Sub-processors
Who processes your data on our behalf. Every supplier below is listed with its role, purpose, jurisdiction, and DPA status.
Australian data residency
Clinical records and clinical AI stay in Sydney. The register names the suppliers outside Australia and what they receive.
Data Processing Agreements
We maintain DPAs with every sub-processor that may access personal information.
Change notifications
We give 30 days’ notice before adding a new sub-processor that handles PHI.
Current sub-processors
Suppliers that process customer data on Praxi's behalf. Reviewed at the start of each quarter and corrected whenever the architecture changes; last reviewed 23 October 2026. Contact hey@praxi.au with any sub-processor question and we coordinate with the named supplier where needed.
| Role | Purpose | Jurisdiction | DPA |
|---|---|---|---|
| Amazon Web Services (AWS): cloud infrastructure | Hosting for the Praxi application and database: EC2/ECS compute, RDS Aurora PostgreSQL, S3 storage, KMS, networking. Also covers the AWS AI services Praxi uses on the same Sydney boundary: Amazon Transcribe (clinical voice transcription), Amazon Polly (spoken prompts and voicemail greetings on the inbound phone line), Amazon Textract (document OCR), Amazon Rekognition (automated checks on images shared in team chat) and Amazon Titan embeddings via Bedrock (clinical note search). PHI stored on KMS-encrypted volumes, with sensitive fields additionally encrypted at the application layer (AES-256-GCM). SCPs deny all non-Australian regions. ISO 27001, SOC 2 Type II, IRAP PROTECTED. | Sydney (ap-southeast-2) | Signed (AWS DPA) |
| Anthropic via AWS Bedrock: AI clinical note drafting | Anthropic Claude via AWS Bedrock in Sydney. Clinical content is processed there; identifiers are not removed before inference. Never used for model training. Practitioner review before signing. See /legal/ai-transparency. | Sydney (ap-southeast-2) via au.anthropic.* inference profiles | Signed (zero retention) |
| Stripe: payment processing | Processes Praxi subscriptions and client card payments. Depending on the transaction, Stripe receives payer contact details, billing information and payment references. Do not include clinical notes or diagnoses in payment descriptions. Stripe provides its own payment security and compliance documentation. | Australia / United States | Signed (Stripe DPA + Australia regional processing) |
| AWS End User Messaging (Pinpoint SMS): transactional SMS | Appointment reminder SMS when a practitioner opts in. Limited client contact information (name, appointment time). No clinical content. Inherits AWS certifications (ISO 27001, SOC 2 Type II, IRAP). | Sydney (ap-southeast-2) | Signed (AWS DPA) |
| AWS Simple Email Service (SES): transactional email | Account, billing, and notification emails (e.g. account-deletion notices, MFA codes). Handles practitioner email and limited personal data. No clinical content. Inherits AWS certifications. | Sydney (ap-southeast-2) | Signed (AWS DPA) |
| Google: workspace email & mapping services | Google Workspace hosts Praxi's corporate mail, including the hey@praxi.au support inbox (monitored via the Gmail API); support correspondence may contain personal information a customer chooses to include. Google Maps Platform (Geocoding and Places) resolves client addresses to map coordinates for waitlist mapping and address autocomplete when those features are enabled (not currently enabled in production; address lookups fall back to postcode centroids on Praxi infrastructure). No clinical records are stored with Google. ISO 27001, SOC 2, ISO 27017/27018. | Global (US-headquartered) | Signed (Google Workspace DPA / Google Cloud Data Processing Addendum) |
| Keycloak: identity & authentication (idle rollback only) | Since 19 October 2026, production sign-in, MFA and session management run on Praxi’s own sign-in service. Keycloak remains only as an idle rollback until it is removed, and the register will be updated when it is. Open-source software self-hosted by Praxi on the same Australian infrastructure as the application; not a third-party operator. | Sydney (ap-southeast-2, self-hosted) | N/A (self-hosted open source) |
| Jitsi: telehealth video | Video sessions for telehealth. Open-source software self-hosted by Praxi on Australian infrastructure; not a third-party operator. Session media is ephemeral and not persisted (ADR-016). | Sydney (ap-southeast-2, self-hosted) | N/A (self-hosted open source) |
| Twilio Inc.: voice + SMS telephony | Voice carriage for Praxi’s own phone line, and for a practice receptionist phone only when the practice connects one. Praxi-provisioned numbers are pinned to the Twilio AU1 (Sydney) edge. The recipient is still Twilio in the United States. Appointment-reminder SMS is sent by AWS in Sydney, not by Twilio. A practice that connects its own Twilio account does so under its own contract. Call content is whatever the caller or the practice supplies, and it can be health information. | United States (master account); AU1 Sydney region for Praxi-provisioned numbers | Signed (Twilio DPA for Praxi-provisioned numbers); tenant-direct DPA for BYO Twilio accounts |
| ElevenLabs: AI voice for Praxi’s own support/sales phone line | ElevenLabs Conversational AI powers the House-of-Praxi support and sales line (+61 480 890 089). Handles business contact details of callers (practitioners and prospective customers discussing Praxi software). This line is intended for software support and sales. Please do not share patient or clinical information; information supplied during a call may be processed by this provider. The client-facing AI Receptionist (coming soon) never uses ElevenLabs: it is text-based (chat, SMS and email) and runs on Anthropic Claude via AWS Bedrock in the Sydney region (listed above). | United States | ElevenLabs standard DPA; software support and sales use only |
| Apple Inc.: push notifications for the iOS apps | The Apple Push Notification service delivers notifications to Praxi’s iOS apps (coming soon). Apple receives the device push token and the notification payload. Notifications to the client app use fixed, generic wording, with routing data such as a record reference and, for messages, the sender’s name. Notifications to the practitioner app use fixed, generic wording for each kind of alert, with a record reference for routing. No client names or clinical details are sent, and no clinical records are stored with Apple. | United States (Apple-operated global service) | Apple Developer Program License Agreement (no separate DPA) |
Optional video providers you can connect
Telehealth runs on Praxi's self-hosted Jitsi service by default. A practice can instead connect its own Zoom or Coviu account; Praxi holds no platform credentials for either, so the provider is the practice's own supplier and processes session media under the practice's agreement with it.
| Provider | Purpose and data | Region | Agreement |
|---|---|---|---|
| Zoom (optional, practice-connected) | Video sessions for practices that prefer Zoom over the built-in Jitsi service. Praxi creates each meeting under the practice’s own Zoom account with a neutral title (a short session reference, never the client’s name), the appointment time and length, and the participants’ display names and the host’s email. The session audio and video flow through Zoom. The clinical record never leaves Praxi. | Zoom is a United States company with Australian data centres; where a session’s media is routed depends on the practice’s own Zoom account and data-centre settings. | The practice’s direct agreement with Zoom |
| Coviu (optional, practice-connected) | Video sessions for practices that prefer Coviu. Praxi creates each session under the practice’s own Coviu account with a neutral session name, the start and end time and the host and guest display names. The session audio and video flow through Coviu. The clinical record never leaves Praxi. | Coviu is an Australian company; hosting is per Coviu’s own published statement. | The practice’s direct agreement with Coviu |
Tenant-connected integrations
Practices can also connect their own third-party accounts to Praxi: Google Workspace or Microsoft 365 (email, calendar and drive sync), Xero or MYOB (accounting), Square or Tyro (payment terminals, paired to the practice's own merchant account), HealthLink or Medical-Objects (secure clinical messaging), their own Twilio account (BYO telephony), and Zoom or Coviu for video (see the table above; privacy statements at zoom.us and coviu.com). HealthLink, Medical-Objects and Tyro are listed ahead of their activation, which is still in progress. These providers process practice data as the practice's own suppliers under the practice's direct agreement with them, not as Praxi sub-processors: Praxi accesses a connected account only with the practice's authorisation and on its instructions. Data synced into Praxi is then protected under the commitments above.
What we do not use
Praxi operates its own alerting, status page, and incident management. There is no third-party paging provider (e.g. PagerDuty) and no third-party status-page provider (e.g. StatusPage.io) with access to operational metadata. See the trust whitepaper (available on request) §alerting for the in-house architecture.
Voice and audio for telehealth video calls on Praxi's own Jitsi service are never persisted. Praxi processes call audio in real time on AU-based infrastructure and discards it immediately; only the text transcript is retained as part of the clinical record (ADR-016, ephemeral voice recordings). Separately, where a practice enables session recording for AI scribe transcription (always with client consent), that audio is retained under the practice's configured retention policy, from a 72-hour default down to a zero-retention mode that destroys audio the moment transcription completes, and is never used to train AI models.
Change log and review cadence
23 October 2026. Q4 review, completed after the 1 October review date. Checked suppliers’ published certifications, processing regions and public security notices since 1 July 2026. Added Apple (push notifications for the iOS apps). Added Amazon Rekognition (team-chat image checks, Sydney) to the AWS row. Updated the Keycloak row: production sign-in moved to Praxi’s own service on 19 October 2026, and Keycloak remains only as an idle rollback until it is removed. Added HealthLink, Medical-Objects and Tyro to the practice-connected integrations. No supplier was removed.
5 October 2026. Removed PostHog. Praxi no longer runs product analytics on the app or the website, so no analytics events are collected and no cookie banner is shown.
29 September 2026. Aligned the register with the legal-drive recipient list. Appointment-reminder SMS stays on AWS in Sydney and is not a Twilio path. Twilio is Praxi’s own phone line and, only if a practice connects one, a receptionist phone. ElevenLabs remains the software support and sales line only. Google Maps stays off in production. Nylas and Resend stay out. The trust-centre card no longer says that health information does not leave Australia: clinical records and clinical AI stay in Sydney, and the overseas rows name what leaves.
2 September 2026. Added Zoom and Coviu as optional, practice-connected video providers, with the data each receives and where it is processed. The register now states plainly that it lists suppliers processing customer data on Praxi’s behalf and is corrected whenever the architecture changes.
3 August 2026. Corrected the AI Receptionist (coming soon) description in the ElevenLabs row: the receptionist is text-based (chat, SMS and email) on Anthropic Claude via AWS Bedrock (Sydney), not a separate Pipecat voice stack.
4 July 2026. Q3 review. Removed Nylas: the email integration now connects directly to each practice's own Google or Microsoft mailbox (Nylas retired 22 June 2026; no successor third party receives mailbox data). Added Google (Workspace corporate email and Maps Platform geocoding, no PHI). Expanded the AWS entry to itemise the Sydney-region AWS AI services already in use (Transcribe, Polly, Textract, Titan embeddings). Corrected the Stripe and PostHog rows to remove ISO 27001 claims we could not verify against those vendors' current public attestations. Reclassified PostHog as self-hosted after verifying production configuration: the analytics stack runs on Praxi infrastructure when deployed, and PostHog Inc. does not process Praxi data.
Last reviewed: 23 October 2026. We notify customers of any change to this list that involves sub-processors handling protected health information at least 30 days before the change takes effect. Material changes are also posted to the System Status page.
Quarterly review. Praxi reviews this list at the start of each calendar quarter (1 January / 1 April / 1 July / 1 October). Reviews check for new vendors, jurisdiction changes, certification expiries, and DPA refreshes.
Questions about a sub-processor?
If a specific sub-processor name matters for your due diligence, we can share it under NDA together with the executed DPA and the provider’s current attestations.