Our Subprocessors
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Managed PostgreSQL database hosting Aptux records. | Account, clinic, patient, clinical, billing, and authentication records. | Canada (Central), ca-central-1, as configured by Aptux. |
| Vercel | Application hosting and server-side functions for the Aptux platform. | Information submitted to or generated by the Services that is processed to operate them. | Server-side functions that process health information in Montréal, Canada (yul1), as configured by Aptux. Public static assets containing no health information may be served over Vercel's global network. |
| Google Cloud (Vertex AI) | AI-assisted features such as drafting, summarization, and transcription, used only when an authorized user invokes them. | The prompt and clinical context needed for the requested feature, which may include clinical information. | Montréal, Canada (northamerica-northeast1), using only Google models that support Canadian processing. Aptux does not use the global endpoint for health information. |
| Amazon Web Services (S3) | Storage of patient documents uploaded to Aptux, and Aptux-controlled encrypted database backups. | Uploaded documents and object metadata; encrypted backup copies. | Canada (Central), ca-central-1, as configured by Aptux. |
| Resend | Delivery of transactional email such as invitations, verification and password-reset messages, intake links, follow-ups, invoices, and exercise programs. | Recipient address, message content, links, and attachments included in the message. | Region as configured by Aptux. |
| Stripe | Payment processing for clinic invoices through connected clinic accounts, hosted checkout pages, and payment webhooks. | Payer email, invoice number and amount, transaction metadata, and payment details entered on Stripe-hosted pages. Stripe does not receive clinical notes, diagnoses, treatment details, patient documents, or health numbers. | International processing, potentially including the United States, as described in Stripe's terms and privacy materials. |
| Grafana Cloud | Operational monitoring — platform metrics and traces used to run and troubleshoot the service. | Operational measurements and trace attributes after filtering. Aptux does not intentionally send patient names, health numbers, clinical text, documents, or authentication secrets. | Canadian stack on AWS ca-central-1, as configured by Aptux. |
| Google (Places API) | Address and business-name autocomplete during clinic onboarding. | The address or business text typed into the search field. | Region as configured by Aptux. |
| Let's Encrypt | TLS certificates that secure connections to aptux.ca. | Domain and certificate-management metadata only. | N/A. |
Notes on This List
Authentication is performed by Aptux itself using self-hosted software — there is no third-party authentication provider. Development and test systems (such as local databases, storage, and monitoring) are self-hosted and are not included here.
Changes to This List
Before Aptux materially changes a subprocessor that will manage health information, we will provide reasonable information and notice so clinics can assess the change, consistent with our Information Manager Agreement. If a clinic reasonably objects on privacy or security grounds, we will work in good faith on a practical alternative. Clinics should check this page periodically for updates.