Subprocessors
Effective June 9, 2026
Epithel is operated by Epithel Care, LLC. To deliver the service we rely on the third parties listed below. Every subprocessor that stores or transmits Protected Health Information ("PHI") is covered by an executed Business Associate Agreement ("BAA") that flows down the HIPAA obligations described in our BAA Notice.
| Subprocessor | Purpose | Data | Location | BAA |
|---|---|---|---|---|
| Lovable Cloud (managed Supabase infrastructure) | Application database (Postgres), authentication, private object storage, serverless functions | PHI — residents, wounds, photos, assessments, care plans, orders, audit logs | United States | Executed |
| Amazon Web Services, Inc. (via Lovable Cloud / Supabase) | Underlying compute, managed Postgres, and object-storage infrastructure operated by our platform provider | PHI at rest, AES-256 encrypted under enterprise KMS-managed keys | United States (us-east regions) | Executed (flow-down via Lovable Cloud) |
| Cloudflare, Inc. | Edge network, TLS termination, DDoS protection, serverless Worker runtime for SSR and server functions | PHI in transit (TLS-encrypted request/response bodies); no PHI at rest | Global edge; primary US regions | Executed |
| Stripe, Inc. | Subscription billing and payment processing for facility subscriptions | Billing contact and payment metadata only — no clinical PHI | United States | Not required (no PHI) |
| ElevenLabs, Inc. | Marketing-video voiceover generation (build-time only, non-runtime) | Anonymized / synthetic marketing script text only — no PHI, no resident data, no facility-identifying information | United States | Not required (no PHI) |
Change notice
Epithel will provide Customers with at least thirty (30) days' advance notice before engaging a new subprocessor that will store or transmit PHI, giving the Customer a reasonable opportunity to object as provided in the executed BAA.
Questions about this list may be directed to the account administrator for your facility, who can contact Epithel Care, LLC on your behalf.