Sub-processors

This page lists the third parties that process personal data on our behalf to deliver the RAKT Service, together with what each one does and where it processes data. It is referenced by our Privacy Policy and by the Data Processing Addendum, and a blood centre’s authorisation of these sub-processors is given under Section 5 of the DPA.

We keep this list short on purpose. Every entry is a party that can technically see some personal data, and we would rather name them than describe them vaguely as “our service providers”.

Where your records actually live

Donor, recipient, patient, and staff records are stored and backed up on infrastructure in India. The entries marked as processing outside India handle delivery, diagnostics, or the optional artificial intelligence features, not the primary record store.

Infrastructure

Sub-processor	What it does	Processing location
DigitalOcean, LLC	Application hosting, managed PostgreSQL database, and serverless functions used for government portal integration. This is the primary store for Customer Data.	India (Bengaluru)
Amazon Web Services, Inc.	Object storage for uploaded files and generated documents, content delivery, and encrypted database and system backups.	India (Mumbai). Content delivery edge locations are global, and serve static assets only.

Communications

Sub-processor	What it does	Processing location
Twilio SendGrid	Transactional and notification email. Processes recipient email addresses and message content.	United States
2Factor (Sarv Webs Pvt. Ltd.)	SMS and one-time passcode delivery. Processes recipient phone numbers and template variables, which can include a donor name and donation details.	India
Meta Platforms, Inc. (WhatsApp Business Cloud API)	WhatsApp notifications where a blood centre enables them. Processes recipient phone numbers and template message contents, which can include a donor name, donation details, and report links.	United States and other locations operated by Meta

Optional artificial intelligence features

Sub-processor	What it does	Processing location
OpenAI, L.L.C.	Two optional features, described in Section 5 of the Privacy Policy: extracting text from an image of a completed donor registration form, and answering staff questions through the RAKT AI assistant. Receives the form image, which can contain all data written on the form, and the records returned by the assistant’s read-only lookups, which can include donor names, blood groups, and contact numbers. Contractually prohibited from using the data for model training.	United States

A blood centre that does not want donor data processed in this way should not use these features, and can ask us to disable them for its account by writing to support@rakt.in.

Operations, billing, and diagnostics

Sub-processor	What it does	Processing location
Razorpay Software Pvt. Ltd.	Payment processing for subscriptions and credits. Card and bank details are entered directly with Razorpay and are never received or stored by RAKT.	India
Functional Software, Inc. (Sentry)	Application error and performance monitoring. Receives technical diagnostic data. Personal data reporting is disabled, though limited identifiers can appear incidentally within an error payload.	United States
Google LLC	reCAPTCHA on sign-up and public forms, which processes IP address and a challenge token; address autocomplete, which processes an address as it is typed; and website analytics and advertising measurement on rakt.in only, subject to consent, as described in the Cookie Policy. Not present in the signed-in application.	United States
Cloudflare, Inc.	Public content delivery network for common JavaScript libraries. Receives IP address as an incidental consequence of serving a file. No Customer Data.	Global edge network

Sales and marketing contacts only

These tools hold business contact details of customer and prospective customer staff. They do not receive donor, recipient, or patient records.

Sub-processor	What it does	Processing location
Sendinblue SAS (Brevo)	Marketing email and contact management for prospective and existing customer organisations.	European Union (France)
Mango Technologies, Inc. (ClickUp)	Internal customer operations, onboarding, and support tracking. Holds organisation names and staff contact details.	United States
Abstract API, Inc.	Validating that an email address is deliverable at the point of enquiry or sign-up.	United States

Integrations you choose to enable

These are not sub-processors. They are third parties that receive data because a blood centre instructs the Service to send it, and the centre is responsible for the lawfulness of that transfer.

• eRaktKosh, operated by the Ministry of Health and Family Welfare, for statutory reporting of stock, donation, and camp data.
• Ayushman Bharat Digital Mission, operated by the National Health Authority, where a centre uses ABHA linkage or scan-and-share.

Changes to this list

We will update this page before a new sub-processor begins processing personal data, and we will notify customer organisations by email or through the Service. If a blood centre reasonably objects to a new sub-processor on data protection grounds, it should write to support@rakt.in within fourteen days of that notice, and we will work in good faith to offer an alternative or, failing that, the centre may terminate the affected part of its subscription without penalty for the unused prepaid term.

Contact

Questions about this list, or a request to disable the optional artificial intelligence features for your account, can be sent to the Grievance Officer:

RAKT INNOVATIONS (OPC) PVT. LTD.
AN-4D, AN Block, Shalimar Bagh, Delhi 110088, India
CIN: U72900DL2020OPC360414  |  GSTIN: 07AAKCR0304B1Z0
Phone: +91 70427 21037, +91 99539 94941
Email: support@rakt.in