Subprocessors
Vendors that handle practice or patient data to run DARO. Version 2026-10-14.
How this list works
Each vendor below processes data only to provide DARO. Vendors that handle protected health information must have a signed Business Associate Agreement before a practice enters real patient information. Customers are notified at least 30 days before a new subprocessor is added.
| Vendor | Purpose | Data | Location | BAA |
|---|---|---|---|---|
| Managed cloud platform (Postgres database and file storage on AWS) | Application hosting, database, file storage, authentication | All practice and patient data | United States | No BAA signed yet — DARO holds demonstration and trial data only; real patient data is not accepted until DARO moves to HIPAA-covered hosting under a signed BAA |
| Cloudflare | Application delivery and server runtime | Data in transit | Global edge, US origin | Required before production PHI |
| Managed AI gateway (Google Gemini, OpenAI models) | Ambient note drafting, transcription, clinical organization | Visit audio transcripts and draft notes | United States | Required before production PHI |
| Stripe | Subscription billing and patient card payments | Payment details, patient name, amounts | United States | Payment processing exemption; confirm with counsel |
| Resend | Email reminders, invitations, statements | Patient name, email, appointment times | United States | Required before production PHI |
| Twilio | Text reminders and voice calls | Patient name, phone, appointment times | United States | Required before production PHI |