Subcontractors
- Version
- 2026-11-06
- Effective
These are the subcontractors that receive protected health information under our Business Associate Agreement. This list is separate from the subprocessor list for our European data processing agreement. We notify account owners at least 15 days before a new subcontractor receives protected health information.
| Subcontractors | Service | Purpose | Customer Data received | Processing locations | Agreement | Privacy |
|---|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Hosting | Compute, database, file storage, cache, key management, email (Amazon SES), translation (Amazon Translate), speech-to-text (Amazon Transcribe), code sandbox (Amazon Bedrock AgentCore), web research (Amazon Nova Web Grounding, which receives only questions from which patient identifiers are removed), logging and backups | All Customer Data, including Protected Health Information | AWS us-east-1 (Northern Virginia) | AWS Business Associate Addendum | Privacy |
| Fireworks.ai, Inc. | AI models | AI models for the AI features, with zero data retention | Requests to the AI features: prompts, conversation history and information retrieved by authorized tools, which can include Protected Health Information | Requests are processed and not stored | Fireworks Business Associate Agreement | Privacy |