Subprocessors

Legal · Transparency · Bioscope Foundry, LLC (a Delaware limited liability company) · Effective date: June 23, 2026 · Last updated: June 23, 2026

Draft for legal review. List is current as of June 2026. Foundry provides advance notice of changes per the BAA. Not legal advice.

Bioscope Foundry engages the third-party service providers listed below ("subprocessors") to deliver the Services. Subprocessors that may create, receive, maintain, or transmit Protected Health Information (“PHI”) on Foundry’s behalf are bound by a Business Associate Agreement (“BAA”) providing protections at least as protective as those Foundry owes its member practices. PHI lives only inside a Foundry-operated FHIR R4 service running on Foundry’s cloud infrastructure subprocessor (see the entry below); the FHIR service itself is self-hosted by Foundry and is therefore not a distinct third-party subprocessor.

1. PHI-bound subprocessors (BAA in place)

These providers may handle PHI on Foundry’s behalf and are operating under an executed BAA.

Subprocessor	Purpose	Location	PHI?	BAA?	Effective
Amazon Web Services, Inc.	Cloud infrastructure provider for the operating platform. Hosts the clinical workflow database (Amazon RDS for PostgreSQL), the private Foundry-operated HAPI FHIR service (Amazon ECS) that serves clinical FHIR resources, encrypted object storage (S3 with AWS KMS-CMK), the managed secrets store (AWS Secrets Manager) that brokers Foundry-owned credentials, and the onboarding control-plane workloads (EventBridge / Scheduler / SQS). PHI resides in the RDS clinical database and the HAPI FHIR service. AWS is the relevant cloud subprocessor for PHI infrastructure; the FHIR service itself is not a distinct third party; it is Foundry-operated software running inside AWS.	U.S. regions	Yes (PHI is stored on AWS-managed storage)	Yes	On engagement
Google LLC: Google Workspace	Workforce identity, corporate email, and productivity (Docs / Drive / Calendar / Meet). Used for internal collaboration; PHI is prohibited from Workspace surfaces by policy.	U.S. regions	Identifiers only	Yes (precaution; PHI scope is out by design)	On engagement
Anthropic, PBC	Claude API: AI reasoning for the multi-agent system, including clinic-scoped (Tier-3) workflows that may include PHI.	U.S.	Yes	Yes	On engagement
OpenAI OpCo, LLC	OpenAI API. Powers the Maverick Tier-1 executive assistant; not used by Atlas / Tier-3 clinical agents (those run on Anthropic). PHI scope is excluded by Foundry policy and routing.	U.S.	No	BAA in progress	On engagement
Amazon SES (Amazon Web Services)	Out-of-band transactional email (login codes, secure-message-waiting alerts). PHI excluded from message body by design.	U.S.	Identifiers only	Yes (covered by the AWS BAA)	On engagement

2. Non-PHI subprocessors

These providers support Foundry’s business operations and do not handle PHI. PHI is not permitted into these systems by policy.

Subprocessor	Purpose	Location	PHI?	BAA?	Effective
Cloudflare, Inc.	CDN, DNS, edge security, and Workers Static Assets hosting for the customer-marketing and exploratory web surfaces (`bioscopefoundry.com` and other public Foundry web properties). No PHI traverses the edge.	Global edge (origin in U.S.)	No	N/A	On engagement
1Password, Inc. (AgileBits)	Workforce password manager and credential vault. Two configurations: (a) a Foundry-operated Stage-1 vault used to provision new Practice administrator credentials during onboarding, and (b) the Connect API used to deliver Stage-2 vaults to Practice owners. Stores credentials and MFA material for Foundry’s operational SaaS accounts. No PHI.	U.S.	No (credentials only)	N/A	On engagement
GitHub, Inc. (Microsoft)	Source-code hosting and continuous integration. No PHI in source or CI by policy.	U.S.	No	N/A	On engagement
Slack Technologies, LLC (Salesforce)	Workforce communications. PHI is not introduced into Slack by policy.	U.S.	No	N/A	On engagement
Linear Orbit, Inc.	Engineering and operations work tracking. PHI is not introduced into Linear by policy.	U.S.	No	N/A	On engagement
Notion Labs, Inc.	Internal documentation and knowledge management. PHI is not introduced into Notion by policy.	U.S.	No	N/A	On engagement
Stripe, Inc.	Payment processing for Practice fees (non-PHI).	U.S.	No	N/A	On engagement
DocuSeal	Electronic signature for agreements (MSA, BAA, Orders), self-hosted by Foundry. No PHI in signature envelopes.	U.S. (Foundry-controlled environment)	No	N/A (self-hosted, no third-party processing)	On engagement
Mercury Technologies, Inc.	Banking and treasury operations for Foundry (internal). No customer data.	U.S.	No	N/A	On engagement
Attio Ltd.	Customer relationship management (CRM) for prospective and current member practices. Business contact data only, no PHI.	U.S. / U.K.	No	N/A	On engagement
Granola Labs, Inc.	Meeting-notes tooling (internal). No PHI by policy.	U.S.	No	N/A	On engagement

3. Notice of changes

This list is current as of June 2026. Foundry will:

Provide member Practices at least 30 days’ prior written notice before engaging any new subprocessor that may handle PHI, per the BAA;
Update this page when subprocessors are added, removed, or materially change in scope; and
Maintain BAAs with all PHI-handling subprocessors before any PHI flow.

If a Practice objects to a new PHI-handling subprocessor on a reasonable, articulable risk basis, the Practice may exercise its termination rights as set out in the BAA and the Master Services Agreement.

4. Contact

Questions about Foundry’s subprocessors or to request additional detail:

Bioscope Foundry, LLC
Privacy: privacy@bioscopefoundry.com
Security: security@bioscopefoundry.com
11939 N. Meridian Street, Suite 125, Carmel, IN 46032

List of HIPAA-Covered Services Master Services Agreement