Subprocessors

Current subprocessors

Each entry names the provider, what it does and what categories of data it can reach. A business associate agreement is put in place with every provider that can reach protected health information before a HIPAA-regulated deployment goes live.

• Render (United States, Oregon) — application hosting and managed PostgreSQL. Reaches encrypted health data.
• PayPal — subscription billing. Reaches name, email and billing details. Never reaches health data.
• Resend — account, security and reminder emails. Reaches email address and discreet message content only.
• Anthropic and OpenAI — AI model providers, used only when the AI assistance you consented to runs. Each receives only the minimal context a skill requires, under API terms that prohibit training on customer data.
• Google — Sign in with Google, when you choose it: Google tells us your verified email address and name. Google Analytics, on the public marketing pages only: receives the page path, never a query string or health data, and is not loaded on any signed-in page.
• GetWaitlist — the early-access waitlist, before you have an account. Receives the email address you enter on that form and nothing else.
• SMS is not offered. No SMS provider receives any data.
• Sentry (optional) — error monitoring. Receives the fact that a request failed, the code path that failed, and an account identifier. Request bodies, query strings, cookies and every health value are removed before an error report is sent, and session recording is switched off entirely.

Not used

This list is what the service actually sends data to, not what it may use one day. NurturaCare stores no uploaded files, so there is no object-storage provider. No analytics vendor is loaded on any signed-in page. A voice note is transcribed and discarded in the same request; no recording is ever written down. There is no session-replay tool anywhere in the product. Any addition here is announced before it takes effect.

Changes

Organisations on a contract receive advance notice of any addition to this list and may object under their data processing addendum.