Subprocessors

Subprocessors and Vendor Register

MedicalRide.org uses service providers to host, secure, route, message, bill, measure, and operate the platform. This page lists the main vendor categories used to support the service.

Publisher details are available in the Legal Notice.

Last updated: 2026-08-04

This register is an operational transparency page. Vendor access is limited by role, service purpose, contractual safeguards, privacy choices, and MedicalRide's data-minimization practices.

Vendor transparency controls

MedicalRide maintains vendor categories, public evidence links, BAA availability notes, and privacy choices around optional tags.

Clear operator identity
MedicalRide.org is operated by Tipmunk SASU, with public controller and contact details listed in the Legal Notice and Privacy Policy.
Legal Notice
Directory platform boundary
MedicalRide presents a directory and request platform. Independent providers remain responsible for transportation services, vehicles, drivers, licensing, insurance, pricing, and ride completion.
Terms
Consent and privacy choices
Non-essential analytics and advertising tags stay off unless allowed, Global Privacy Control is honored where applicable, and key consent choices are recorded.
Privacy Choices
Rights request workflow
People can request access, correction, deletion, portability, consent withdrawal, and California privacy choices through a dedicated intake form.
Data Rights
Retention and deletion controls
MedicalRide publishes baseline retention categories and uses review, legal-hold, and approval steps before eligible deletion or redaction runs.
Retention
Vendor transparency
The vendor register lists core provider categories, data categories, transfer evidence, BAA availability, and public legal evidence links.
Subprocessors
Security and audit controls
Admin/session controls, role-based permissions, rate limits, same-origin checks, and sensitive-access audit logs support privacy operations.
Security
Organization agreement evidence
Organizations can accept directory-platform terms through an electronic agreement flow that records authority, accepted text, and request context.
Organization agreement

Vendor register

Google Cloud

Cloud infrastructure and hosting provider

Application hosting, serverless runtime, secrets, logs, storage, scheduler/cron infrastructure, and related operational services.

Data categories: Ride request and provider records
Admin and operational logs
IP address and device metadata
Secrets and service configuration
Regions: Configured cloud regions and Google support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: Cloud Data Processing AddendumPublic Google Cloud DPA/CDPA for customer data processing and security terms.Privacy compliance and recordsGoogle Cloud guidance for CDPA, SCCs, privacy records, and BAA acceptance paths.HIPAA Business Associate AddendumGoogle Cloud BAA terms for covered services when a covered-entity workflow is approved.Google Cloud subprocessorsPublic subprocessor list and support/data-labeling processing details.

MongoDB or configured database provider

Database processor

Primary persistence for ride requests, drafts, providers, payments metadata, consent events, privacy requests, and operational records.

Data categories: Customer and passenger identity/contact data
Ride logistics and mobility details
Provider account and directory data
Consent, privacy-rights, payment, and audit metadata
Regions: Configured database region plus provider support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: Privacy HubMongoDB privacy hub explaining DPA incorporation for self-serve cloud customers.Data Processing AgreementMongoDB DPA for customer personal data processed through cloud services.Cloud TermsMongoDB Cloud Terms incorporating the DPA for cloud services.Security measuresTechnical and organizational security measures for MongoDB Atlas.SubprocessorsMongoDB subprocessor list and change-notice source.

Stripe

Payment services provider

Customer checkout, payment authorization, provider fees, subscriptions, invoices, refunds, billing portals, and payment status webhooks.

Data categories: Billing contact details
Payment status and transaction identifiers
Invoice, subscription, refund, and dispute metadata
Regions: Stripe processing and support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: Data Processing AgreementStripe DPA governing personal data processing under Stripe services.Data Transfers AddendumStripe transfer mechanisms, including SCC/UK/Swiss addenda and DPF references.DPA FAQStripe explanation of DPA incorporation, SCCs, DPF, and transfer terms.Service providers and subprocessorsStripe service providers, subprocessors, and affiliates list.

Twilio

Communications processor

SMS, voice, call routing, call status webhooks, masked-call flows, and provider/customer communications.

Data categories: Phone numbers
Message and call metadata
Call recordings/transcripts if enabled
Ride coordination context included in messages
Regions: Twilio processing and support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: Data Protection AddendumTwilio DPA with transfer framework and contractual safeguard terms.Twilio and HIPAATwilio HIPAA and BAA guidance for PHI workflows.HIPAA accountsTwilio docs for Security/Enterprise Edition and BAA requirements.SubprocessorsTwilio public subprocessor list.

Transactional email providers

Email communications processors

Transactional email, provider outreach, customer notices, admin alerts, lifecycle emails, and digest delivery.

Data categories: Names and email addresses
Ride/provider context included in email bodies
Delivery, open, bounce, suppression, and reply metadata
Regions: Depends on the configured provider account and support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: Mailgun/Sinch termsMailgun terms referencing Sinch Email data-processing terms.Sinch Data Processing AgreementSinch/Mailgun DPA with SCC, DPF, UK addendum, and security terms.Sinch subprocessorsSubprocessor list and change-notice subscription source for Sinch services.Mailgun HIPAA BAAMailgun BAA terms for PHI workflows when an approved email workflow exists.Google Cloud DPAGoogle Workspace/Cloud Identity DPA evidence when Google Workspace email is configured.

Google Maps/Places

Address and location services provider

Address suggestions, place details, geocoding, route context, and distance/time support.

Data categories: Address search text
Pickup/dropoff addresses
IP/device metadata sent by browser or server requests
Regions: Google processing and support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: Google Maps Platform TermsGoogle Maps Platform service terms for address/location APIs.Google Maps SCCsMaps Platform transfer terms and SCC information.Google transfer frameworksGoogle DPF and international transfer framework statement.

Google Tag Manager, Google Ads, and analytics tags

Analytics and advertising technology providers

Site analytics, attribution, ad measurement, conversion tracking, and performance reporting.

Data categories: Cookie identifiers
Device/browser metadata
IP-derived approximate location
Consent state, page views, attribution, and conversion events
Regions: Google processing and support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: Google Ads Data Processing TermsGoogle Ads/Analytics data processing terms for EEA/GDPR and similar laws.Analytics Help: Data Processing TermsGoogle Analytics help page for data-processing terms.International data transfersGoogle Ads transfer safeguard and SCC information.Google transfer frameworksGoogle DPF and international transfer framework statement.

AI and voice-AI vendors

AI processing providers

Provider AI assistant, call handling, summaries, classification, drafting, and operational support where enabled.

Data categories: Provider business records
Call/message content if enabled
Ride coordination context submitted to AI workflows
Operational instructions and outcome metadata
Regions: Depends on the configured model and voice-AI provider.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: OpenAI Services AgreementOpenAI business terms covering DPA incorporation and PHI restrictions.OpenAI enterprise privacyOpenAI DPA and enterprise privacy commitments for business/API customers.OpenAI data controlsOpenAI API data controls and retention configuration guidance.Vapi Terms of ServiceVapi terms incorporating its DPA and privacy policy.Vapi HIPAA complianceVapi HIPAA/BAA requirements and PHI workflow restrictions.Vapi Trust CenterVapi security, DPA, SCC, and trust-center evidence.

Business outreach and social platform

Business development, provider outreach, public posts, and lead generation workflows where enabled.

Data categories: Business contact details
Provider company information
Campaign and engagement metadata
Regions: LinkedIn processing and support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: LinkedIn Data Processing AgreementLinkedIn DPA for customer data processed in LinkedIn services.LinkedIn SCCsLinkedIn SCC incorporation and transfer safeguard information.LinkedIn transfer guidanceLinkedIn EEA/UK/Swiss transfer mechanism guidance.LinkedIn privacy policyLinkedIn privacy practices and user choices.

IP geolocation services

Visitor location processor

Approximate visitor location, routing, localization, fraud controls, and analytics support where enabled.

Data categories: IP address
Approximate location
Device/browser metadata
Regions: Depends on the configured provider.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: ipapi.co privacy policyipapi.co privacy, processing, and subprocessor statement.ipapi.com privacy policyAlternative configured ipapi privacy and DPA availability statement.ipapi.is DPADPA evidence if the configured geolocation provider is ipapi.is.

Domain, DNS, and web infrastructure vendors

Infrastructure and publishing support

Domain registration, DNS, web delivery, TLS, monitoring, and related infrastructure services.

Data categories: Domain/account contact data
Technical logs
Visitor IP/device metadata where processed by edge or DNS services
Regions: Depends on the configured provider and support locations.
Safeguards: MedicalRide uses appropriate contractual, transfer, access, retention, and data-minimization controls for vendor processing where required.
Public legal evidence: Hostinger DPAHostinger data processing addendum for domain/hosting account evidence.Hostinger privacy policyHostinger privacy practices and GDPR contact evidence.Hostinger hosting agreementHosting service terms and customer responsibility language.

Sensitive data restrictions

MedicalRide limits covered-entity PHI and unnecessary health or mobility details to workflows, vendors, and channels appropriate for the specific service. Non-essential analytics and advertising tags remain subject to privacy choices.

Privacy questions or vendor notices may be submitted through the Data Rights Request form.