Source: https://vocarihealth.co/trust/subprocessors

# Subprocessors by purpose.

Vocari uses a limited set of service providers to operate the platform. Customer security reviews receive the applicable vendor register, data purpose, hosting region, and BAA status.

**Vendor-level register available during security review**

Publicly naming a provider does not prove that a BAA has been executed or that a specific product configuration is eligible for PHI. Vocari confirms both before production use.

## Cloud application hosting

Runs the customer-facing application and service endpoints.

Data category

Application and operational metadata

Requirement

Contract and BAA review where PHI applies

## Managed database infrastructure

Stores workspace, patient chart, insurance, configuration, and audit records.

Data category

Customer and patient data

Requirement

Contract and BAA review where PHI applies

## Voice and telecommunications processing

Handles authorized telephone interactions and real-time conversation processing.

Data category

Call audio in transit, transcripts, and workflow context

Requirement

Contract and BAA review where PHI applies

## Healthcare transaction processing

Processes authorized eligibility and benefits inquiries and responses.

Data category

Patient, provider, payer, and transaction data

Requirement

Contract and BAA review where PHI applies

## Transactional email

Delivers account invitations and password recovery messages.

Data category

User name, work email, and security-link metadata

Requirement

Contract and BAA review where PHI applies

Customers may request notice terms for material changes to relevant subprocessors in their executed agreement. Vocari will publish the named public register after vendor agreements and disclosure language are approved.