Subprocessors
Two providers may see PHI. We name every one.
This is the list our Business Associate Agreement points to in Section 7 and Exhibit C. Every other service we use is kept away from PHI by design, with a technical control that enforces it.
Last updated
May process PHI
Both under a BAA, both in the United States.
In offline mode, neither receives anything: speech recognition and interpretation run on the device.
Amazon Web Services
Amazon Web Services, Inc.
- Role
- Application hosting, database, logging, key management and monitoring.
- Location
- United States (us-west-2)
- PHI handling
- Hosts the application and the server-side records listed in BAA Exhibit D: session records, ratings and the audit log. No transcripts, narratives or audio.
Covered by the AWS Business Associate Addendum.
OpenAI
OpenAI, L.L.C.
- Role
- AI service provider: speech recognition, interpretation, summarization, extraction and drafting in online mode.
- Location
- United States
- PHI handling
- Receives encounter audio and transcript text for real-time processing and returns the result.
Covered by our BAA with OpenAI. Zero data retention: nothing is kept after the response. No training on your PHI.
Never receives PHI
Kept out by design, and by a control that enforces it.
We don’t send your PHI to any of these providers. Each line names the control that keeps it that way.
Provider
What it does
Control
- Cloudflare, Inc. (R2)
- Storage for Guide documents and department logos
- Holds non-PHI reference material and branding only. No encounter storage exists.
- Firecrawl
- Text extraction for published Guides
- Receives a published Guide document at publish time. Never receives call content, questions or user context.
- Resend, Inc.
- Sign-in email delivery
- Carries sign-in links only.
- Mixpanel, Inc.
- Product analytics
- A code-level property denylist and event suppression keep transcripts, questions, locations and IDs out.
- Functional Software, Inc. (Sentry)
- Crash and error reporting
- Personal data collection off, and a scrubber cleans every event before it leaves the device.
- Expo / Expo Application Services
- App builds and over-the-air updates
- Distributes application code. Does not process call data.
- Apple Inc.; Google LLC
- App distribution and testing
- Distribution channels only.
- RevenueCat, Inc.
- Subscription status
- Receives subscription state, not call data.
- logo.dev
- Department logo lookup
- Branding assets only.
On the device
WhisperKit (offline speech recognition) and Google ML Kit Translate (offline interpretation and language identification) run entirely on the iPad and send no call content anywhere.
When this list changes
You hear first, and you can say no.
Subscribers get each notice by email, and every change is recorded below. To subscribe, write to security@vitalvoice.ai with your department and the address that should receive notices.
30 days’ notice
We tell you at least 30 days before engaging a new provider that may handle PHI. Urgent replacements for security, reliability or legal reasons are notified as soon as practicable.
BAA §7.2
Your right to object
Object in writing within 30 days of a notice on good-faith HIPAA, privacy or security grounds. We work it through with you, including compensating controls or a configuration without that provider.
BAA §7.3
The same protections, passed down
Every provider that handles PHI is bound in writing to restrictions at least as protective as ours, and we stay responsible for their performance.
BAA §4.7
Change log
Every change, dated.
-
28 October 2026
List published at this address. Two providers may process PHI: Amazon Web Services and OpenAI.
Questions about a provider? Ask for its security documentation at security@vitalvoice.ai, or read how a call moves through each one on our security page.