What this list covers
This page lists each provider that processes data on NOWAITN's behalf in the hosted NOWAITN platform: what it does, the category of data it receives, and where it operates. It is Exhibit B to the Data Access and Boundary Agreement, and it is the list that the Business Associate Agreement refers to.
Protected health information
No sub-processor on this list receives Clinical Data or protected health information (PHI). Sub-processors receive only de-identified, tokenized or non-clinical operational data. If that ever changes for a sub-processor, NOWAITN first puts in place the written subcontractor terms that the Business Associate Agreement requires.
Current sub-processors
- Provider
- Google LLC (Google Workspace)
- What it does
- Business email, document collaboration and internal operations.
- Data it receives
- Business correspondence and operational documents, and the contact details of a customer's business (not patient) contacts. No Clinical Data or PHI.
- Location
- United States
- Provider
- Mailgun Technologies, Inc. (a Sinch company)
- What it does
- Transactional and operational email delivery.
- Data it receives
- Recipient email addresses and non-clinical message content only.
- Location
- United States
- Provider
- Anthropic, PBC
- What it does
- AI features of the hosted services: text generation, classification and assistance.
- Data it receives
- De-identified, tokenized or generic prompts and operational text only. Never Clinical Data or PHI. Customer data is not used to train models.
- Location
- United States
- Provider
- Stripe, Inc.
- What it does
- Payment processing, connected-account settlement and payouts.
- Data it receives
- Source-reference tokens, amounts, currency, timestamps and transaction status. Cardholder data goes from the payer's browser directly to Stripe and never through NOWAITN systems.
- Location
- United States
- Provider
- Amazon Web Services, Inc.
- What it does
- Hosting, databases, file storage and backups for the hosted platform.
- Data it receives
- The data the hosted platform stores for a customer's account, encrypted at rest. No Clinical Data or PHI.
- Location
- United States
- Provider
- Twilio Inc.
- What it does
- Text message delivery.
- Data it receives
- Recipient phone numbers and non-clinical message text only.
- Location
- United States
- Provider
- OpenAI, L.L.C.
- What it does
- Text embeddings that power search across a customer's own content.
- Data it receives
- Generic operational text only. Never Clinical Data or PHI.
- Location
- United States
How changes are announced
NOWAITN updates this page, and gives each affected customer at least 30 days' written notice by email to the customer's designated contact, before it adds a sub-processor or materially changes what an existing sub-processor does or receives. This applies when the change affects data connected to that customer's account.
A customer may object in writing, as the Data Access and Boundary Agreement provides.
Removing a sub-processor, or reducing what one receives, takes effect when this page is updated, without advance notice.
Each revision has a new version number and date. NOWAITN keeps earlier versions for at least 6 years.