Sub-processors
VeinFusion uses the following sub-processors to operate the Platform. Each is bound by contract to process data only for the purposes below, and vendors that touch protected health information operate under a business associate agreement (BAA).
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Google Cloud Platform / Firebase (Google LLC) | Cloud infrastructure: database (Firestore Enterprise), API hosting (Cloud Run), authentication (Identity Platform), file storage, web hosting. Also abuse prevention (reCAPTCHA Enterprise) on sign-in, payment and public forms — a distinct purpose from hosting, listed separately here because it processes how a page is used rather than what you submit | All platform data, including PHI (under BAA) | United States (us-central1) |
| Anthropic PBC | AI assistance for platform operations (e.g., pricing-desk copilot, documentation tooling) via a controlled gateway with PHI minimization | Operational text with PHI minimized before processing | United States |
| Twilio Inc. | Masked messaging and calling between patients, nurses, and care teams; SMS notifications | Phone numbers (masked routing), message metadata | United States |
| TranzPay | Payment processing: pharmacy billing and nurse payouts | Payment and payout account details, transaction records | United States |
| Resend, Inc. | Transactional email delivery (contact-form routing, account notifications) | Email addresses, message content you submit | United States |
| Apple Inc. / Google LLC (app stores) | Distribution of the mobile apps; push notification delivery | Device tokens, app diagnostics per their terms | United States |
Questions
For sub-processor questions or to be notified of changes, contact privacy@veinfusion.com.