Sub-processors
We rely on a small number of trusted third-party services to deliver CareRunner. This page lists them and the data each one processes. We update it when the list changes.
Supabase
United States (primary). EU region available for EU customers.Purpose: Database, authentication, file storage
Data processed: All account, Care Circle, document, medication, and audit data.
Google (Gemini)
United States / global.Purpose: AI model behind document analysis and most drafting features
Data processed: Document bytes, prompt text, and conversation context for the specific request.
OpenAI (GPT)
United States.Purpose: AI model used for select drafting and reasoning features
Data processed: Prompt text and conversation context for the specific request.
ElevenLabs (voice)
United States / global.Purpose: Text-to-speech for Rosie's spoken interface. Not used for health information.
Data processed: Only short, non-health text that CareRunner sends to be read aloud (interface prompts and introductions). ElevenLabs is not approved to handle health information and does not sign healthcare agreements, so recordings of care conversations and any health details are never sent to it — automatic transcription of care conversations is disabled.
Cloudflare
Global edge network.Purpose: Edge hosting and serverless runtime for the web app
Data processed: Standard HTTP request data (IP, user agent, URL).