Subprocessor list
DRAFT — requires legal review
This document is a working draft prepared by the engineering team to describe how the platform is designed to support compliance. It is not legal advice and has not yet been reviewed by counsel. Do not rely on it as a final policy until this banner is removed.
| Subprocessor | Purpose | Data categories | Location | Status |
|---|---|---|---|---|
| Google Cloud / Firebase (Google Cloud India) | Hosting, compute (Cloud Functions, Cloud Run), Firestore database, Cloud Storage, backups, logging, KMS, Secret Manager | All platform data | India — asia-south1 (Mumbai), asia-south2 (Delhi) | Active |
| Cashfree Payments India | Subscription and patient payments, payment links, UPI | Name, phone/email, amount, order/payment references (no card data stored by us) | India | Active |
| Meta Platforms (WhatsApp Business Cloud API) | WhatsApp reminders, documents links, notifications | Phone number, message content/templates (links rather than clinical content where possible) | Meta infrastructure (may be outside India) — cross-border basis TBD | Active |
| Google Workspace (Gmail SMTP) or provider-configured SMTP | Transactional email (invites, password reset, notifications) | Name, email, message content | Google (global) / provider-chosen | Active — dedicated transactional email provider TBD |
| Google Vertex AI (Gemini) — or Gemini API paid tier | AI drafts, patient-friendly summaries, ICD-10 suggestions (only when the workspace opts in) | Consultation transcripts, template structure, signed clinical facts without identifiers | Vertex AI asia-south1 (Mumbai) when configured; Gemini API: Google (global) — cross-border basis TBD | Available (off by default; zero-retention settings required) |
| Google Cloud Speech-to-Text | Server voice dictation (only when the workspace opts in) | Audio snippets (≤ 60 s) | Google Cloud (region per endpoint) — TBD | Available (off by default) |
| Sarvam AI | Server voice dictation for Indian languages (only when the workspace opts in) | Audio snippets (≤ 60 s) | India | Available (off by default; zero-retention contract TBD) |
| Browser speech service (Google via Chrome, Microsoft via Edge) | Browser dictation (free) — only when the workspace enables it | Audio captured by the browser | Browser vendor (may be outside India) | Optional, disclosed in AI settings |
| Fast2SMS | OTP and SMS notifications | Phone number, OTP/message text | India | Active |
| OpenRouter (routes to third-party LLMs) | Public website chatbot | Visitor chat messages (no patient records) | Outside India — cross-border basis TBD | Active (website chatbot only) |
| Google Gemini API | Public website chatbot (alternative model provider) | Visitor chat messages (no patient records) | Google (global) — TBD | Active (website chatbot only) |
| Hugging Face Inference API | Public website chatbot (fallback provider) | Visitor chat messages (no patient records) | Outside India — TBD | Active (website chatbot only) |
We notify customers at least 30 days before adding or replacing a subprocessor that processes patient data (proposed; to be confirmed in the DPA).