Service Providers (Sub-processors)

These companies process personal information on HEAL’s behalf. The data shown is the most each one can access.

Apple and Google deliver push notifications to phones as part of their operating systems. Expo hands notifications to them, with the same generic text. Cloudflare Turnstile’s bot check runs in a frame on our sign-up and sign-in pages.

The website chat guide. The chat on teleheal.com is answered by an AI model: Anthropic’s Claude when it’s configured, otherwise OpenAI, otherwise our own built-in answers with no AI provider at all. Before any message is kept or sent, our server removes names, email addresses, phone numbers, street addresses and long numbers. Messages that look like a crisis, a medical question, a request to pick a treatment center or an attempt to change the guide’s rules are answered by HEAL directly and never reach a model. What is sent is the scrubbed conversation and our site’s own help text, from our server, so the provider doesn’t see your IP address or cookies. The chat is open to anyone and isn’t linked to a HEAL account. We keep the open conversation only for a short time after the last message (or until you end it) and then only anonymous daily counts. When an OpenAI key is configured, OpenAI’s moderation service also screens scrubbed messages.

Stripe processes payments for the shop and for Supporter plans, and hosts the Customer Portal where supporters update their card and download invoices. Card details are entered straight into Stripe; HEAL never receives full card numbers. Stripe runs fraud checks using device and network information, and, where we switch it on, calculates sales tax from the shipping address. For fraud prevention and its own legal obligations, Stripe acts as an independent controller of some payment data under its own privacy policy, which is why it appears here and is also named in our Privacy Policy.

Printful prints, packs and ships shop orders, which are made to order. It receives the recipient’s name, shipping address, phone number (if given) and the items. It may make an order at the facility nearest the delivery address, which can be outside the US, and it hands packages to postal and courier carriers, who see what’s on the label. Printful never receives payment details or anything from your HEAL account. Members who never shop share nothing with Printful.

Google Analytics runs only with advertising storage, ad user data and ad personalization denied. On the website it follows your cookie choice and Global Privacy Control. From the mobile app, our server forwards only app opens, sessions, screen names, errors and performance timings, keyed to a random install ID, never your account ID.

HEAL is a small, free community. Running our own data centers, email servers or global audio network wouldn’t be safer or sensible. Instead we choose established providers for each job, and design HEAL so that each one sees as little as possible. The most sensitive information, your private writing, is sealed before any provider stores it.

Before we use a provider, we look at:

• whether we can avoid sending them personal information, or send less;
• their security practices, including encryption, access controls, independent audits and their record on incidents;
• where they process data, and whether they’ll accept the contract terms below;
• whether their business model depends on using customer data for their own purposes. If it does, we don’t use them for member data.

We review each provider at least once a year, and whenever its service or terms change materially.

We put a data processing agreement (DPA) in place with every provider that handles member data, before member data reaches them. The agreements require them to:

• process personal information only on our documented instructions, and only to provide their service to HEAL;
• not sell or “share” it, or use it for their own purposes, including advertising or training products;
• keep it confidential and secure, and limit access to their staff who need it;
• tell us promptly about any security incident affecting it;
• help us respond to your rights requests, including deleting your data when we ask;
• bind their own sub-processors to the same obligations;
• delete or return the data when the service ends.

These terms are designed to meet the service-provider and processor requirements of the CCPA/CPRA, Washington’s My Health My Data Act and other state laws, and the GDPR and UK GDPR. Where data leaves the EEA, UK or Switzerland, the agreements include the Standard Contractual Clauses or rely on the provider’s Data Privacy Framework certification. For Google Analytics, we rely on Google’s data processing terms for its analytics products, and for Stripe and Printful, on their data processing terms for business customers.

Before a new provider starts processing member data, or an existing one takes on a materially different role, we update this page. We aim to do this at least 30 days ahead, except where a change is urgent, for example to keep HEAL secure or running after a provider fails. In that case we update the page as soon as we can, and explain why.

Get updates by email: send a message to privacy@teleheal.com with “Subscribe: service provider updates” in the subject. We’ll email you whenever this list changes, and use your address for nothing else. Reply “Unsubscribe” at any time. Significant changes are also announced in the app.

If you have a concern about a new or existing provider, email privacy@teleheal.com and tell us why. We’ll answer in writing, explain the safeguards in place, and consider whether we can address it, for example by limiting what that provider receives.

If we can’t resolve it, you can stop the processing affecting you by switching off the related feature (for example, turning off analytics in Cookie settings or turning off notifications), or by exporting and deleting your account as described in Your Data Rights & Deletion.

• People you share with, such as share-link recipients, help-board members and people in a meeting. They aren’t service providers. The Privacy Policy explains what they see.
• Postal and courier carriers that deliver shop orders. Printful chooses and hands packages to them, and they see only what’s on the shipping label.
• Authorities who serve legal process. See our law enforcement guidelines.
• Websites we link to, such as a listed provider’s site or a crisis line, which have their own policies.
• Location lookup: we work out a city-level location from IP addresses with a database file (MaxMind GeoLite2) stored on our own servers. No IP address is sent to MaxMind.

Questions about our providers, or a request for a copy of the relevant contract terms: privacy@teleheal.com.