Subprocessor List
Every third party we engage to process Customer Content, what it does, where, and under what safeguards. Short list, on purpose: 4 vendors can touch your records, every one under a BAA with zero-retention, no-training terms. Changes are announced 30 days in advance, and business-operations vendors that never touch Customer Content are listed separately.
A. Subprocessors of Customer Content
These entities can process the records, imaging, and outputs you upload, solely to provide the Services. Each is bound by a subcontractor BAA and terms no less protective than the DPA, including the no-training flow-down.
us-east-1 ·
us-west-2 (DR)
Plan scope. This table describes Self-Service and Test-a-File processing. Under AI Enablement, records and model inference run inside your AWS or Azure tenancy under your keys and your cloud provider's BAA. The model-inference rows above are not engaged. Under Enterprise On-Prem, no subprocessor receives Customer Content unless you explicitly enable it. Details: DPA Annex 3.
B. Business-operations processors — no access to Customer Content
These vendors support running the business: billing, email, site analytics. They never receive medical records, imaging, or any Customer Content; they process only the visitor, account, and billing data described in the Privacy Notice.
What every Customer-Content subprocessor signs
We remain fully liable to you for every subprocessor's performance, as if it were our own (DPA §7.3).
Change notifications & objection rights
We add or replace a subprocessor of Customer Content only after 30 days' advance notice, by email to your account contacts. You may object on reasonable data-protection grounds within 14 days to [email protected]; if we can't resolve the objection, you may terminate the affected Services with a pro-rata refund of prepaid, unused fees (DPA §7.2). Emergency replacements for security reasons are notified as they happen, with the same objection rights.