to this page.