Subprocessors
Vendors that handle practice or patient data to run DARO. Version 2026-09-26.
How this list works
Each vendor below processes data only to provide DARO. Vendors that handle protected health information must have a signed Business Associate Agreement before a practice enters real patient information. Customers are notified at least 30 days before a new subprocessor is added.
| Vendor | Purpose | Data | Location | BAA |
|---|---|---|---|---|
| Lovable Cloud (Supabase, on AWS) | Application hosting, database, file storage, authentication | All practice and patient data | United States | Required before production PHI |
| Cloudflare | Application delivery and server runtime | Data in transit | Global edge, US origin | Required before production PHI |
| Lovable AI Gateway (Google Gemini, OpenAI models) | Ambient note drafting, transcription, clinical organization | Visit audio transcripts and draft notes | United States | Required before production PHI |
| Stripe | Subscription billing and patient card payments | Payment details, patient name, amounts | United States | Payment processing exemption; confirm with counsel |
| Resend | Email reminders, invitations, statements | Patient name, email, appointment times | United States | Required before production PHI |
| Twilio | Text reminders and voice calls | Patient name, phone, appointment times | United States | Required before production PHI |