01About this list#
A subprocessor is a company that handles personal information on MedTality's behalf to help us provide the service. We use as few as we can, give each one only what its job needs, and bind each one by contract to protect what it handles and use it for nothing else.
None of them is meant to receive patients' health information, because the MedTality app is not built to hold it. Our privacy policy explains what we collect and why.
02Current subprocessors#
Running the service
| Company | What it does | What it handles |
|---|---|---|
| Convex, United States | Database, server functions, sign-in and file storage | Everything stored in MedTality, including profiles, transcripts, scorecards, messages and uploaded documents |
| Vercel, United States | Hosts this website and the web app | Pages you request, your IP address and browser details |
| Cloudflare, United States | Stores images, through R2 | Profile pictures and organization logos |
| OpenAI, United States | AI models for the examiner, transcription, scoring and reading documents | Your voice during an assessment, transcripts, resumes, credential documents and role details, as each task needs |
| Malware scanning provider | Scans every uploaded file before it is accepted | Uploaded files |
| Mapbox, United States | Suggests addresses as you type | The address you type |
Messages and payments
| Company | What it does | What it handles |
|---|---|---|
| Resend, United States | Sends our emails | Your email address and the content of each email |
| Twilio, United States | Sends sign-in codes by text | Your phone number and the code |
| Expo, United States | Delivers notifications and updates to the mobile app | Your device's notification token and the notification |
| Stripe, United States | Takes payments and holds card details | Your name, email address, card and what you bought |
03Notes on specific providers#
AI models
OpenAI processes what we send to provide its service to us. It does not use it to train its models, we ask it not to store our requests, and under its terms it keeps API data only for a limited time to detect abuse. Your voice is streamed to it during an assessment and is not stored by MedTality.
Payments
You pay on Stripe's own checkout page, so card details go straight to Stripe and never reach MedTality. We receive only whether a payment succeeded, failed or was refunded, and a link to your receipt.
04Services you connect#
Some services take part only when you choose them. They act under their own terms and privacy policies, not as our subprocessors.
- Google, Apple and LinkedIn. If you sign in with one of them, it tells us your name, email address and profile picture.
- Google Calendar and Microsoft Outlook. If you connect one to schedule interviews, we read when you are busy, and add, change and cancel interview events, with Google Meet or Microsoft Teams links where you ask for them.
We also check credentials against official public sources, such as the National Provider Identifier registry run by the US Centers for Medicare & Medicaid Services. We send them only the number to check.
05Changes to this list#
We update this page before a new subprocessor begins handling personal information, and change the date at the top. An organization with a signed agreement with us is told of changes as that agreement sets out. For questions about this list, ask us through Support.