Policy

Subprocessors

The outside services SLPcentral relies on, what each one receives, and where. Only Google and Anthropic receive clinical records, and both have signed HIPAA Business Associate Agreements with us.

Clinical plane (holds or processes clinical records, all under a BAA)

Google Cloud (Cloud Run, Cloud SQL for PostgreSQL, Cloud KMS, Secret Manager, Cloud Storage, Cloud Scheduler, Cloud Logging and audit logs, Artifact Registry, IAM, VPC)

Receives: All clinical records; synced client names and details (extra KMS encryption); the access log; move-day transfer file (auto-deleted after 2 days). Where: United States only (us-east4, Northern Virginia; org policy blocks non-US locations). Why: Store and serve clinical records. BAA: Yes, Google Cloud BAA effective 2026-09-22

Google Cloud Speech-to-Text (Chirp 3)

Receives: Brain Dump audio, in short pieces, processed in memory and discarded; returns text. Where: United States (us multi-region). Why: Turn Brain Dump speech into text. BAA: Yes (same BAA). Data logging off (opt-in, never enabled)

Anthropic (Anthropic's Claude models, called only from our server)

Receives: Clinical text with client codes (CLT_…): what you dictated or typed, goal wording, trial counts, percentages, session dates, cue levels, attendance codes and counts, and your messages to Ollie (saved client names replaced with codes). Never client name fields or client details. Where: United States (US-only processing). Why: Draft notes, SOAP notes, progress reports and present levels, and run the assistant Ollie. BAA: Yes, Anthropic BAA (HIPAA-ready organization). No training on our data.

Account plane and operations (no clinical records by design)

Supabase

Receives: Email, hashed password, sign-in records (time, IP, device), profile (first name, stage, terms version, referral answer), subscription status, usage counts, grad-school application tracker, support messages, marketing waitlist emails. (The pre-move copy of clinical records it held was deleted on October 15, 2026.) Where: United States (AWS us-east-1). Why: Login, account, billing status, limits, support inbox. BAA: No

Apple

Receives: Purchases and subscriptions; App Store distribution; TestFlight. Where: Apple's systems. Why: Sell and renew iPhone subscriptions. BAA: No

RevenueCat

Receives: Random account ID, purchase and subscription events, receipts. Where: United States. Why: Keep subscription status in sync between Apple, the web and our database. BAA: No

Stripe (via RevenueCat Web Billing)

Receives: Name, email, card details (entered on Stripe's page; we never see card numbers). Where: United States. Why: Web subscriptions. BAA: No

Resend (sending through Amazon SES)

Receives: Email address, first name, email content (account emails, including trial reminders: confirm email, password reset, "Welcome to Pro"). Where: United States. Why: Send account emails from send.slpcentral.app. BAA: No

Vercel

Receives: Website hosting logs (IP, browser, pages requested). Analytics: page views and referrers on public marketing pages only, no cookies; signed-in pages are dropped before sending. Where: Global edge network; US. Why: Host www.slpcentral.app; count marketing-page visits. BAA: No

Sentry (web app only; not in the iPhone app)

Receives: Error details, page path, network request addresses and status, random account ID. Session Replay, click/typing and console capture are off. Where: Sentry's cloud service. Why: Find and fix web crashes. BAA: No

Expo (EAS Update)

Receives: Device platform, app version, an update-client identifier. Where: United States. Why: Deliver over-the-air app updates to iPhones. BAA: No

Cloudflare

Receives: DNS lookups; email sent to @slpcentral.app addresses, including privacy@ and support@ (forwarded to the owner's inbox). Where: Global. Why: Domain name service and email forwarding. BAA: No

Google (Gmail), the owner's inbox that privacy@ and support@ forward to

Receives: Emails you send us. Where: Google's systems. Why: Answer email. BAA: No (a consumer Gmail account is not covered by the Cloud BAA). Never email client details. Kept 24 months, then deleted

Receives: A content-free notice ("new message on form X, reply address left: yes/no"); a daily count summary (signups, subscriptions, message count, web crash titles). Where: Global. Why: Tell the owner something needs attention. BAA: No

Google Fonts (public marketing pages only)

Receives: Visitor IP address and browser when the font file loads. Where: Global. Why: Display a handwriting font on the landing page. BAA: No

Not used

Deepgram: used before the move for Brain Dump transcription. No longer used for any user data after move day; its key was deleted on October 15, 2026.
Google's Gemini models: not used for any user content. (Tested on made-up data only; switched off for client data.)
Anthropic under our old, non-HIPAA account: the pre-move Edge Functions (anthropic-*) used a general Anthropic account without a BAA. They were deleted on October 15, 2026, and that key was revoked. All AI text now goes only to the separate HIPAA-mode organization above, through our Google server.
No advertising networks, data brokers or cross-site tracking of any kind.

Changes

We will update this page and tell you in the app at least 30 days before a new provider starts receiving clinical records, except when we must change a provider urgently to keep the service secure or available; then we tell you as soon as we can.