Subprocessors and Vendor Register

Deliver mobile app updates and, when registered by the user, route push notifications through the device platform notification service.

Data categories

• App, runtime, platform and update-request information
• Installation identifiers and app launch diagnostics
• Registered push tokens and notification payloads

Regions

Expo and its service providers' processing locations; see Expo's privacy and subprocessor information.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Expo privacy explanationExpo's explanation of developer data, app-user data, updates and push notifications.Expo Privacy PolicyExpo's public privacy policy and contact information.Expo push notification handlingNotification processing, delivery and troubleshooting information.

Application hosting, serverless runtime, secrets, logs, storage, scheduler/cron infrastructure, and related operational services.

Data categories

• Ride request and provider records
• Admin and operational logs
• IP address and device metadata
• Secrets and service configuration

Regions

Configured cloud regions and Google support locations.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Cloud Data Processing AddendumPublic Google Cloud DPA/CDPA for customer data processing and security terms.Privacy compliance and recordsGoogle Cloud guidance for CDPA, SCCs, privacy records, and BAA acceptance paths.HIPAA Business Associate AddendumGoogle Cloud BAA terms for covered services when a covered-entity workflow is approved.Google Cloud subprocessorsPublic subprocessor list and support/data-labeling processing details.

Primary persistence for ride requests, drafts, providers, payments metadata, consent events, privacy requests, and operational records.

Data categories

• Customer and passenger identity/contact data
• Ride logistics and mobility details
• Provider account and directory data
• Consent, privacy-rights, payment, and audit metadata

Regions

Configured database region plus provider support locations.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Privacy HubMongoDB privacy hub explaining DPA incorporation for self-serve cloud customers.Data Processing AgreementMongoDB DPA for customer personal data processed through cloud services.Cloud TermsMongoDB Cloud Terms incorporating the DPA for cloud services.Security measuresTechnical and organizational security measures for MongoDB Atlas.SubprocessorsMongoDB subprocessor list and change-notice source.

Customer checkout, payment authorization, provider fees, subscriptions, invoices, refunds, billing portals, and payment status webhooks.

Data categories

• Billing contact details
• Payment status and transaction identifiers
• Invoice, subscription, refund, and dispute metadata

Regions

Stripe processing and support locations.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Data Processing AgreementStripe DPA governing personal data processing under Stripe services.Data Transfers AddendumStripe transfer mechanisms, including SCC/UK/Swiss addenda and DPF references.DPA FAQStripe explanation of DPA incorporation, SCCs, DPF, and transfer terms.Service providers and subprocessorsStripe service providers, subprocessors, and affiliates list.

SMS, voice, call routing, call status webhooks, masked-call flows, and provider/customer communications.

Data categories

• Phone numbers
• Message and call metadata
• Call recordings/transcripts if enabled
• Ride coordination context included in messages

Regions

Twilio processing and support locations.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Data Protection AddendumTwilio DPA with transfer framework and contractual safeguard terms.Twilio and HIPAATwilio HIPAA and BAA guidance for PHI workflows.HIPAA accountsTwilio docs for Security/Enterprise Edition and BAA requirements.SubprocessorsTwilio public subprocessor list.

Transactional email, provider outreach, customer notices, admin alerts, lifecycle emails, and digest delivery.

Data categories

• Names and email addresses
• Ride/provider context included in email bodies
• Delivery, open, bounce, suppression, and reply metadata

Regions

Google data-center and support locations described in the Workspace terms and subprocessor list.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Google Workspace Data Processing AmendmentData-processing, security, audit, deletion, transfer, and subprocessor terms for Google Workspace.Google Workspace subprocessorsCurrent Workspace third-party subprocessors, functions, and processing locations.Google Workspace HIPAA guidanceWorkspace HIPAA implementation and covered-functionality guidance used with the accepted BAA.

Address suggestions, place details, geocoding, route context, and distance/time support.

Data categories

• Address search text
• Pickup/dropoff addresses
• IP/device metadata sent by browser or server requests

Regions

Google processing and support locations.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Google Maps Platform TermsGoogle Maps Platform service terms for address/location APIs.Google Maps SCCsMaps Platform transfer terms and SCC information.Google transfer frameworksGoogle DPF and international transfer framework statement.

Site analytics, attribution, ad measurement, conversion tracking, and performance reporting.

Data categories

• Cookie identifiers
• Device/browser metadata
• IP-derived approximate location
• Consent state, page views, attribution, and conversion events

Regions

Google processing and support locations.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Google Ads Data Processing TermsGoogle Ads/Analytics data processing terms for EEA/GDPR and similar laws.Analytics Help: Data Processing TermsGoogle Analytics help page for data-processing terms.International data transfersGoogle Ads transfer safeguard and SCC information.Google transfer frameworksGoogle DPF and international transfer framework statement.

Provider AI assistant, call handling, summaries, classification, drafting, and operational support where enabled.

Data categories

• Provider business records
• Call/message content if enabled
• Ride coordination context submitted to AI workflows
• Operational instructions and outcome metadata

Regions

Depends on the configured model and voice-AI provider.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

OpenAI Services AgreementOpenAI business terms covering DPA incorporation and PHI restrictions.OpenAI enterprise privacyOpenAI DPA and enterprise privacy commitments for business/API customers.OpenAI data controlsOpenAI API data controls and retention configuration guidance.Vapi Terms of ServiceVapi terms incorporating its DPA and privacy policy.Vapi HIPAA complianceVapi HIPAA/BAA requirements and PHI workflow restrictions.Vapi Trust CenterVapi security, DPA, SCC, and trust-center evidence.

Business development, provider outreach, public posts, and lead generation workflows where enabled.

Data categories

• Business contact details
• Provider company information
• Campaign and engagement metadata

Regions

LinkedIn processing and support locations.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

LinkedIn Data Processing AgreementLinkedIn DPA for customer data processed in LinkedIn services.LinkedIn SCCsLinkedIn SCC incorporation and transfer safeguard information.LinkedIn transfer guidanceLinkedIn EEA/UK/Swiss transfer mechanism guidance.LinkedIn privacy policyLinkedIn privacy practices and user choices.

Approximate visitor location, routing, localization, fraud controls, and analytics support where enabled.

Data categories

• IP address
• Approximate location
• Device/browser metadata

Regions

Depends on the configured provider.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

ipapi.co privacy policyipapi.co privacy, processing, and subprocessor statement.ipapi.com privacy policyAlternative configured ipapi privacy and DPA availability statement.ipapi.is DPADPA evidence if the configured geolocation provider is ipapi.is.

Domain registration, DNS, web delivery, TLS, monitoring, and related infrastructure services.

Data categories

• Domain/account contact data
• Technical logs
• Visitor IP/device metadata where processed by edge or DNS services

Regions

Depends on the configured provider and support locations.

Safeguards

MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.

Public legal evidence

Hostinger DPAHostinger data processing addendum for domain/hosting account evidence.Hostinger privacy policyHostinger privacy practices and GDPR contact evidence.Hostinger hosting agreementHosting service terms and customer responsibility language.