Documento legal
Subprocessors
Última atualização: . Escrito em inglês.
Adapted from the Basecamp open-source policies (https://github.com/basecamp/policies, commit 05fb1f9ddaaf604fc5816990fa66f3ffd7f0a462) / CC BY 4.0. Source file: privacy/company-processors/index.md, with the list format of privacy/basecamp-subprocessors/index.md. See Changes from the template.
We use the third-party providers below to run the Service. Each one processes personal data for us. For patient call data we are the clinic's processor, so these providers are subprocessors under the Data Processing Addendum. For our own account data, see the Privacy Policy.
True today, and what applies to real clinics
The public demo uses fictional clinic and caller data. A separately owner-authorized test call used a fictional patient identity and created retained provider and application records; its removal remains in open item ENG-023. This does not establish clinic use with patient data. No clinic has signed the DPA, and no DPA with any listed provider has been reviewed or signed (open item L15). The transfer mechanisms in the table are what each provider states on its own pages, read on 2026-11-02 and not yet approved by the owner (open item L14); the evidence, quotes and gaps are in subprocessor research, November 2026. Before the Service processes clinic patient data, the applicable signed DPAs, any required transfer mechanism where data leaves the EEA, and the location decisions in open item L20 remain unresolved.
How to read the location column
- VERIFIED means a file in
docs/providers/records the fact from an official provider page or a live API response, and the row names that file. - CONFIGURED means it is our own setting in this repository or in the provider console. It says where we asked for the data to go, not what the provider guarantees.
- UNVERIFIED means no official source in this repository confirms it.
- STATED 2026-11-02 means the provider's own public page says so; the quote and URL are in the research file. It is the provider's claim, not a checked fact. Data Privacy Framework (DPF) claims were not checked against the official list.
- not found means the provider's pages we read do not say.
On the Vercel AI Gateway path we have no contract with the model provider. The chain is us, then Vercel, then the model provider. Every Gateway request asks for zero data retention (zeroDataRetention: true, CONFIGURED in src/shared/voice-runtime/gateway-options.ts), except speech to ElevenLabs: the Gateway has no zero-retention route for that voice, and the owner chose to keep it on 2026-11-02. The receptionist's reasoning model, Anthropic Claude Haiku 5.5 (anthropic/claude-haiku-5.5), also asks for prompt caching (BRAIN_OPTIONS in the same file). The flag restricts routing to providers that have zero-retention agreements with Vercel; the terms of those agreements, and what each provider keeps under them, are not established here. LiveKit carries audio only; no model request passes through it.
Subprocessor list
| Subprocessor | Purpose | Data categories | Location | Source | Transfer mechanism |
|---|---|---|---|---|---|
| LiveKit Cloud | Configured runtime and media transport for clinic calls and authenticated rehearsals | Live call audio and participant and session metadata; eligible room audio is exported to private Supabase Storage | Production project data region: EU (Frankfurt), CONFIGURED and read back 2026-10-27. STATED 2026-11-02: pinning covers signalling and media only, not SIP traffic or agent compute. Telemetry and logs are stored in the US or Europe | docs/providers/livekit.md "Production project, 2026-10-27"; docs/engineering/voice-runtime.md; docs/adr/0026-single-livekit-cutover.md; research file | STATED 2026-11-02: processor under a DPA that is part of the Terms of Service; SCC Modules 1, 2 and 3, UK Addendum; DPF: commitment only, certification not found. Ten days' notice of subprocessor changes |
| Microsoft (Azure) | Live speech recognition, and the transcript of eligible retained recordings: MAI Transcribe 2 streaming through Vercel AI Gateway | Call audio | STATED 2026-11-02: the streaming model is a preview, listed in US regions, South India and Sweden Central (scope "Global"). No EU-only route documented. Region used by the Gateway: not found | workers/receptionist/mai-stt.ts; src/shared/voice-runtime/model-profile.ts; research file | Microsoft DPA terms and transfer basis: not found. Reached through Vercel, which holds the Azure arrangement. Real-time speech-to-text stores nothing at rest (STATED; preview coverage not found) |
| Anthropic | Live voice reasoning: Claude Haiku 5.5 (anthropic/claude-haiku-5.5) through Vercel AI Gateway, with zero data retention and prompt caching requested. Also optional owner-reviewed website-import suggestions with the same model, pinned to anthropic | Transcript text, system prompt, clinic knowledge and patient tool context; for website import, captured clinic website text and URLs, extraction prompt, and candidate facts returned for owner review | STATED 2026-11-02: inference geography is us or global only; no EU-only option on this route. Which region the Gateway uses for the live brain: not found. How long a cached prompt prefix is held under zero retention: not found | workers/receptionist/models.ts; src/shared/voice-runtime/model-profile.ts; src/shared/voice-runtime/gateway-options.ts; docs/providers/vercel.md "AI Gateway"; src/features/builds/adapters/website-extractor-vercel.ts; research file | STATED 2026-11-02: DPA incorporated into the Commercial Terms; SCC Modules 2 and 3, UK and Swiss addenda; DPF not found. No training on customer content. Binds Vercel as the direct customer, not us. Anthropic's retention pages differ (deletion within 30 days, or not retained by default except for covered models; the model in use is not on the covered list). Vercel's model list marks the model zero-retention on all routes (read 2026-11-02); the terms of that agreement and whether it changes Anthropic's own retention: not found |
| ElevenLabs | Live voice synthesis: elevenlabs/eleven-v4-turbo through Vercel AI Gateway. Also the retired direct runtime and historical artifacts, with an application adapter for exact-ID audio access and deletion | Generated reply text and configured voice; legacy call audio, transcripts and conversation metadata where retained | Live synthesis through the Gateway: standard endpoint presumed, region not found. Direct account storage in the US. VERIFIED: EU, India and Singapore residency is Enterprise only, and our key is refused by the EU endpoint | workers/receptionist/models.ts; workers/receptionist/speech-http.ts; docs/providers/elevenlabs.md opening section, section 7 and "Live findings"; research file | STATED 2026-11-02: processor under its DPA; SCCs and DPF. Default terms allow training on content unless opted out; Zero Retention Mode is Enterprise only. Absent from Vercel's zero-retention and no-training provider tables, so no such guarantee through the Gateway |
| Telnyx | Carrier for the shared assistant number; the configured SIP trunk carries calls to LiveKit. The application also has Telnyx SMS paths | Caller and called numbers, the forwarding line's number carried in the Diversion header (the clinic's own number), call detail records, call audio in transit, SMS recipient numbers and message content | Data at rest: the account's Data Storage Location is Europe, owner-confirmed 2026-11-02. STATED 2026-11-02: the setting covers call and message records, recordings and speech-to-text, is one-way, and does not address media path, signalling or SMS body location (not found) | docs/providers/telnyx.md section 7; docs/ops/telephony.md; src/features/messaging/adapters/telnyx-sms.ts; research file | STATED 2026-11-02: processor for message bodies and recordings, independent controller for call and message records. DPA binding on acceptance; SCCs, UK Addendum, DPF claimed. Notice of subprocessor changes by email; objection within 10 days |
| Cal.com | Clinic calendars, availability and bookings | Attendee name, phone number, appointment time, practitioner and treatment type | STATED 2026-11-02: processed in the United States (database on AWS US); EU residency only on request to Cal.com. Where data migrated from Cal.eu sits: not found. Cal.eu was due to shut down on 2026-11-01 | docs/providers/calcom.md section 10; research file | STATED 2026-11-02: processor for account data; DPA version 2.3 effective 2026-11-01 with SCC Modules 2 and 3 and UK Addendum; DPF claimed. DPA bars health information without a business associate agreement (US concept). Acceptance method: not found |
| Supabase | Database, dashboard sign-in and private storage for eligible call recordings and transcripts | Clinic records, staff email addresses and roles, call records (transcript, summary, masked caller number), private audio recordings, booking requests (caller name, full phone, slot), messages and knowledge versions | eu-central-1 (Frankfurt). CONFIGURED. Free plan has no backups (STATED 2026-11-02; see BIZ-020). Support access, logs and subprocessor locations: not found (subprocessor lists are PDFs, not read) | docs/engineering/voice-runtime.md; docs/handover.md section 6; decision O3 in docs/decision-trail.md; src/composition/patient-recordings.ts; research file | STATED 2026-11-02: processor; DPA accepted with the Agreement (plan limits not stated); SCC Module 2 or 3 and UK Addendum; DPF not mentioned. 30 days' notice of subprocessor changes to subscribers. Training: not found |
| Vercel (hosting and AI Gateway) | Hosts the web application and API routes; AI Gateway routes speech recognition to Microsoft, reasoning and owner-reviewed website import to Anthropic, and voice synthesis to ElevenLabs | Request bodies in transit (tool call parameters and webhook payloads with transcripts), captured website text, call audio for recognition, transcript text, clinic knowledge and tool context for reasoning, speech text for synthesis, request logs | Functions in fra1 (Frankfurt), CONFIGURED. STATED 2026-11-02: the edge and the Gateway front door are not pinned and can process in any Vercel region; the Gateway keeps no prompt or response content, only metadata for 30 days; provider region is a per-request option. Log storage region: not found | docs/providers/vercel.md; docs/ops/deploy.md; docs/engineering/voice-runtime.md; vercel.json; research file | STATED 2026-11-02: processor under its DPA; SCC Modules 1, 2 and 3 and UK IDTA; DPF claimed on its compliance page. No training by the Gateway. Five days to object to a new subprocessor. DPA acceptance method: not found |
| Better Stack | Logs, error tracking and traces | Redacted technical events: ids, counts, durations, the last three digits of phone numbers. No transcripts, summaries, names or email addresses | us_west (US). VERIFIED from the provisioning API response: Germany was refused on our plan. STATED 2026-11-02: Germany is offered per source on its changelog; moving an existing source: not found | docs/engineering/observability.md "Provisioning and region", docs/providers/betterstack.md section 5; research file | STATED 2026-11-02: processor; DPA of 2025-02-25 relying on DPF with SCCs as fallback. Subprocessor list and notice period: not found |
| Resend | Custom SMTP for Supabase sign-in codes and application transactional email, including clinic invitations and permitted patient messages. Setup-request receipts are retired. | Recipient address and the applicable transactional content, such as clinic identity or appointment information; previously sent setup-request receipts may remain retained. | Content and logs stored in the US. Sending region eu-west-1 is configured for the verified domains (read back 2026-10-22). STATED 2026-11-02: the sending region does not change where data is stored | docs/adr/0010-messaging-providers.md; docs/ops/dashboard-sign-in.md; docs/evidence/2026-10-22-auth-and-sending-cutover.md; research file | STATED 2026-11-02: processor; DPA pre-signed at sign-up; SCCs, UK Addendum, DPF claimed. Email and log data kept 30 days. States it cannot sign a business associate agreement. 14 days' notice of subprocessor changes |
The Telnyx row covers the forwarding line's number, which arrives in the Diversion header of a forwarded call and is the clinic's own number. The application keeps only the matched clinic and a pass or fail result, never the raw header.
Retention at each provider is in Offboarding and data export.
Not subprocessors today
- Billing: Autumn and Stripe. Chosen 2026-10-21 (ADR 0008 section 11), built in test mode only: no real clinic is billed and no live key is accepted. They process our own customer account data, not patient data, so they are not subprocessors for call data: Autumn receives the clinic id, clinic name and, per call, the billable minutes, the start time and the voice provider's conversation id; Stripe Checkout collects the clinic's billing identity and payment method directly. Autumn says it is based in the United States and relies on safeguards such as standard contractual clauses (useautumn.com/privacy, read 2026-10-21); where it stores data is UNVERIFIED and, re-checked on 2026-11-02, no DPA, subprocessor list, hosting region or training statement was found (its
/dpapage returned 404; see the research file). Stripe, re-checked the same day: processor for its services and controller for fraud and compliance, DPA incorporated into its services agreement, SCCs and DPF claimed, data may be stored in any country where it does business, no EU-only option found. Stripe's DPA terms are summarised in ADR 0008 section 9, question 7. Before the first live key: a DPA with each, a transfer mechanism, and both added to the Privacy Policy (open item L9). - OpenAI. Not on any clinic call, rehearsal or website-import path. It was the receptionist's reasoning provider until the model profile moved to Anthropic Claude Haiku 5.5 (
src/shared/voice-runtime/model-profile.ts). It stays reachable only in development and in the private Voice Studio: the receptionist evals' judge isopenai/gpt-4.1(workers/receptionist/evals/runner.ts), and the Studio brain list offers OpenAI models for a test (src/shared/voice-runtime/studio-catalog-brains.ts). Both ask the Gateway for zero data retention. If clinic data is ever sent to an OpenAI model, add OpenAI to the list above first. - GitHub. Hosts our source code. It holds no personal data, because the repository contains fictional data only.
Owner decisions the research cannot make
The full list is at the end of the research file. In short:
- Whether health data may go to providers whose only transfer basis is SCCs or a self-declared DPF claim.
- Whether to accept that Vercel, not we, holds the contracts with Microsoft, Anthropic and ElevenLabs.
- What to do about ElevenLabs speech synthesis, which has no zero-retention or no-training guarantee on this route.
- Whether to keep the preview Microsoft recogniser, which has no documented EU-only route.
- Whether any "Frankfurt" or "EU" claim may be made, since the Gateway front door and SIP are not pinned.
- Cal.com, Resend and Better Stack: accept US storage, or ask for or move to an EU option.
This is research for the owner to approve, not legal advice.
How clinics hear about changes
Before we add or replace a subprocessor, or move a subprocessor's data to a new country, we tell each client clinic in advance. The notice period and the objection window are open items (L13). The process is in Policy updates.
Changes from the template
- Replaced the 37signals company processors (newsletter, blog, podcast, shop) with the providers that run the Service.
- Replaced the template's bullet list with a table, because each row needs purpose, data categories, location status, source and transfer mechanism.
- Removed the statement that GDPR-compliant DPAs exist with every processor. None is confirmed here.
- Removed "all located in the United States" and gave the location per provider with VERIFIED, CONFIGURED or UNVERIFIED and its source file.
- Added a "Not subprocessors today" section and the change notice pointer to our policy updates page.
- Distinguished current transactional email from retired setup-request receipts, whose historical records may remain retained.
Adaptado das políticas open source da Basecamp, sob licença CC BY 4.0. Cada documento indica as alterações que fizemos.