Subprocessors

CarePath is a documentation tool, not a healthcare provider. It does not practise medicine, diagnose, triage, prescribe, calculate doses or check interactions, and it never replaces a clinician's own judgment or instructions.

1. 01Current subprocessors

   Vendor	Purpose	Data	Region
   OpenAI	De-identification, comic scripts and illustrations	De-identification: raw text in transit, not stored (Zero Data Retention required before launch). Generation: de-identified text only.	United States
   Supabase	Database, authentication and file storage	Clinician accounts, de-identified cases, comics and artwork.	United States
   Vercel	Application hosting	Serves the app; no case content at rest.	United States
   Inngest	Background job orchestration	Job identifiers only — no case text.	United States
   Stripe	Payments and invoices	Billing contact and payment details (entered on Stripe’s pages).	United States
   Resend	Transactional email	Invitation and account emails to clinicians. Never patient-facing.	United States

   The de-identification service’s hosting provider will be listed here before launch.

2. 02What each vendor is bound to

   Every vendor above is engaged under a written contract that requires it to:

   • process data only on our documented instructions;
   • keep it confidential and apply appropriate technical and organisational measures;
   • support us in answering data subject requests and in notifying incidents;
   • delete or return data at the end of the engagement;
   • where the transfer requires it, accept the Standard Contractual Clauses.

   No vendor on this list is permitted to use your content to train its models. We select vendors on that basis, and we review the arrangement whenever the system changes.

3. 03Changes and objections

   We will update this page before a new subprocessor starts processing customer data, and — for customers with a Data Processing Addendum in place — notify organization owners by email at least 30 days beforehand.

   If you have a reasonable, documented objection on data protection grounds, tell us within those 30 days at support@carepath.com. We will work with you to find an alternative; if none exists, you may cancel the affected subscription and receive a pro-rata refund of the unused prepaid period.

   To be told about changes automatically, email us asking to be added to the subprocessor notification list.