Subprocessors

A subprocessor is a third party that processes customer data on Modulon's behalf to help us provide the service. We choose each one carefully, review its security before we sign, and bind it by contract to protect the data it handles.

Each clinic's data is kept in its own region, and handled only by the subprocessors for that region. Every subprocessor that handles patient data is bound by the same restrictions our Business Associate Agreement or Data Processing Agreement places on Modulon, including that it may not use the data to train its models.

United States

For clinics in the United States. Patient data is stored and processed in the United States.

European Union and United Kingdom

For clinics in the EEA, Switzerland and the UK. EU clinics' data is stored in Germany, and UK clinics' data in London.

Gulf

For clinics in the six Gulf states. Data for the UAE, Qatar, Saudi Arabia and Kuwait is stored in the clinic's own country; data for Bahrain and Oman is stored in the UAE.

Every region

Services Modulon uses to run its own business, which hold no patient data.

AI models

Our AI providers process patient data under a Business Associate Agreement or Data Processing Agreement and a zero data retention arrangement: they do not store the content we send, and do not use it to train or improve their models. Modulon sends each request only the information that task needs, to models running in the clinic's region.

Payments

Stripe receives what it needs to take a payment, such as the patient's name, contact details, card and the amount due, but no diagnoses, visit reasons or other clinical information. In the United States, HIPAA exempts payment processing of this kind, so Stripe does not sign Business Associate Agreements, and Modulon keeps clinical detail out of every payment it creates. Card details go straight to Stripe and never touch Modulon's servers.

Email

Modulon uses Google Workspace for its own business email. Notifications that the platform emails to clinic staff carry no patient data; they say that something needs attention and link back into the platform, where staff sign in to see it.

When a clinic connects Modulon to its own systems, data moves between Modulon and those systems at the clinic's direction. Those vendors work for the clinic under the clinic's own agreements, so they are not Modulon subprocessors. Typical connections include:

Each connection is granted by a clinic administrator, is limited to the data the clinic's chosen features need, and can be disconnected at any time from the platform's settings.

We update this page before a new subprocessor begins handling customer data, and notify the clinics in the affected region at least 30 days before a new subprocessor begins handling patient data.

A clinic that objects on reasonable data protection grounds can raise its concerns with us, and we will work with it in good faith on an alternative. If we cannot find one, the clinic may end the affected services as its Business Associate Agreement or Data Processing Agreement provides. To be notified of changes, write to hello@modulonhealth.com.