Subprocessors
Every EDFlow sub-processor with its purpose, whether health information can reach it, the data categories, its location and when it applies, from the single list shared with the privacy page and the security review pack.
This table is generated from the single sub-processor list used by the privacy page, the PIA inputs and the security review pack, so they always agree.
| Sub-processor | Purpose | Health information? | Data | Location | When it applies |
|---|---|---|---|---|---|
Amazon Web Services (self-hosted Convex, RDS, KMS) | Database and backend for hospital tenants | Yes | Visit data needed to run the service (minimum necessary) | Canada (ca-central-1; ca-west-1 for disaster recovery) | Hospital production deployments |
Convex, Inc. | Managed backend for the showcase and development | No | Synthetic data only | United States | Non-production deployments only |
Vercel | Web delivery and server functions | No | No PHI by design; authentication tokens in transit | Functions in Montréal (yul1); global CDN for static files | Every deployment |
Expo Push (with Apple APNs and Google FCM) | Push notifications | No | Device push tokens; generic notification text | United States | When push notifications are on for the site |
Twilio | SMS (share links, updates, verification codes) | No | Phone numbers; generic message text with no hospital or patient name | United States | When SMS is on for the site |
Resend | Email (staff invitations, password resets, summary links) | No | Email addresses; generic message text | United States | When email is configured |
Microsoft Entra ID | Staff single sign-on | No | Staff identity only | The hospital's own tenant | When the hospital enables SSO |
Vercel AI Gateway (Anthropic, Amazon Bedrock, Google Vertex AI) | AI features, zero data retention | No | Scrubbed prompts; no identifiers | United States (zero data retention) | Only for sites that approved AI phase 2 (US processing, zero data retention) |
OpenAI (speech transcription) | Web voice input in the showcase | No | Audio from synthetic demonstrations | United States | Web voice only; off for hospital tenants until approved |
Notes
- Only the database host receives health information by design. Push, SMS and email carry generic text and opaque links; SMS providers necessarily receive the phone number of a patient or family member who opts in.
- AI providers receive patient-derived data only for sites whose privacy office has approved AI phase 2, under zero data retention and with no training on the data. Web voice transcription stays off for hospital tenants until its conditions are met.
- Optional and env-gated: push, SMS, email, SSO and AI can each be turned off per site. Without them, the service falls back to in-app delivery.
- Showcase-only processors never see hospital data.
Change notice
New sub-processors, or a change in what one receives, are announced to each custodian in advance, with the updated PIA inputs. Flow-down terms (confidentiality, breach notice, residency where applicable) apply to every sub-processor that can receive personal information.
Related
Last updated on