Subprocessors
Current as of 1 October 2026
To operate Patient Care Circle we rely on a small number of vetted third-party services ("subprocessors"). We keep the list short on purpose and route document bytes through our own servers rather than exposing storage directly. The table below shows what each provider does and the data it processes.
| Subprocessor | Purpose | Data processed | Region | Agreement |
|---|---|---|---|---|
| Neon | Managed PostgreSQL database hosting | Account & consent records, document metadata, encrypted message bodies | United States | Signed |
| PSS Document Service → DigitalOcean Spaces | Document file storage (bytes routed through our server) | Uploaded document contents | United States | Executed |
| Amazon SES (AWS) | Transactional email delivery | Recipient email addresses & non-clinical notifications (no PHI in message bodies) | United States | Executed (AWS BAA) |
| Stripe | Subscription billing & payments | Billing/account data only — never PHI | United States | Not required |
Business Associate Agreements
Every subprocessor that may handle protected health information maintains an executed Business Associate Agreement (BAA) with us before any such data flows to them. Stripe handles billing data only and never receives PHI, so no BAA is required there. See our Business Associate Agreement page for details.
Changes
We'll update this page when we add or replace a subprocessor. To be notified of changes, or to ask a question, contact privacy@patientcarecircle.com.