Sub-processors

    The vendors Theraflow uses to deliver the service. Each meets contractual security and confidentiality standards, and customer admins are emailed before a new one that touches Customer Data goes live.

    Last reviewed 7 September 2026

    • Amazon Web Services (AWS)
      Core service
      Purpose
      Cloud hosting: compute and a dedicated encrypted database (EC2), object storage (S3), email (SES)
      Data accessed
      All Customer Data at rest
      Location
      Mumbai, India (ap-south-1)
    • Clerk
      Core service
      Purpose
      Authentication and user identity (login, MFA, session management)
      Data accessed
      Staff user identifiers (name, email, password hashes)
      Location
      United States
    • Anthropic (Claude API)
      Opt-in
      Purpose
      AI features: scheduling suggestions, report generation, clinical reasoning
      Data accessed
      Only when AI features are enabled. Limited context per request; never used to train models.
      Location
      United States
    • Google AI (Gemini API)
      Opt-in
      Purpose
      AI features: alternative provider for scheduling and report generation
      Data accessed
      Only when AI features are enabled. Limited context per request; never used to train models.
      Location
      United States
    • Razorpay
      Core service
      Purpose
      Payment processing for Theraflow subscriptions and (where used) parent payment collection
      Data accessed
      Billing contact, amount, invoice metadata. No patient clinical data.
      Location
      Bangalore, India
    • Meta Platforms (WhatsApp Business Platform)
      Opt-in
      Purpose
      Transactional messaging on behalf of customer centres: appointment confirmations, reminders, receipts and package alerts sent from the centre's own WhatsApp Business number
      Data accessed
      Only when the centre connects its WhatsApp Business Account. Recipient phone number and the message content the centre sends. No clinical notes, diagnosis or goals.
      Location
      United States / Meta global infrastructure
    • Nango
      Opt-in
      Purpose
      Third-party connector framework (for integrations the centre opts into, e.g. Google Drive)
      Data accessed
      Only data flowing through integrations the centre explicitly connects
      Location
      United States / European Union

    Adding new sub-processors

    We notify centre admins by email at least 30 days before any new sub-processor that handles Customer Data goes live. Customers may object during that window; if we cannot accommodate, we will work with you on transition options up to and including termination with a pro-rated refund.

    Questions about sub-processors? Email founders@theraflow.in.