Trust
Subprocessors
Third parties we rely on to provide the service, and whether they may process PHI.
Last updated: August 2026
Draft, pending legal review. This page is a placeholder that reflects our intended practices. It is not yet a binding agreement; final language is subject to counsel review before any production use with protected health information.
We engage a small number of subprocessors to operate OrganAlert. Where a subprocessor may process protected health information, it is bound by a Business Associate Agreement and the safeguards described in our security overview. Extend performs document extraction under our BAA. Azure OpenAI may classify an uploaded PDF as donor or recipient, produce a bounded donor overview, summarize only the most recent imaging study, and reconcile canonical score inputs from validated Extend data. Every selected input must cite an exact Extend path; score arithmetic remains deterministic in OrganAlert.
| Subprocessor | Purpose | Region | PHI |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure: compute, database, object storage | United States | BAA · may process PHI |
| Extend.ai | Donor and recipient document extraction and source citations | United States | BAA · may process PHI |
| Microsoft Azure OpenAI | Bounded donor/imaging summaries and source-backed score-input reconciliation from validated structured Extend data | United States | BAA · may process PHI |
Changes
We will update this list before engaging a new subprocessor that processes PHI, and notify customers as required by their agreement. Questions: trust@organalert.com.