Sub-processors
Version 1.0 · Effective 31 July 2026This page lists the third parties that process personal data on our behalf to deliver the RAKT Service, together with what each one does and where it processes data. It is referenced by our Privacy Policy and by the Data Processing Addendum, and a blood centre’s authorisation of these sub-processors is given under Section 5 of the DPA.
We keep this list short on purpose. Every entry is a party that can technically see some personal data, and we would rather name them than describe them vaguely as “our service providers”.
Where your records actually live
Donor, recipient, patient, and staff records are stored and backed up on infrastructure in India. The entries marked as processing outside India handle delivery, diagnostics, or the optional artificial intelligence features, not the primary record store.
Infrastructure
| Sub-processor | What it does | Processing location |
|---|---|---|
| DigitalOcean, LLC | Application hosting, managed PostgreSQL database, and serverless functions used for government portal integration. This is the primary store for Customer Data. | India (Bengaluru) |
| Amazon Web Services, Inc. | Object storage for uploaded files and generated documents, content delivery, and encrypted database and system backups. | India (Mumbai). Content delivery edge locations are global, and serve static assets only. |
Communications
| Sub-processor | What it does | Processing location |
|---|---|---|
| Twilio SendGrid | Transactional and notification email. Processes recipient email addresses and message content. | United States |
| 2Factor (Sarv Webs Pvt. Ltd.) | SMS and one-time passcode delivery. Processes recipient phone numbers and template variables, which can include a donor name and donation details. | India |
| Meta Platforms, Inc. (WhatsApp Business Cloud API) | WhatsApp notifications where a blood centre enables them. Processes recipient phone numbers and template message contents, which can include a donor name, donation details, and report links. | United States and other locations operated by Meta |
Optional artificial intelligence features
| Sub-processor | What it does | Processing location |
|---|---|---|
| OpenAI, L.L.C. | Two optional features, described in Section 5 of the Privacy Policy: extracting text from an image of a completed donor registration form, and answering staff questions through the RAKT AI assistant. Receives the form image, which can contain all data written on the form, and the records returned by the assistant’s read-only lookups, which can include donor names, blood groups, and contact numbers. Contractually prohibited from using the data for model training. | United States |
A blood centre that does not want donor data processed in this way should not use these features, and can ask us to disable them for its account by writing to support@rakt.in.
Operations, billing, and diagnostics
| Sub-processor | What it does | Processing location |
|---|---|---|
| Razorpay Software Pvt. Ltd. | Payment processing for subscriptions and credits. Card and bank details are entered directly with Razorpay and are never received or stored by RAKT. | India |
| Functional Software, Inc. (Sentry) | Application error and performance monitoring. Receives technical diagnostic data. Personal data reporting is disabled, though limited identifiers can appear incidentally within an error payload. | United States |
| Google LLC | reCAPTCHA on sign-up and public forms, which processes IP address and a challenge token; address autocomplete, which processes an address as it is typed; and website analytics and advertising measurement on rakt.in only, subject to consent, as described in the Cookie Policy. Not present in the signed-in application. | United States |
| Cloudflare, Inc. | Public content delivery network for common JavaScript libraries. Receives IP address as an incidental consequence of serving a file. No Customer Data. | Global edge network |
Sales and marketing contacts only
These tools hold business contact details of customer and prospective customer staff. They do not receive donor, recipient, or patient records.
| Sub-processor | What it does | Processing location |
|---|---|---|
| Sendinblue SAS (Brevo) | Marketing email and contact management for prospective and existing customer organisations. | European Union (France) |
| Mango Technologies, Inc. (ClickUp) | Internal customer operations, onboarding, and support tracking. Holds organisation names and staff contact details. | United States |
| Abstract API, Inc. | Validating that an email address is deliverable at the point of enquiry or sign-up. | United States |
Integrations you choose to enable
These are not sub-processors. They are third parties that receive data because a blood centre instructs the Service to send it, and the centre is responsible for the lawfulness of that transfer.
- eRaktKosh, operated by the Ministry of Health and Family Welfare, for statutory reporting of stock, donation, and camp data.
- Ayushman Bharat Digital Mission, operated by the National Health Authority, where a centre uses ABHA linkage or scan-and-share.
Changes to this list
We will update this page before a new sub-processor begins processing personal data, and we will notify customer organisations by email or through the Service. If a blood centre reasonably objects to a new sub-processor on data protection grounds, it should write to support@rakt.in within fourteen days of that notice, and we will work in good faith to offer an alternative or, failing that, the centre may terminate the affected part of its subscription without penalty for the unused prepaid term.
Contact
Questions about this list, or a request to disable the optional artificial intelligence features for your account, can be sent to the Grievance Officer:
RAKT INNOVATIONS (OPC) PVT. LTD.
AN-4D, AN Block, Shalimar Bagh, Delhi 110088, India
CIN: U72900DL2020OPC360414 | GSTIN: 07AAKCR0304B1Z0
Phone: +91 70427 21037, +91 99539 94941
Email: support@rakt.in
Ready to revolutionize your blood bank operations? Get started today!