Sub-processor Register

Version 2026-09-03 · effective 2026-09-03 · generated from in-repo configuration

The vendors that process data on our behalf, their purpose, location and agreement status.

How to read this register

7 vendors process data on our behalf. 3 of them may receive consumer health data; those are the vendors named in the standalone Consumer Health Data Privacy Policy, because naming categories alone does not satisfy that disclosure.

Source: in-repo configuration stub. Agreement status reflects the current state of the contract with each vendor and is not a compliance claim.

Awaiting counsel. TODO(counsel): Confirm every entry, its data categories and its agreement status before this page is published, and set the notice period for adding a new sub-processor.

Sub-processors

VendorPurposeData categoriesLocationAgreement
Supabase, Inc.May receive consumer health dataPrimary database, authentication and document storage.identity, contact, case, consumer health dataUnited StatesBAA + DPAstatus: pending
Vercel Inc.Application hosting and edge delivery.request metadata, IP addressUnited StatesDPAstatus: pending
Didit ProtocolIdentity verification and document authenticity checks.identity, government identifier, biometric templateUnited States / European UnionDPAstatus: pending
Fasten Health, Inc.May receive consumer health dataMedical record retrieval from connected provider networks.consumer health data, clinical recordsUnited StatesBAAstatus: pending
Zoho CorporationCustomer relationship management for intake operations.identity, contact, case statusUnited StatesDPAstatus: pending
Twilio Inc.SMS and voice communications with claimants.contact, message contentUnited StatesDPAstatus: pending
Anthropic PBCMay receive consumer health dataZero-retention termsAssistive summarisation for intake staff.case narrativeUnited StatesDPA (zero-retention terms required)status: pending

Other legal documents

Consumer Health Data Privacy Policy

Privacy choices: 0 of 3 optional technologies enabled.