Subprocessors
Subprocessor list
The third-party services we use to deliver The Clinic. Each subprocessor has a Data Processing Addendum on file; clinics that process PHI through us are covered by our BAA. We notify customers in writing at least 30 days before adding a new subprocessor that handles PHI.
Last updated: 2026-05-28
Want change notifications?
Email privacy@the-clinic.net to be added to our subprocessor-change mailing list.
Infrastructure & hosting
| Provider | Purpose | Region | Handles PHI | DPA |
|---|---|---|---|---|
| Hetzner Online GmbH | Primary production server hosting (EU region) | Germany (Falkenstein) | Yes | View |
| Cloudflare, Inc. | Edge DNS, DDoS protection, R2 object storage (uploads, backups) | Global edge; R2 buckets pinned per-clinic region | Yes | View |
Payments
| Provider | Purpose | Region | Handles PHI | DPA |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing (subscriptions, one-time card payments) | US / EU | No | View |
| Tap Payments (Network International) | Payment processing for GCC clinics | GCC (Bahrain primary) | No | View |
AI / inference
| Provider | Purpose | Region | Handles PHI | DPA |
|---|---|---|---|---|
| OpenRouter, Inc. | LLM gateway for clinical Copilot, transcription, note generation | Provider-dependent; per-clinic AI DPA gated | Yes | View |
| OpenAI, L.L.C. | Realtime speech-to-text and clinical writing models (when selected by clinic admin) | US; data residency configurable for enterprise clinics | Yes | View |
Communications
| Provider | Purpose | Region | Handles PHI | DPA |
|---|---|---|---|---|
| Customer-configured SMTP / SMS / WhatsApp providers | Outbound patient notifications (per-clinic credentials) | Clinic-configured | Yes | — |
Monitoring & telemetry
| Provider | Purpose | Region | Handles PHI | DPA |
|---|---|---|---|---|
| Sentry (Functional Software, Inc.) | Error tracking and performance monitoring | US / EU (region-pinned per environment) | No | View |