Subprocessors and Hosting
Effective date: October 7, 2026
This table describes the current beta architecture and the planned hosting change. A provider's country is a processing or access disclosure, not a promise that every byte is stored there. Exact service regions and support-access locations for Convex and Stream are still being verified; the beta should be treated as involving transfers outside Canada and Québec.
| Provider | Purpose | Data categories potentially processed | Country or region status |
|---|---|---|---|
| Vercel | Current Next.js web application hosting and delivery | IP address, request metadata, cookies or session data, and content passed through web requests | Current US-hosted beta service; exact regions and support access require confirmation. Planned replacement: Canadian sovereign VPS. |
| Convex | Current application backend, authentication, and database | Accounts, practice and client profiles, appointments, messages, clinical records, files or references, invoices, and audit data | Current externally hosted beta backend with potential US processing; exact region and access require confirmation. Planned replacement: self-hosted Convex on a Canadian sovereign VPS, preferably Québec. |
| Stream | Video calls and call signalling | Participant identifiers, call metadata, audio/video streams, and related tokens | Processing and support locations require confirmation; treat as a transfer outside Canada until verified. |
| Resend | Transactional account and service email | Email address, delivery metadata, and the content of service emails; clinical detail should not be placed in email | US-based provider; delivery infrastructure and recipient mail systems may process elsewhere. |
| Expo | Mobile build, update, and push-notification services where enabled | Device push token, app/device metadata, and notification content | Processing location requires confirmation; treat as a transfer outside Canada. Avoid clinical detail in push notifications. |
| Sentry | Error and crash reporting for the web application, backend, and mobile app, where enabled | The error's type, an automatically redacted message (email addresses, phone numbers, long numbers, tokens, and record IDs removed) and stack trace; the app release; browser or operating system name and version; and the page path (record IDs masked) or screen name. Mobile app crash reports also carry device details (model, manufacturer, operating system build, memory, storage, and screen) and a random per-installation identifier that is not linked to the account; that identifier and the device's language and time zone are removed when Sentry receives the report. IP addresses are not stored. Reports are not meant to contain names, account details, or clinical content. | US-based provider; reports are processed and stored in Sentry's US data region. |
| OpenAI — separate opt-in only | Optional AI feature, if explicitly enabled by the Practice and client | Submitted prompt and any text the user chooses to send, which could include journal or health information | US processing may occur. The existing code contains OpenAI calls; opt-in gating for the practice product is not yet verified. Do not use the AI feature with clinical data until that gate and notice are in place. |
The planned Canadian VPS migration has not been completed or verified in the current beta. It will change the first two rows only after deployment and data-location checks; third-party video, email, push, error-reporting, and optional AI services must be assessed separately. Changes to this list will be posted with notice under the DPA. For questions, contact Nicholas Ponari, Data Privacy Officer, at nicholas@ponari.ca or 5150 Rue Buchan, Montréal, Québec H4P 0A9, Canada.