Subprocessors
Last updated August 10, 2026
These are the only companies that may handle information on our behalf. We keep this list short deliberately, and we will notify practices before adding to it.
A subprocessor is a vendor we use to operate MyWholeFile MD. Every vendor that may handle protected health information is bound by a Business Associate Agreement. Vendors that cannot or will not sign one are not used for anything touching health information.
Current subprocessors
| Vendor | Purpose | Handles PHI | Agreement |
|---|---|---|---|
| Amazon Web ServicesUnited States | Application hosting, database, encrypted storage, key management | Yes | AWS Business Associate Addendum; HIPAA-eligible services only |
| Amazon Simple Email ServiceUnited States | Transactional email: verification, export links, notifications | No | Covered by the AWS Business Associate Addendum. No clinical content is placed in email. |
| Auth0 (Okta, Inc.)United States | Patient sign-in, multi-factor authentication, and authorization of AI assistants | No | Business Associate Agreement required before any patient other than the founder is enrolled. No clinical information is stored in identity profiles. |
What is deliberately absent
We use no analytics, advertising, session-replay, error tracking, customer messaging, or A/B testing vendor anywhere in the application, the API, or the assistant connection. The public marketing site may use privacy-preserving, cookieless measurement; nothing in that measurement touches health information, and none of it runs where records are handled.
We do not use a third-party AI provider to process your records on our own initiative. AI providers receive your information only when you connect one yourself, which is a disclosure you make rather than a subprocessor we engage. See our AI sharing disclosure.
Data sources
These are the systems your records come from. They are not acting on our behalf and are not subprocessors, but you should know which ones are involved.
- Practice Fusion / Veradigm. Electronic health record system of participating practices. Records are retrieved read-only after the patient authorizes access.
Changes to this list
We will update this page and notify participating practices before a new subprocessor begins handling protected health information, so that a practice has the opportunity to object under its Business Associate Agreement with us.
Questions: privacy@mywholefilemd.com.