Legal
Data Processing Addendum
Our DPA, BAA-equivalent terms, SCCs, and sub-processor list. Available pre-signed at contracting.
GDPR + HIPAA aligned
Combined BAA and DPA executed at contract signing; one document covers EU and US frameworks.
Standard Contractual Clauses
EU SCCs (Module 2 & 3) attached for any data transfer outside the customer's chosen region.
Sub-processor registry
Maintained, versioned list with 30-day advance notice for new sub-processors. Right to object.
Single point of contact
DPO: dpo@medflow.ai · Security: security@medflow.ai · Legal: legal@medflow.ai
Sub-processors
We notify customers at least 30 days before adding a new sub-processor. Customers may object in writing.
| Sub-processor | Purpose | Location |
|---|---|---|
| AWS | Primary hosting (multi-region) | Customer-selected region |
| Cloudflare | Edge security, DDoS, WAF | Global |
| Datadog | Telemetry & observability | Region-matched |
| Twilio | SMS / WhatsApp notifications | Region-matched |
| Resend | Transactional email | Region-matched |
Onboard in under 4 weeks
Ready to modernize your hospital operations?
Schedule a 30-minute walkthrough tailored to your specialty mix, bed count, and billing model.
No card required
Live data sandbox