Vocenya (DRAKB LLC, doing business as Vocenya and GH Business Solutions) uses the service providers below to run the Services. Each one processes customer data only to provide its part of the Services, under a contract that limits how it may use the data. This list is part of our Data Processing Addendum and Privacy Policy.
HIPAA-mode accounts. For healthcare customers in HIPAA mode, the code only uses the providers marked "Yes" in the last column. Providers marked "Never" are switched off for those accounts: for example, calls in HIPAA mode always use the Standard voice engine on AWS, so ElevenLabs, Deepgram and Cartesia are never used, and WhatsApp can't be connected.
Infrastructure and AI
| Sub-processor | Purpose | Data | Location | HIPAA-mode accounts |
|---|---|---|---|---|
| Amazon Web Services | Hosting (servers, database, cache, file storage with encryption keys), the Standard voice engine (Amazon Nova Sonic on Amazon Bedrock), Claude models on Amazon Bedrock, spoken call briefings (Amazon Polly), and receiving email for HIPAA-mode inboxes (Amazon SES) | All customer data, including call audio, recordings, transcripts, messages and leads | United States (us-east-1; AI capacity may overflow to another US region) | Yes |
| Anthropic | Claude AI models, used directly when Amazon Bedrock is unavailable: summaries, chat replies, knowledge extraction and the account assistant | Conversation content (transcripts, chats and messages) and business settings | United States | Yes |
| Laravel (Forge) | Server provisioning and deployment for the hosts on AWS | Server access; no customer data is sent to it | United States | Yes (server access only) |
Voice, calling and messaging
| Sub-processor | Purpose | Data | Location | HIPAA-mode accounts |
|---|---|---|---|---|
| Telnyx | Phone numbers, call connection and media, softphones, text messaging (SMS and carrier registration) and caller name lookups | Phone numbers, call audio in transit, call details, text messages | United States | Yes (texts are limited to short notices with no health details) |
| ElevenLabs | Studio voices (text-to-speech and speech recognition) on calls, custom voices made from a voice sample, and transcribing WhatsApp voice notes | Call audio and transcripts on Studio calls; voice samples | Vendor's cloud | Never |
| Deepgram | Backup speech recognition and text-to-speech on Studio calls | Call audio and text on Studio calls | Vendor's cloud | Never |
| Cartesia | Backup text-to-speech on Studio calls | Text the receptionist speaks | Vendor's cloud | Never |
| Meta Platforms (WhatsApp) | The WhatsApp channel, for businesses that connect WhatsApp | WhatsApp messages and media, phone numbers | Vendor's cloud | Never (WhatsApp can't be connected in HIPAA mode) |
| TypeSafe | Fast text classification (for example matching a question to an FAQ). Not enabled today | Message text and FAQs | United States | Never |
Email, payments, notifications and sign-in
| Sub-processor | Purpose | Data | Location | HIPAA-mode accounts |
|---|---|---|---|---|
| Cloudflare | DNS, security and delivery for our website and portal (web traffic passes through its network), bot checks on forms (Turnstile), sending our emails, and receiving email for non-HIPAA inboxes | Web traffic in transit, email addresses and email content | Global network | Yes for web traffic in transit; emails to HIPAA-mode accounts leave out patient details, and HIPAA-mode inboxes don't use it |
| Stripe | Subscriptions, invoices and payments, and partner payouts | Billing contact and payment details (card numbers are held by Stripe, never by us) | United States | Billing data only |
| Expo, Apple and Google | Push notifications to the Vocenya app and browsers, and Sign in with Apple and Google | Device tokens, notification text, sign-in profile (name and email) | United States | Yes, with notification text that leaves out patient details |
| Finding your business on Google during signup (Places API) | Business name and address searches | United States | Yes (no caller or patient data) |
Our own team
| Sub-processor | Purpose | Data | Location | HIPAA-mode accounts |
|---|---|---|---|---|
| GH Business Solutions (our affiliate) | Trained live agents who answer calls and chats handed to a person (GH Live), and customer support | Calls and chats handed to them, with the caller's details and the AI's summary | United States and the Philippines | Yes, when the practice uses GH Live |
Integrations you connect
When you connect another product, such as Google Calendar, Microsoft 365, Acuity Scheduling, Jobber, Housecall Pro, ServiceTitan, HubSpot, Salesforce, Calendly, Cal.com, Slack, Notion or Shopify, we send it the data that integration needs on your instruction. Those products are your vendors, not our sub-processors, and their own terms apply. In HIPAA mode, an integration only receives caller details after you confirm you have a business associate agreement with that vendor, and some (such as Notion, Shopify and WhatsApp) can't be used at all.
Changes to this list
We will update this page before a new sub-processor starts processing customer data. Customers who want notice of changes can email [email protected] to be added to our notification list.