SMILE EDITOR — SUBPROCESSOR LIST
Status: TEMPLATE — must be completed from production architecture before publication
Smile Editor uses third parties to provide infrastructure and business services. This list must accurately identify material providers that process personal data on Smile Editor's behalf.
| Provider | Legal entity | Purpose | Data categories | Patient Data? | Processing region | Transfer mechanism | BAA required/available? | Status |
|---|---|---|---|---|---|---|---|---|
| Supabase | [VERIFY] | Database/auth/storage | Account + possibly Customer Data | [VERIFY] | [VERIFY] | [VERIFY] | [VERIFY] | Pending |
| Lovable | [VERIFY WHETHER PRODUCTION DATA IS PROCESSED] | App development/hosting as applicable | [VERIFY] | [VERIFY] | [VERIFY] | [VERIFY] | [VERIFY] | Pending |
| Stripe | [VERIFY ENTITY] | Payments | Billing/account | No clinical data intended | [VERIFY] | [VERIFY] | N/A for PHI if PHI prohibited | Pending |
| Email provider | [SELECT] | Transactional email | User contact/account | No Patient Data intended | [VERIFY] | [VERIFY] | [VERIFY] | Pending |
| Analytics provider | [SELECT] | Product analytics | De-identified/technical only | Must be No | [VERIFY] | [VERIFY] | N/A if no PHI | Pending |
| Error monitoring | [SELECT] | Reliability/security | Technical metadata | Must be minimized | [VERIFY] | [VERIFY] | [VERIFY] | Pending |
| AI provider | [SELECT IF USED] | AI feature processing | Feature-specific | [VERIFY PER FEATURE] | [VERIFY] | [VERIFY] | Required if PHI and HIPAA applies | Pending |
Rules
- Never list a provider merely because it is popular; list what production actually uses.
- Never send Patient Data to analytics/advertising providers.
- For each AI provider, document:
- exact API/product;
- retention;
- training use;
- region;
- DPA;
- BAA if required;
- deletion behavior.
- Maintain a change-notification process for material subprocessors when law/DPA requires it.
- Separate "business vendor" from "subprocessor": a provider that never processes Customer Personal Data may not be a DPA subprocessor.