Vendor transparency
A status-aware subprocessor register.
A vendor’s appearance here does not mean it is approved to process PHI. Professional-service approval requires deployment-specific review.
Current register
The structured table below distinguishes verified consumer-service use from professional-service approval.
| Provider | Purpose | Data categories | Processing location | Contract status | Last reviewed |
|---|---|---|---|---|---|
| Supabase | Consumer app backend and authentication | Consumer account and app data | UNKNOWN — requires verification | Consumer use verified; PHI approval unknown | 2026-07-28 |
| Apple | App distribution, purchases and push delivery | Store, purchase and device delivery data | Provider dependent | No professional-service PHI approval asserted | 2026-07-28 |
| RevenueCat | Consumer subscription entitlements | Purchase entitlement data | UNKNOWN — requires verification | Not approved for professional-service PHI | 2026-07-28 |
| Expo | Consumer app build and notification delivery | Build and device notification data | UNKNOWN — requires verification | Not approved for professional-service PHI | 2026-07-28 |