To the Tarsi Inc. Data Processing and ESP/Agent Agreement · Version 1.0 · Effective June 15, 2026
| # | Sub-processor | Entity & country | Function | Data category processed | Cross-border transfer basis |
|---|---|---|---|---|---|
| 1 | Supabase | Supabase, Inc. (U.S.); data hosted in Canada — AWS ca-central-1 | Primary database and file storage (clinical records, photos, signatures) | All platform data, including PHI | Stored data resides in Canada; no cross-border storage. Sub-processor agreement governs the U.S. corporate relationship. |
| 2 | Cloudflare | Cloudflare, Inc. (U.S.) | Application hosting, CDN, edge delivery | In-transit platform traffic; no PHI stored at rest at the edge | Written data-processing agreement; PIPEDA accountability (Principle 4.1.3); Law 25 s. 17 assessment (Schedule D). |
| 3 | Stripe | Stripe, Inc. (U.S.) | Card payment processing and subscriptions | Patient/operator name, email, payment-method tokens, transaction amounts | DPA + PIPEDA accountability + Law 25 s. 17 assessment. |
| 4 | Clover | Clover Network, LLC / Fiserv, Inc. (U.S.) | In-person payment terminals | Patient name, transaction and line-item descriptions, last-4 of card | DPA + PIPEDA accountability + Law 25 s. 17 assessment. |
| 5 | Rotessa | Rotessa Inc. (Canada) | Operator subscription billing only (pre-authorized debit) | Clinic/operator legal name, email, banking authorization — no patient PHI | Stored and processed in Canada; no cross-border transfer. |
| 6 | Resend | Resend (U.S.) | Transactional and marketing email delivery | Recipient email and name; message content (may include treatment/service names) | DPA + PIPEDA accountability + Law 25 s. 17 assessment. |
| 7 | Telnyx | Telnyx LLC (U.S.) | SMS delivery | Recipient phone number; message content (clinical detail excluded by design) | DPA + PIPEDA accountability + Law 25 s. 17 assessment. |
| 8 | Anthropic | Anthropic, PBC (U.S.) | AI assistance for clinical documentation | Chart text; clinical context (allergies, conditions); raw consultation transcripts; patient names; message bodies; treatment names | DPA + PIPEDA accountability + Law 25 s. 17 assessment; BAA/ZDR to be executed (Schedule C). |
| 9 | OpenAI | OpenAI, L.L.C. (U.S.) | AI audio transcription for clinical note assistance (Whisper API) | Consultation audio submitted for transcription | DPA + PIPEDA accountability + Law 25 s. 17 assessment; ZDR/BAA to be executed (Schedule C). |
| 10 | ipify | ipify (U.S.) | IP-address capture at consent signing | IP address | DPA + PIPEDA accountability + Law 25 s. 17 assessment. |
| 11 | Google / Firecrawl | Google LLC; Firecrawl, Inc. (U.S.) | Clinic-onboarding website extraction | Public business website data only — no PHI | DPA + PIPEDA accountability + Law 25 s. 17 assessment. |
Notice of change. Tarsi will give the Operator at least 30 days' advance written notice before adding or replacing any sub-processor, during which the Operator may object. The current list is maintained at all times and provided on request to privacy@tarsi.ca.