Legal
Sub-processors
Third parties that may process personal data on our behalf, and what they receive.
Version 2026-10 · Last updated 26 October 2026
Template — this document describes how the software works and must be reviewed and completed by qualified legal counsel for your jurisdiction before production use.
Current list (template)
Only vendors that sign a DPA — and a BAA where they may receive PHI — are used in production.
| Service | Provider | Data received | Agreements |
|---|---|---|---|
| Cloud hosting & database | [vendor, region] | all data (encrypted) | DPA + BAA |
| Object storage | [vendor, region] | encrypted files only | DPA + BAA |
| Payments | Stripe | name, email, amounts and generic order references only; never health information | DPA |
| Email / SMS / WhatsApp | [vendors] | contact details and generic notifications with secure links; never health information | DPA |
| Video consultations | [HIPAA-eligible vendor] | audio/video streams | DPA + BAA |