- Home
- Legal
Subprocessors
Third parties that process data on our behalf, by category and purpose. Any subprocessor that touches protected health information is bound by a Business Associate Agreement before it receives any.
1. How we use subprocessors
We engage third parties to provide infrastructure and services that would be impractical to build ourselves. Each is bound by written terms that require confidentiality, appropriate security, and processing only on our documented instructions.
Any subprocessor that may access protected health information executes a Business Associate Agreement before it receives any. Subprocessors that never touch PHI are not given access to it.
2. Categories in use
| Category | Purpose | PHI access |
|---|---|---|
| Cloud hosting and compute | Running the platform and storing data | Yes, under BAA |
| Database and storage | Patient records, orders, configuration | Yes, under BAA |
| Payment processing | Billing infrastructure. Patient card data settles into the Client's own account, not ours | Limited, under BAA |
| Transactional email and SMS | Order, shipping and clinical notifications | Yes, under BAA |
| Error monitoring and logging | Availability and defect diagnosis | Restricted and scrubbed |
| Product analytics | Aggregate platform usage | No |
| Marketing and CRM | Business contacts only, never patients | No |
| Customer support tooling | Handling Client requests | Restricted, under BAA |
The named vendors within each category are provided to customers on request and are listed in the Business Associate Agreement package. Enterprise customers receive the full named list as part of security review.
3. Independent providers and pharmacies
Licensed clinicians and compounding pharmacies in your network are not our subprocessors. They are independent covered entities or their business associates, providing care and dispensing under their own licences and their own legal obligations. Information reaches them because delivering the care requires it, not because we have delegated processing to them.
4. Changes
We will give customers advance notice before adding a subprocessor that will have access to protected health information, so that any objection rights in your agreement can be exercised. Notice is given by email to the contact on your account.
To request the current named list, or to raise an objection, write to support@pharmabro.co.