Subprocessors
Subprocessors
Legal · Transparency · Bioscope Foundry, LLC (an Indiana limited liability company) · Effective date: June 23, 2026 · Last updated: October 23, 2026
Draft for legal review. List is current as of October 2026. Foundry provides advance notice of changes per the BAA presented during onboarding. Not legal advice.
Bioscope Foundry engages the third-party service providers listed below ("subprocessors") to deliver the Services. Subprocessors that may create, receive, maintain, or transmit Protected Health Information (“PHI”) on Foundry’s behalf are bound by a Business Associate Agreement (“BAA”) providing protections at least as protective as those Foundry owes its member practices. PHI lives only inside a Foundry-operated FHIR R4 service running on Foundry’s cloud infrastructure subprocessor (see the entry below); the FHIR service itself is not a distinct third-party subprocessor because Foundry self-hosts it.
1. PHI-bound subprocessors
These providers handle PHI on Foundry’s behalf, or are designed to. Each is listed with the status of its BAA.
| Subprocessor | Purpose | Location | PHI? | BAA? | Effective |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure provider for the operating platform. Hosts the clinical workflow database (Amazon RDS for PostgreSQL), the private Foundry-operated HAPI FHIR service (Amazon ECS) that serves clinical FHIR resources, encrypted object storage (S3 with AWS KMS-CMK, including uploaded documents scanned by GuardDuty), the managed secrets store (AWS Secrets Manager), the onboarding control-plane workloads (EventBridge / Scheduler / SQS), and the web delivery and DNS layer (CloudFront and Route 53). PHI resides in the RDS clinical database, the HAPI FHIR service, and S3. AWS is the relevant cloud subprocessor for PHI infrastructure; the FHIR service itself is not a distinct third party; it is Foundry-operated software running inside AWS. | U.S. regions | Yes | Yes | On engagement |
| Amazon SES (Amazon Web Services) | Out-of-band transactional email: login codes, patient-portal magic links, and secure-message-waiting alerts. PHI excluded from message body by design. | U.S. | Identifiers only | Yes (covered by the AWS BAA) | On engagement |
| Anthropic, PBC | Claude API: AI reasoning for the multi-agent system, including clinic-scoped (Tier-3) workflows that may include PHI, extraction of structured data from uploaded laboratory PDFs, and the onboarding assistant. | U.S. | Yes | Yes | On engagement |
| Google LLC: Gemini API | Gemini models for the onboarding voice interview and clinical presence features. Onboarding audio may be PHI-adjacent. The clinical presence feature is gated by a feature flag. | U.S. | Possible (PHI-adjacent audio) | To be confirmed before any PHI flows | On engagement |
| Quo (OpenPhone) | Business telephony for practices: call records and call transcripts ingested into the clinical workflow. | U.S. | Yes (call transcripts) | Yes | On engagement |
| Fax provider (Optima; Fax.Plus) | Inbound and outbound fax for referrals and records. | U.S. | Yes | Yes | On engagement |
| Zoom Video Communications, Inc. | Telehealth meetings. | U.S. | Yes | Yes | On engagement |
| DoseSpot, Inc. | Electronic prescribing (Surescripts network). | U.S. | Yes | Yes | On engagement |
2. Non-PHI subprocessors
These providers support Foundry’s business operations and do not handle PHI. PHI is not permitted into these systems by policy.
| Subprocessor | Purpose | Location | PHI? | BAA? | Effective |
|---|---|---|---|---|---|
| Google LLC: Google Workspace | Workforce identity, corporate email, and productivity (Docs / Drive / Calendar / Meet). Also provides clinician sign-in (Google OAuth), provisions Workspace accounts for new practices during onboarding, and connects clinician Calendar. PHI is prohibited from Workspace surfaces by policy. | U.S. regions | Identifiers only | Yes (precaution; PHI scope is out by design) | On engagement |
| Cloudflare, Inc. | DNS for Foundry’s own zones, and domain registration and DNS for practice domains provisioned during onboarding. Domain names and DNS records only. | Global edge (origin in U.S.) | No | N/A | On engagement |
| 1Password, Inc. (AgileBits) | Credential vault. The platform stores initial practice administrator credentials in a Foundry-operated vault during onboarding and hands them to the Practice owner. Stores credentials and MFA material only. | U.S. | No (credentials only) | N/A | On engagement |
| GitHub, Inc. (Microsoft) | Source-code hosting and continuous integration. No PHI in source or CI by policy. | U.S. | No | N/A | On engagement |
| Slack Technologies, LLC (Salesforce) | Workforce communications, and operational notifications from the platform (practice names, account notices, alarms). PHI is not introduced into Slack by policy. | U.S. | Identifiers only | N/A | On engagement |
| HubSpot, Inc. | Customer relationship management (CRM) for prospective and current member practices. Sends webhooks to the onboarding service. Business contact data only. | U.S. | No | N/A | On engagement |
| Browserbase, Inc. | Hosted browser automation that drives administrative consoles of other vendors during practice provisioning. | U.S. | No | N/A | On engagement |
| Mercury Technologies, Inc. | Banking for Foundry, and identity and bank-account verification of practice owners during provisioning (name, date of birth, SSN, bank routing and account numbers). Not PHI, but sensitive personal information. | U.S. | No (sensitive personal information) | N/A | On engagement |
| Stripe, Inc. | Payment processing for Practice fees. | U.S. | No | N/A | On engagement |
| DocuSeal | Electronic signature for agreements, self-hosted by Foundry. No PHI in signature envelopes. | U.S. (Foundry-controlled environment) | No | N/A (self-hosted, no third-party processing) | On engagement |
| Public registries (CMS NPPES, HHS OIG, SAM.gov) | Lookups of clinician identity and exclusion status during credentialing. Clinician name and NPI are sent; the registries are U.S. government services. | U.S. | Identifiers only | N/A | On engagement |
3. Notice of changes
This list is current as of October 2026. Foundry will:
- Provide member Practices at least 30 days’ prior written notice before engaging any new subprocessor that may handle PHI, per the BAA presented during onboarding;
- Update this page when subprocessors are added, removed, or materially change in scope; and
- Maintain BAAs with all PHI-handling subprocessors before any PHI flow.
If a Practice objects to a new PHI-handling subprocessor on a reasonable, articulable risk basis, the Practice may exercise its termination rights as set out in the BAA and the Master Services Agreement presented during onboarding.
4. Contact
Questions about Foundry’s subprocessors or to request additional detail:
Bioscope Foundry, LLC
Privacy: privacy@bioscopefoundry.com
Security: security@bioscopefoundry.com
11939 N. Meridian Street, Suite 125, Carmel, IN 46032
Related: HIPAA-covered services · Vendor & third-party risk policy.
© 2026 Bioscope Foundry, LLC. All rights reserved. This draft is provided for internal and legal review and does not constitute legal advice.