Last updated: 2026-10-01.
The following sub-processors may Process Customer Data in the delivery of the Copergrine Platform. The canonical version of this list is published at https://copergrine.com/legal/subprocessors. Copergrine will provide at least thirty (30) days' advance notice of any material addition, via email to the billing contact on file and via the published page.
"EMR" below means the Copergrine EMR platform and every product line that runs on it: Telehealth, Home Health, and Therapy & Behavioral Health. "Courier" is the Copergrine medical courier service. "Clinic" is the Copergrine Health & Wellness clinic. A location of "Not yet confirmed" means Copergrine has not yet confirmed where that vendor stores or processes the data; it is not a statement that the data is outside the United States.
Current sub-processors
| # | Sub-processor | Purpose | Data categories | Location | Used by |
|---|---|---|---|---|---|
| 1 | Hostinger International Ltd. | Production server hosting: application, database, and uploaded files | All Customer Data, including PHI | Not yet confirmed | EMR, Courier, Clinic |
| 2 | Backblaze, Inc. (B2 Cloud Storage) | Off-site backups | Database backups, point-in-time-recovery archives, and uploaded-file backups, including PHI | United States (US East region, us-east-005) | EMR, Courier |
| 3 | Google LLC (Google Workspace) | Email delivery and Copergrine mailboxes, including the inbound mailbox for Direct secure messages | Email addresses, email content, and attachments, including encrypted visit documents | Not yet confirmed | EMR, Courier |
| 4 | Google LLC (Google Maps Platform) | Address geocoding, maps, and pharmacy search | Street address, city, state, and ZIP code; pharmacy search text. No name, date of birth, record number, or clinical information is sent | Not yet confirmed | EMR, Courier |
| 5 | Anthropic, PBC | AI model inference for clinician-reviewed drafts: scribe notes, treatment-plan drafts, imaging summaries, and coding suggestions | Visit transcripts, clinical note text, and report text | United States. Requests carrying clinical data are restricted to US-only inference, and a response reported as processed elsewhere is refused | EMR |
| 6 | Deepgram, Inc. | Speech-to-text for the ambient scribe | Visit audio and transcripts | Not yet confirmed | EMR |
| 7 | LiveKit, Inc. | Video and audio for telehealth visits | Real-time audio and video of visits. Copergrine does not start recordings | Not yet confirmed | EMR |
| 8 | Stedi, Inc. | Healthcare clearinghouse: eligibility checks (270/271), claims and remittance (837/835), and payer enrollment | Patient demographics, insurance member IDs, coverage details, claim content (diagnosis and procedure codes, charges), and provider identifiers | Not yet confirmed | EMR |
| 9 | Twilio Inc. | SMS notifications and voice calls | Phone numbers, notification text, and call routing data | Not yet confirmed | EMR, Courier |
| 10 | Stripe, Inc. | Payment processing | Payer name, email, and billing details; card data (tokenized by Stripe); payment amounts | Not yet confirmed | EMR, Courier, Clinic |
| 11 | ElevenLabs | AI voice agent that answers and places Copergrine phone calls | Caller phone number and name, call audio, transcripts, call summaries, and the order or booking details a caller provides | Not yet confirmed | Courier, Clinic |
Advance notice: planned sub-processors
The sub-processors below are not yet Processing Customer Data. They are listed here as advance notice. Copergrine will not route Customer Data to a planned sub-processor until at least thirty (30) days after the date it was first listed.
| # | Sub-processor | Purpose | Data categories | Location | Used by | First listed |
|---|---|---|---|---|---|---|
| 1 | DxWeb Management LLC (DxScript) | Electronic prescribing: sending prescriptions to pharmacies and receiving refill requests | Patient demographics, prescriptions and medication history, prescriber identifiers, and the patient's pharmacy | Not yet confirmed | EMR | 2026-10-01 |
Notice of changes
This list implements the following commitments.
Business Associate Agreement, Section 4.2: A current list of subcontractors is published at https://copergrine.com/legal/subprocessors. Business Associate will provide Covered Entity at least thirty (30) days' advance notice of any new subcontractor materially processing PHI; Covered Entity may object in good faith on reasonable grounds and terminate the affected services if the objection is not resolved.
Master Subscription Agreement, Section 5.4: A current list is maintained at https://copergrine.com/legal/subprocessors. Copergrine will provide at least thirty (30) days' notice of any new Sub-processor materially processing Customer Data; Customer may object in good faith on reasonable security or privacy grounds, in which case the Parties will cooperate in good faith to resolve the objection, and, failing resolution within thirty (30) days, Customer may terminate the affected Services for convenience.
Changes in this version
- Added: Backblaze (backups), Google Maps Platform, LiveKit, Stedi, and ElevenLabs, which were already in use but missing from the previous list.
- Added as advance notice: DxWeb Management LLC (DxScript), for electronic prescribing.
- Removed: Amazon Web Services. Backups are stored with Backblaze, not AWS.
- Removed: OpenAI, LLC. Copergrine does not send Customer Data to OpenAI.
- Removed: Twilio SendGrid. Email is sent through Google Workspace.
- Removed: Dokploy s.r.o. The deployment tool runs on Copergrine's own server, and the vendor receives no Customer Data.
- Removed: Cloudflare, Inc. Copergrine does not use Cloudflare.
- Corrected: locations that had not been confirmed (Hostinger, Deepgram, and others) now say "Not yet confirmed".
This list reflects the vendors relied upon as of the VERSION date and is reviewed at minimum quarterly.