Subprocessors and checkout provider
HC Sync uses Vercel for hosting and API execution and Supabase for its Postgres database in the US. The merchant of record shown at checkout handles payments and never receives health records. The DPA governs subprocessor obligations, including 30-day advance notice of additions or replacements and a right to object.
Last updated: 2026-11-04. Source for the 2026 service details: HC Sync page details.
Effective 3 November 2026. These providers support HC Sync. The DPA governs customer health data, subprocessor obligations, and 30-day advance notice of additions or replacements with a right to object.
| Provider | Purpose | Data and location |
|---|---|---|
| Vercel | Hosting and API execution | API requests and service metadata; configured API region iad1, US. |
| Supabase | Postgres database | Customer health records, pseudonymous ids and project metadata; US. |
| Our merchant of record shown at checkout | Payments, receipts and subscription management | Billing and payment details; never health records. Identity, location and privacy and transfer terms are shown at checkout. |
The merchant of record handles payments under its own checkout terms and privacy notice; its inclusion here does not mean it receives customer health data. Do not put health data in billing fields. Questions or objections: shaharfrish6@gmail.com.
What else should you know?
Who hosts the API?
Vercel provides hosting and API execution in the configured API region iad1, US.
Where is the database?
Supabase provides the Postgres database in the US.
Does the checkout provider receive health records?
The merchant of record handles billing and payment details, never health records.