Subprocessors
These are every company that processes data on our behalf. They act only on our instructions, under contract, and none of them may use your data for their own purposes such as advertising or training their own models. This list is the one referenced by our clinic agreements and business associate agreements.
1. The list
| Provider | What it does for us | Health data? |
|---|---|---|
| Amazon Web Services | Database, sign-in infrastructure, and transactional email such as guardian-consent links and clinician alerts | Yes |
| Cloudflare | Application server and meal-photo storage | Yes |
| OpenAI | Chat responses, meal-photo food and calorie estimates, and safety-moderation checks, through the API, which is not used to train their models | Yes |
| Apple | Push notifications, Sign in with Apple, and App Store subscription billing | No. Push payloads are generic and never contain health details |
| Push notifications on Android, Google Sign-In, and Play billing | No, same as above | |
| Stripe | Billing for clinics and institutions only | No. Stripe never receives patient health data |
| Vercel | Hosting for our websites, the clinician hub, and the clinician dashboard interface | Health data passes through the dashboard interface in transit; it is not stored there |
| PostHog | Product analytics on the marketing site only | No. It runs on no page that displays patient data |
2. What we require of them
- A written contract limiting them to processing on our instructions.
- A business associate agreement, or equivalent commitments, wherever protected health information is involved.
- No use of the data for advertising, resale, or training their own models.
- Encryption in transit and at rest, and prompt breach notification to us.
We have no affiliates, and we share your information with no third parties other than these providers and the clinicians or family members you approve. We never sell your data.
3. Where data is processed
Nuro is operated for use in the United States, and our providers process data in the United States. Some, such as Cloudflare, run global networks that may route or cache non-health traffic through other regions.
4. Changes to this list
Clinics and institutions with a signed agreement can ask to be notified in advance of a new subprocessor by emailing us; we give at least 30 days' notice where the agreement requires it, and you may object as that agreement provides. Otherwise, changes appear here with a new date at the top.