Current service and pilot arrangements
Eselram processes personal data on behalf of practitioner businesses under the applicable DPA. Practitioners remain responsible for the purposes for which they collect and use their client records, including health information, photographs and consent records.
The proposed Laser Station arrangement starts with a practitioner pilot supported by Eselram. Introducing practitioners to a pilot does not, by itself, give The Laser Station access to their client records or make it the operator of their accounts. The applicable pilot terms, DPA and actual processing arrangements govern any access.
If a subsequent licence agreement appoints The Laser Station to sell and operate the service, the customer terms, privacy information, DPA and this notice will be updated to identify the effective legal entity, responsibilities and relevant providers before that arrangement takes effect. This notice does not represent that a proposed licence, operator transfer or Stripe account switch has already happened. Ownership of the software or Eselram name does not, by itself, determine data-protection roles.
Cloudflare - hosted infrastructure
Provider: the Cloudflare contracting entity applicable to the active service account.
Purpose: hosted application delivery, security, tenant provisioning and routing, Cloudflare Workers, tenant-specific D1 databases and R2 file storage and recovery where used.
Data: business and client operational records, bookings, form answers, consent/signature records, treatment and health information, photographs, uploaded files and relevant technical/security metadata, to the extent used in the account.
Role: core infrastructure subprocessor where Cloudflare processes practitioner-controlled personal data for the hosted service. The service operator manages the infrastructure; practitioners do not need their own Cloudflare account. This does not promise that all processing or support access takes place in the UK.
Resend - managed email delivery
Provider: the Resend contracting entity applicable to the active sending account.
Purpose: managed delivery of operational emails, including account setup and subscription notices, and configured client booking, reminder, form, aftercare and review messages where sent through Resend.
Data: sender and recipient addresses, business/reply-to details, message content and links, and delivery, bounce and other supported email-event metadata. Message content may disclose appointment or treatment context depending on the practitioner's settings and templates.
Role: where Eselram contracts Resend to deliver messages containing practitioner-controlled personal data, Resend is an email-delivery subprocessor. Eselram's own account and subscription communications may also involve processing for its own business purposes. A business contact/reply-to email address is distinct from the automated sending address.
Where a practitioner independently configures its own supported email-provider account, that provider relationship must also be assessed against the actual configuration and contracts. It should not be assumed that a provider is outside the processing chain simply because the practitioner supplies credentials.
Stripe - two separate payment relationships
Provider: the Stripe group entity applicable to the relevant account and service.
Eselram subscription billing: Stripe processes business/contact and billing details, subscription/invoice information and payment references for access to Eselram. Subscription billing is separate from payments a practitioner collects from clients. The proposed use of a dedicated Laser Station Stripe account is not presented as already active; any change must be reflected in the effective customer-facing billing and contractual information.
Practitioner client payments: a practitioner may connect its own Stripe account through the supported payment integration. Data may include business identity and onboarding information, client contact details and payment/transaction references. Stripe's role for its own regulated payment activities is governed by the applicable Stripe terms and privacy information; it is not automatically an Eselram subprocessor for every activity.
Practitioners should review the terms applicable to their connected Stripe accounts. The software licence or a change to Eselram subscription billing does not itself transfer a practitioner's connected payment account or change its payout destination.
Google / Gmail - optional connected email
Provider: the Google group entity applicable to the connected account.
Purpose: outbound email through Gmail where the integration is available and enabled for that account. It is not required simply to use Eselram's managed email sending.
Data: OAuth identity/authorisation information, recipient details and outbound message content needed for the configured sending feature.
Role: an optional practitioner-selected integration. Eselram processes the connection information needed to maintain it. The Gmail sending feature requests gmail.send and does not require inbox-reading permission.
Google Analytics - optional analytics integration
Provider: the Google group entity applicable to the selected Google Analytics account.
Purpose: connecting an authorised Google account and property/web stream for supported website and booking analytics and reporting.
Data: OAuth connection details, property and stream identifiers, and configured analytics events, attribution and client/session identifiers where enabled. Analytics events should not contain clinical notes, form answers, photographs or other treatment-record content.
Role: an optional practitioner-selected integration, separate from Eselram's built-in booking analytics. Practitioners are responsible for their analytics configuration, privacy information and any required consent. Google account connections and analytics processing remain subject to the applicable Google terms; roles depend on the actual processing.
Technical maintenance and support access
Eselram provides product development and technical support under the current service arrangements and would support the proposed pilot. Access to practitioner data must be limited to what is needed for authorised support, maintenance, security or recovery, under the applicable DPA and confidentiality arrangements.
If a later operating arrangement uses Eselram or a separate technical supplier to process practitioner data on an operator's behalf, that processing relationship must be documented, including any required subprocessor authorisation, contractual safeguards and access restrictions. Retaining software ownership is not a blanket authorisation to access client records.
Provider identity, locations and safeguards
The relevant legal entities, processing/support locations and transfer safeguards depend on the actual provider accounts and contracts. The descriptions above do not establish a UK-only hosting or processing guarantee. Contact Eselram for information about the arrangements applicable to your service; any proposed operator change must identify and document the provider chain before it becomes effective.
Professional and operational service providers
Professional advisers and business administration services may process information for the service business's own purposes. They are not automatically subprocessors of practitioner-controlled client data. Any separate provider engaged to process that client data on behalf of the processor must be assessed and included in the appropriate notice and contractual arrangements.
Changes to subprocessors
The current DPA governs authorisation and notice. Where general written authorisation is relied on, proposed changes to subprocessors must be notified in writing with a reasonable opportunity for the practitioner to raise a documented objection on data-protection grounds before the change takes effect. A referral, software licence or commercial proposal does not replace those requirements.
International transfers
Where the service processor initiates a restricted transfer, an applicable UK adequacy regulation, UK International Data Transfer Agreement, UK Addendum to approved standard contractual clauses or another lawful mechanism must apply, as appropriate to the transfer. Practitioners should also assess transfers arising from accounts and integrations they independently select or control.
Contact
Questions about providers, support access, the proposed operating arrangement or transfer safeguards can be sent to [email protected].
Current business correspondence address: 2 Hagbourne Close, Woodcote, RG8 0RZ, United Kingdom