Subencargados y proveedores de servicios
En vigor desde 4 de julio de 2026 · Operado por Kureon Health · [email protected]
Esta página se ofrece por transparencia. No es asesoría legal y está en revisión por abogados; la redacción puede ajustarse.
This page lists every third party that processes data on our behalf, what it touches, and the safeguard that covers it. Version 1.5, published 24 October 2026.
1. Subprocessors
| Name | Location | Purpose | Data touched | Safeguard | BAA or DPA |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Germany (EU), Falkenstein data center | Hosting of the entire Service and database | All service data, encrypted in transit | EU hosting. The server and database stay in Germany; AI features send content to the US providers below | Hetzner’s standard terms; whether its data processing agreement (GDPR Art. 28) has been concluded for our account is being confirmed. No BAA |
| Anthropic | United States | AI text features: summaries, explanations, drafts | Health text you submit to an AI feature, under your AI features consent | Reached through the Claude command-line tool on our server under a Claude subscription account, not the Anthropic commercial API under a negotiated agreement | No BAA and no negotiated data processing agreement; clinic AI features that would use it are switched off |
| Modal | United States | GPU compute for imaging AI reads, including our private MedGemma 27B deployment | Medical images and photos you submit to an AI feature, with your consent, and, with your AI consent, uploaded images, which MedGemma reads automatically to sort and file them | Standard self-serve terms today; a signed data processing agreement is planned | No BAA and no signed data processing agreement |
| ElevenLabs | United States | Voice concierge calls (speech synthesis and calling) | Call audio and transcripts for calls you initiate | Standard self-serve terms today; a signed data processing agreement is planned | No BAA and no signed data processing agreement; clinic voice calls are switched off |
| Resend | United States | Transactional email (alerts, digests, notifications) | Your email address and notification content | Minimal health detail in emails. Transfer safeguard (data processing agreement with Standard Contractual Clauses) being confirmed | Resend’s standard terms; our acceptance of a data processing agreement is being confirmed. No BAA |
| Consensus | United States | Scientific evidence search backing some AI answers | Search queries only; no health records and no identifiers | No personal health information sent | Standard terms. No BAA (no health information is sent) |
| UptimeRobot | Malta / EU | Uptime monitoring | Pings to our public health endpoint only; no user data | No personal data sent | Standard terms. No BAA (no personal data is sent) |
| Cloudflare | United States / global edge | Network security and delivery for the whole site (proxy, TLS and attack protection, since 3 November 2026), and inbound mail routing for claim email tracking (Email Routing + Email Worker) | All traffic to and from the site passes through Cloudflare in encrypted form and is decrypted at its edge, including pages you view, files you upload and share links. Insurance claim and EOB emails you forward to your private inbox, only with your consent | Encrypted in transit to and from Cloudflare; pages with health data are marked not to be cached. Mail is a transient relay, not stored. Transfer safeguard (data processing agreement with Standard Contractual Clauses) being confirmed | Cloudflare’s standard terms; our acceptance of a data processing agreement is being confirmed. No BAA |
| Google (Google Drive) | United States | Off-site storage for encrypted backups | Backup files encrypted on our server before upload (rclone crypt); Google stores only ciphertext | Client-side encryption; Google never holds the encryption key or readable data | Standard terms. No BAA (ciphertext only) |
| Fasten Health (Fasten Connect) | United States | Retrieving your records from US health networks (TEFCA Individual Access Services) when you ask for them | Test mode only today: no real records pass through it. Once live, the records you request and the identity details the networks need | Only at your direction; live use needs a separate approval and will be announced here 30 days ahead | No BAA and no signed data processing agreement (test mode only) |
For provider-portal workloads, where we act as a HIPAA business associate to a clinic, hosting, storage, visit transcription and record search stay on our own server in Germany. AI features in the portal, such as scribe, coding and appeal drafts, would send content to Anthropic in the United States. We do not yet have a business associate agreement with Anthropic, Modal or ElevenLabs, so those clinic AI features are switched off until a BAA-covered AI provider is in place. When a vendor BAA is signed, the table above will note it for that vendor.
Twilio (United States) text messaging exists in our code but is switched off and receives no data. It is not a current subprocessor; we will list it here at least 30 days before switching it on.
The "Learn more" reading links on conditions, lab results and medicines come from MedlinePlus Connect, a free public service of the U.S. National Library of Medicine. It is not a subprocessor because it receives no personal data: our server sends it only a standard medical code (such as an ICD-10 or LOINC code) and the page language, never your name, your results or anything that identifies you, and the request comes from our server rather than your browser.
2. Self-hosted AI models
Wherever possible we process health data on our own server instead of sending it to third parties. Audio transcription (Whisper) runs self-hosted on our own EU server, so no third party receives that audio. The default medical imaging model (MedGemma 27B) is not self-hosted: it runs on a private deployment at Modal (listed above), so Modal processes the images it reads.
3. Sources you connect (not subprocessors)
These services send us your data at your direction when you connect them. They are data sources acting on your instruction, not processors working for us, and you can disconnect any of them at any time:
- WHOOP and Oura (wearable metrics you authorize).
- CUF / MyCUF (hospital portal records you connect).
- PocketHealth (imaging records you connect).
- Electronic health record systems via SMART on FHIR (records you pull from your providers).
4. Changes to this list
Before adding a new subprocessor that will touch health data, we will update this page at least 30 days in advance. Each update increments the version number and date at the top of this page. If you object to a new subprocessor, you can decline or withdraw the consent that powers the relevant feature, or delete your account, before the change takes effect.
5. What we are putting in place with every subprocessor
We do not yet have a signed data processing agreement with Anthropic, Modal or ElevenLabs; they are used under their standard terms today. For Resend and Cloudflare, whether a data processing agreement with Standard Contractual Clauses has been accepted for our account is being confirmed; for Hetzner (hosting in Germany), whether its data processing agreement has been concluded is being confirmed. The agreements we are working toward require:
- Use of data only to provide the contracted service to us, never for their own purposes.
- No sale of data and no use for advertising or model training on your content.
- Confidentiality, security measures, and deletion on termination.
- Standard Contractual Clauses for transfers from the EU to the United States.
Questions: [email protected].