Draft template — not legal advice. This document must be reviewed, customized, and finalized by qualified legal counsel before it is published or relied upon.

Sub-processors

Last updated: September 30, 2026

These are the providers that process data for DentalX as the Service is built today. Each one receives only what its purpose needs. When a provider is added or changes what it receives, this page changes with it.

ProviderPurposeDataWhere
Google Cloud / FirebaseHosting, database, file storage, sign-in and server functionsAll Customer Data, including patient health informationCovered by the Google Cloud Business Associate Agreement.United States (Firestore nam5 multi-region; functions us-central1)
Google Vertex AI (Gemini)The AI assistant, notes, summaries and scans a clinic chooses to useThe text, image or document sent with each AI requestCovered by the Google Cloud Business Associate Agreement. Radiograph analysis is off for United States clinics.Google Cloud
Google Workspace (Gmail)Reminders, recall notices, consent links, prescriptions and treatment plans sent by emailPatient email address and the message sentGoogle
Meta (WhatsApp Business Platform)Reminders and replies over WhatsApp, where a clinic turns them onPatient phone number and the message sent or receivedNot used for clinics in the United States.Meta
Google CalendarAppointment sync, only for a clinic that connects its own calendarAppointment time, treatment, dentist and patient nameNo phone numbers or clinical notes.Google
StripeClinic subscriptions and paymentsThe clinic's billing details; no patient dataStripe