Subprocessors
Third-party service providers that process data on behalf of Clinic OS Pro
Last Updated: October 22, 2026
Notification of Changes: We will provide at least 30 days' advance notice where practicable before adding new subprocessors. Subscribe to updates by emailing support@clinicospro.com with subject "Subscribe to Subprocessor Updates".
Current Subprocessors
The HIPAA column: "BAA" means a Business Associate Agreement is executed with that subprocessor. "Conduit" means a carrier that transmits messages and calls under the HIPAA conduit exception. "No PHI" means the subprocessor receives no protected health information.
| Subprocessor | Purpose | Location | Data Type | HIPAA | GDPR |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Application hosting (ECS Fargate), database (RDS PostgreSQL), email delivery (SES), asynchronous processing (SQS/Lambda), backup storage (S3), and AI inference (Bedrock): drafting, classifying and translating patient messages and reviewing call transcripts with Anthropic's Claude, run inside our AWS account | United States (us-east-1) | All application and stored data (encrypted in transit and at rest) | BAA A Business Associate Addendum is executed with AWS, and every service listed here is HIPAA-eligible under it. | Yes |
| Telnyx LLC | SMS Messaging & Voice Carrier | United States / Global | Phone numbers, SMS message content, call metadata, and the audio of calls it carries for our AI voice agent | Conduit Telnyx operates under the HIPAA conduit exception (45 CFR 160.103) and has declined to execute a Business Associate Agreement at our current tier. Written confirmation of this position is maintained in our compliance records. See https://support.telnyx.com/en/articles/3347891-hipaa-baas-and-the-conduit-exception | Yes |
| Retell AI, Inc. | AI voice agent for outbound and inbound patient calls | United States (its BAA allows processing outside the US) | Patient first name, phone number, call audio and transcripts | BAA A Business Associate Agreement and Data Processing Agreement are executed with Retell. Voice calling stays disabled in the product until that agreement is recorded. Retell runs each call on its own providers: the voice (ElevenLabs, named in our agent's voice setting) and the language models that hold the conversation (our agent is set to Anthropic's Claude) and analyze it afterwards (our agent is set to OpenAI's GPT-4.1). Retell answers for them under its BAA with us: it may give PHI to a subcontractor only after that subcontractor agrees in writing to protect it on terms consistent with the BAA, and it must vet its subcontractors and keep a current list of those that receive our PHI. | Yes |
| Google LLC (Google Workspace) | Business email: our support mailbox, and the copies and forwards of patient replies sent to our team | United States / Global | Patient name, phone number or email address, and the text of the reply, in forwarded replies | BAA Google's HIPAA Business Associate Amendment is accepted for both of our Google Workspace accounts (October 17 and 18, 2026). It covers Gmail and Google's other core services, not Google Contacts or third-party add-ons. | Yes |
| Google LLC (Sign in with Google) | Optional sign-in for staff accounts | United States / Global | A staff member's name and email address; no patient data | No PHI No Business Associate Agreement, because sign-in sends Google no patient data: Google only confirms who the staff member is. | Yes |
| Stripe, Inc. | Payment Processing | United States | Clinic billing information and payment methods | No PHI No Business Associate Agreement, because Stripe receives no PHI. Only clinic billing details are sent; no patient record is ever transmitted. | Yes |
| Upstash, Inc. | Rate limiting and short-lived operational caching | United States | Clinic identifiers, request counters, cached clinic settings | No PHI No Business Associate Agreement, because Upstash receives no PHI. Patient-level suppression data is held in the primary database rather than in the cache. | Yes |
| Resend, Inc. | Internal operational alert email to Clinic OS Pro staff | United States | Clinic name and alert text; no patient data | No PHI No Business Associate Agreement, because Resend carries no patient email. It delivers system health alerts to our own staff, and alert content is restricted to clinic-level facts by design. All patient email is sent through AWS SES. | Yes |
| Anthropic, PBC | An optional nightly pass that suggests changes to automated message sequences (off unless switched on) | United States | Counts and day numbers about anonymous sequence enrollments; no names, contact details, record IDs, clinic names or message text | No PHI No Business Associate Agreement, because nothing sent identifies a patient or a clinic, and an automated test guards the request against patient identifiers. Message drafting, classification and translation use Anthropic's Claude through Amazon Bedrock inside our AWS account, under the AWS Business Associate Addendum (see the Amazon Web Services row). | Yes |
Systems Your Clinic Connects
You may connect your own systems to Clinic OS Pro: your EMR or practice-management system (for example WebPT, Jane App, Cliniko or Tebra), a CRM such as GoHighLevel, or your clinic's Facebook or Instagram inbox. We reach them with your clinic's own credentials, on your clinic's behalf, and only for the data you authorize us to sync.
These systems are your clinic's vendors, not ours. They are not our subprocessors under HIPAA or GDPR: they process data under your separate agreements with them.
Due Diligence
Before engaging any subprocessor, we verify:
- Security certifications (SOC 2, ISO 27001, etc.)
- Data protection policies and practices
- HIPAA Business Associate Agreement availability (where PHI is involved)
- GDPR Data Processing Agreement availability (for EU data)
- Physical and technical security measures
- Incident response capabilities
We require subprocessors that access customer data to maintain security standards that are at least as protective as our own technical and organizational measures.
Objection Process
Under our Data Processing Addendum, customers have the right to object to new subprocessors. The process is:
- We notify you at least 30 days before adding a new subprocessor (where practicable)
- You may object in writing with specific, reasonable grounds
- We will work with you to address concerns
- If concerns cannot be resolved in a commercially reasonable way, you may terminate only the affected services as your sole and exclusive remedy
Objection and termination rights are subject to the limitations and procedures set out in your applicable Business Associate Agreement or Data Processing Addendum.
Data Location
All primary data processing occurs in the United States. We use US-based data centers for:
- Application hosting (AWS ECS Fargate - us-east-1)
- Database storage (AWS RDS PostgreSQL - us-east-1)
- Backups (AWS S3 and RDS automated snapshots, encrypted, us-east-1)
For customers in the EEA, UK, or other regions with transfer restrictions, cross-border transfers to the United States are governed by our Data Processing Addendum (including Standard Contractual Clauses, where applicable).
For customers requiring data localization, please contact us to discuss options.
Contact
For questions about our subprocessors:
Clinic OS ProWindsor, Ontario, Canada
Email: support@clinicospro.com (subject: "Subprocessor Inquiry")
Change Log
| Date | Change |
|---|---|
| Dec 25, 2025 | Initial subprocessor list published |
| Jul 2, 2026 | Removed Sentry (error monitoring is handled by an in-house, PHI-safe error log; no data is sent to Sentry) |
| Aug 31, 2026 | Removed Vercel and Neon. Application hosting and the production database moved to Amazon Web Services (ECS Fargate and RDS PostgreSQL, us-east-1), both covered by the existing AWS Business Associate Addendum. Removed Google OAuth, which is not in use. Added Retell AI, Upstash, Resend, Anthropic and Cloudflare, which were already in service but had not been listed. |
| Oct 11, 2026 | The HIPAA column now names each subprocessor's basis: BAA, Conduit or No PHI. Amazon Web Services and Retell AI, both under an executed Business Associate Agreement, had been shown as "Conduit". No subprocessor was added or removed. |
| Oct 19, 2026 | Added Google: Google Workspace, our business email, which receives copies of patient replies forwarded to our team under Google's HIPAA Business Associate Amendment; and Sign in with Google for staff accounts, in use since September 17, 2026. Removed Cloudflare: its bot protection was listed for sign-in, and our sign-in page never used it. The Anthropic row now says what Anthropic receives, and the Amazon Web Services row says what runs on Bedrock. The Retell AI row describes the providers Retell uses for each call, and the Telnyx row adds the call audio it carries. The systems clinics connect are now listed only where we have an integration with them. |
Document Version: 2026-10-22
Last Reviewed: October 22, 2026