Published for transparency while formal governance documents are prepared with counsel. There is no binding effective date until this banner is removed.
A subprocessor is a third party that may process data — including, in production, protected health information — on our behalf to deliver the service. This page lists the real vendors that appear in the codebase today, each with its purpose and status. Counterparty integrations that are not yet enabled for a tenant remain flag-off and fail-closed until the required Business Associate Agreement, banking KYB, or credentialing gate clears. We list only vendors that genuinely appear in the system; we do not pad the list with aspirational partners.
Deterministic architecture, governed by explicit compliance gates.
Every clinical and financial surface is built on a hash-chained WORM double-entry ledger, a six-condition settlement gate, and an integer-cent 835 reconciliation waterfall under a registered HIPAA clearinghouse and Type-2 organizational NPI. Integrations without active counterparty credentials or executed BAAs fail closed by contract.
The table below names each subprocessor with its purpose, the category of data it would touch, its region, and its status on the verified-green-versus-gated register. Google Cloud is the foundational infrastructure and is active. The bank rails (Column, M&T, FedNow), the payment gateways (Authorize.net, Stripe), the clearinghouse transports (Stedi, Change Healthcare), the EMR partners (Nextech, IntelleChart), and the messaging vendors (Twilio/Sinch, SendGrid) are integration-real but gated or sandbox — none is enabled for live money or real PHI. Modern Treasury is being removed: it has been demoted to a removable, config-selected adapter as the sovereign rails direction moves toward direct bank integration.
| Field | Type | Description |
|---|---|---|
Google Cloud (GCP) | active | Foundational cloud infrastructure: compute and hosting, the managed relational database, Cloud Healthcare API FHIR R4 and DICOM stores, and Vertex AI (clinical-translation fallback). — Data touched: PHI (FHIR/DICOM clinical records), operational and application data. Region: United States (e.g. us-east4 / us-central via GCP_REGION). |
Column N.A. | gated | Direct-bank rail / ACH executor for sovereign settlement (primary direct-bank path under the settlement gate). — Data touched: Settlement and payment metadata (no PHI). Region: United States. |
M&T Bank | gated | Batch-wire executor using the bank's proprietary batch format (settlement rail alternative to Column). — Data touched: Settlement and payment metadata (no PHI). Region: United States. |
FedNow (Federal Reserve) | gated | Instant-payment rail; pacs.008 messages are certification-ready with a full inbound parser set. Not certified. — Data touched: Settlement and payment metadata (no PHI). Region: United States. |
Modern Treasury | being-removed | Payment-operations middleware; demoted to a removable, config-selected adapter as sovereign rails move to direct-bank integration. — Data touched: Payment/settlement metadata (no PHI). Region: United States. |
Authorize.net | gated | Patient self-pay payment gateway for Loop-2 patient payments (structurally separated from the payer advance pool). — Data touched: Patient payment / card data (financial); no clinical PHI. Region: United States. |
Stripe | sandbox | Patient / invoice payment processing (self-pay path). — Data touched: Patient payment / card data (financial). Region: United States. |
Stedi | sandbox | EDI clearinghouse transport for X12 healthcare transactions (270/271 eligibility, 837 claims, 835 remittance, 276/277 status). — Data touched: PHI (patient, claim, and eligibility data). Region: United States. |
Change Healthcare (Optum) | gated | Alternate clearinghouse transport for claim submission and status (multi-clearinghouse routing treats vendors as commodities). — Data touched: PHI (claim data). Region: United States. |
Nextech (Practice+ Partner API) | gated | EMR integration partner for clinical data pull / migration (client-zero ophthalmology EMR). — Data touched: PHI (clinical records). Region: United States. |
IntelleChart | gated | EMR integration partner via SMART-on-FHIR; SMART client code-complete pending registration. — Data touched: PHI (clinical records). Region: United States. |
Twilio / Sinch | gated | BAA-eligible SMS transport for patient messaging (env-selected; unconfigured channels fail closed). — Data touched: Patient contact data and minimal message content. Region: United States. |
SendGrid | gated | Email transport for notifications (env-selected EMAIL_PROVIDER; unconfigured fails closed). — Data touched: Recipient contact data. Region: United States. |
Google Translate (googtrans) | gated | On-page UI language switching for the website via the Google translation cookie (site interface only, not the clinical translation path). — Data touched: No PHI (public UI text; client-side cookie). Region: United States. |
Table columns: Field = vendor; Type = status on the verified-green-versus-gated register; Description = purpose, data category, and region.
As the platform approaches production, this list will change: vendors will move from gated to active as their gates clear, some will be removed, and BAAs or equivalent flow-down agreements will be executed before any subprocessor receives real PHI. The binding version will describe how customers are notified of additions or material changes to the subprocessor list and any right to object. Until then, this draft is a transparent snapshot of what is wired, not a claim about what is running.
Questions about a vendor on this list, its status, or a Business Associate Agreement — send a note and a human will respond. When the binding list is published, this draft banner will come down.