Legal
Subprocessors
Every third party that can touch customer data, what it does, and whether it can reach protected health information.
Draft — not yet reviewed by counsel. It states accurately what the platform does today, but it has not been reviewed by healthcare counsel and is not yet in force. Do not rely on it, and do not publish it, until that review is complete.
1.Current subprocessors
A short list, and deliberately so. Every entry is one more organisation a customer's security review has to accept.
| Subprocessor | Purpose · PHI access |
|---|---|
| Railway Corp. United States |
Application hosting, compute and persistent storage. Can access PHI as the infrastructure the platform runs on. NEEDS DECISION A business associate agreement with the hosting provider is a P0 blocker before any real patient data is loaded. |
| Resend, Inc. United States (AWS us-east-1) |
Transactional email: sends the platform's notifications (application confirmations, offer links, operational alerts) and receives mail addressed to @revitics.com, which is forwarded to a monitored inbox. Processes the content of those emails — names, email addresses and whatever a sender writes. The platform never emails protected health information; claim data, exhibits and appeal packages are delivered inside the application only. |
| Google Fonts Marketing site only |
Serves the typeface on this website. No PHI access. Receives the IP address of a visitor's browser. Not used by the platform. |
2.What is deliberately absent
Worth stating explicitly, because the absences are the point:
- No AI model vendor. The platform's default provider is rule-based and runs in-process. No customer data is sent to any external model.
- No analytics or telemetry vendor. Neither the site nor the platform sends usage data anywhere.
- No SMS provider. Email runs through Resend (listed above); nothing else touches a message.
- No offshore processing. There is no offshore operations team.
If any of this changes, this page changes first and affected customers are notified before the subprocessor begins processing — not after.
3.Change notice
NEEDS DECISION The notice period for adding a subprocessor, and a customer's right to object, belong in the data processing addendum. Thirty days is common. Counsel should set it and the agreement should match this page.
Questions about this document: · All policies