Subprocessors and External Data Providers
1. Purpose
This page describes categories of third parties that may receive information in connection with DyZen Med, operated by DyZen Med LLC (“DyZen Med,” “we,” “us”). It supplements the Privacy Policy.
Not every listed provider is a HIPAA “subprocessor” under a Business Associate Agreement. Some are infrastructure or AI processors that may receive customer content or PHI depending on the feature used. Others are external terminology or clinical-reference services that may receive only minimized clinical search concepts.
2. How to read this list
- Customer content / PHI: may receive uploaded records, audio, transcripts, generated artifacts, or account-linked clinical content, depending on the feature.
- Minimized clinical concepts: may receive short, sanitized clinical search terms derived from Opinion Intelligence recommendations — not raw chart dumps or unnecessary patient identifiers by design.
- Account / operational: may receive account, billing, authentication, or support metadata.
- Feature-dependent: used only when the related feature is enabled or invoked.
Provider availability and returned information may vary. DyZen Med does not guarantee that every external source will return results for every query.
3. Infrastructure and customer-data processors
| Provider | Role | Typical data |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, compute, object storage, networking | Customer content / PHI and operational data as stored and processed in the Service |
4. AI, transcription, and clinical-document processing
| Provider | Role | Typical data |
|---|---|---|
| OpenAI | AI-assisted organization, summarization, and drafting features | Customer content / PHI as needed to perform the requested assistive task (feature-dependent) |
| AWS HealthScribe | Exam/dictation audio processing and clinical documentation organization | Audio and related clinical content when HealthScribe exam capture is used |
DyZen Med is designed so customer data is not used to train public or shared AI models. Model-provider processing is subject to applicable agreements and configuration.
5. Payment and communications
| Provider | Role | Typical data |
|---|---|---|
| Stripe | Payment processing and billing | Account / billing information (not clinical chart content) |
| Amazon SES | Transactional email delivery | Email addresses and transactional message content |
| Amazon SNS | SMS delivery for authentication and security messaging | Phone numbers and short authentication/security messages |
6. External terminology and clinical-reference services
These services support Opinion Intelligence when clinical-evidence features are enabled. They are external clinical-information providers, not listed here as HIPAA subprocessors solely because a minimized query may be sent. See also Clinical Evidence Sources and Attribution.
| Provider | Role | Typical data |
|---|---|---|
| UMLS / UTS (NLM) | Terminology normalization and evidence-query expansion within Opinion Intelligence | Minimized clinical concepts (feature-dependent). A UMLS match is not clinical evidence. |
| PubMed / NCBI | Literature metadata and abstracts for advisory references | Minimized clinical search concepts |
| Europe PMC | Literature metadata for advisory references | Minimized clinical search concepts |
| ClinicalTrials.gov | Public trial registry information (category-dependent) | Minimized clinical search concepts |
| DailyMed | Drug labeling / SPL references (category-dependent) | Minimized medication/clinical concepts |
| openFDA | Drug-label and related safety labeling references (category-dependent) | Minimized medication/clinical concepts |
SNOMED CT and RxNorm identifiers may be obtained through UMLS where available. Returned references do not constitute DyZen Med conclusions and do not replace physician evaluation.
7. Optional or configuration-dependent providers
Additional AWS AI or NLP services (for example, Amazon Bedrock or Amazon Comprehend Medical) may be used only if explicitly enabled in configuration. If enabled, they will be treated as processors of customer content for the features that invoke them and disclosed accordingly.
8. Changes
DyZen Med may update this list as providers change. Material changes will be reflected on this page and, where appropriate, communicated under the Privacy Policy notice practices.
This page is an engineering/product disclosure draft prepared for subsequent counsel review. It is not a certification of HIPAA compliance.