Last updated: October 19, 2026
What this is
These are the companies behind this website, clinicospro.com: hosting, email, booking calls, analytics and advertising. The website never handles patient data. The Clinic OS Pro app, which does, has its own list at app.clinicospro.com/legal/subprocessors. Under our Data Processing Agreement you have the right to object to new subprocessors.
| Service | Purpose | Data Categories | Location | Status |
|---|---|---|---|---|
Vercel Vercel Inc. | Website hosting, CDN, serverless functions, edge analytics | Pseudonymous usage data (cookie IDs, truncated IPs), request metadata | United States (global edge network) | DPA + SCCs |
Google Workspace Google LLC | Business email, the booking calendar, documents | Contact details and messages from website visitors and clinic owners, calendar events, documents | United States | DPA and BAA in place |
Zoom Zoom Video Communications, Inc. | Implementation Call video meetings | Voice, video, meeting metadata, transcripts, chat messages | United States | Standard DPA; we never ask for patient data on calls |
Amazon SES Amazon Web Services, Inc. | Transactional email delivery (booking confirmations, calculator results, notifications, newsletter) | Recipient email address, name, message content, delivery metadata | United States | DPA in place; BAA available under the AWS BAA where required |
Neon Neon, Inc. | The database behind our CRM: leads, booked calls and the newsletter list | Names, emails, phone numbers and clinic names that visitors give us, with booking and email history | United States (us-east-2) | Standard DPA |
OpenAI OpenAI, L.L.C. | Drafting and editing website and blog content, and making blog cover images | Prompts and outputs about our own content. No patient data. | United States | DPA, zero-retention where available |
Anthropic Anthropic PBC | Drafting and editing website and blog content | Prompts and outputs about our own content. No patient data. | United States | DPA, zero-retention where available |
Google Analytics 4 Google LLC | Aggregate website analytics, conversion tracking | Pseudonymous usage data (cookie IDs, truncated IPs), page views, events | United States | Standard DPA |
Google Ads Google LLC | Advertising and conversion measurement | Pseudonymous event data, ad interaction metadata | United States | Standard DPA |
Meta (Facebook/Instagram) Meta Platforms, Inc. | Advertising and conversion measurement via Meta Pixel | Pseudonymous event data, hashed identifiers where used, browser metadata | United States | Standard DPA |
Microsoft Clarity Microsoft Corporation | Behavioral analytics: session replay, heatmaps, scroll depth, rage/dead click detection. Diagnostic only – never used for advertising or sold to third parties. | Pseudonymous interaction data (mouse movements, scroll position, clicks, page transitions, viewport size, device + browser metadata). Form input content is masked client-side before transmission. IP is used for approximate geolocation and bot filtering, not stored long-term against an identifiable profile. Only loaded after the visitor grants analytics consent via the cookie banner. | United States | Standard DPA |
No patient data goes to these AI tools.
OpenAI and Anthropic help draft and edit this website's content. The website never handles patient data. In the Clinic OS Pro app, AI drafts replies to patient messages on Amazon Bedrock, inside our own AWS account and under our AWS BAA; the app's list has the details.
Most of our subprocessors are located in the United States. Where we transfer Personal Data to the US from the EU, EEA, or UK, we rely on the Standard Contractual Clauses (EU Commission Implementing Decision 2021/914) or the UK International Data Transfer Addendum, as applicable, together with supplementary measures described in our Data Processing Agreement.
We update this page when we add, replace, or remove a subprocessor. For clients with an active DPA, we also provide at least thirty (30) days' advance written notice, where practicable, of any new subprocessor that will process their Personal Data. To receive notifications, email support@clinicospro.com with "Subprocessor Updates" in the subject line.
Clients with an active DPA may object to a new subprocessor on reasonable data-protection grounds within the notice period. If the objection cannot be resolved through good-faith discussion (for example, by implementing additional safeguards or substituting an alternative vendor), the client may terminate the affected portion of the engagement without penalty. This is the client's sole and exclusive remedy for objections to a new subprocessor.
The subprocessors listed above may themselves engage sub-subprocessors (e.g., Google Workspace relies on Google Cloud infrastructure; Vercel relies on AWS). We evaluate each subprocessor's own data-protection program and flow-down obligations before onboarding, and each of our subprocessor agreements requires substantially equivalent protections to those in our DPA, including flow-down of security and breach-notification obligations where applicable.
Questions about our subprocessors, their certifications, or their data-handling practices?
Clinic OS Pro
Windsor, Ontario, Canada
Email: support@clinicospro.com
For the Clinic OS Pro app, which handles patient data, see its own subprocessor list at app.clinicospro.com/legal/subprocessors.