Template document — for legal-counsel review.
This page is boilerplate that CUBE OneCare customers and counsel are expected to adapt to their specific jurisdiction, use case, and contractual arrangements with CUBE Collective LLC. It is provided for transparency about the platform's policies and is not an executed agreement until separately signed.
Legal
Third parties engaged to help operate CUBE OneCare, with purpose, data category, location, and compliance posture.
CUBE Collective LLC engages a small number of carefully vetted subprocessors to operate CUBE OneCare. This page is the authoritative, up-to-date list. Any material change triggers a 30-day advance notice to enterprise customers under the terms of the Data Processing Addendum.
The table below reflects the subprocessors engaged by CUBE Collective LLC to operate the CUBE OneCare platform, along with the purpose, category of data they process, the country where the primary data-processing activities occur, and their compliance posture. Where a Data Processing Agreement or Business Associate Agreement is on record for a subprocessor, that status appears in the compliance column; it is not assumed for every vendor. The standard CUBE OneCare platform is HIPAA-aligned by architecture and processes no Protected Health Information (PHI) by default: PHI processing requires a Business Associate Agreement executed directly with CUBE, individually scoped and contracted per client, and the subprocessors below handle PHI only within that signed BAA's scope. Compliance and certification packages are likewise requested and delivered through that per-client BAA engagement rather than included in the standard platform. Large healthcare institutions that require a dedicated, compliance-hardened environment may request a separately scoped white-label infrastructure option. That option is contracted separately and is not part of the default subprocessor path described below.
| Subprocessor | Purpose | Data category | Location | Compliance |
|---|---|---|---|---|
| Fly.io, Inc. | Primary infrastructure — compute, managed Postgres, managed key-value store, automated backups | All platform data, encrypted at rest. PHI processing requires a Business Associate Agreement executed directly with CUBE, scoped and contracted per client. | United States (Virginia) | SOC 2 Type 2, no CUBE BAA signed with this vendor today (the only signed BAA is with Stedi; the others are pending and will be published in the CUBE control panel when available, and until then OneCare does not process real PHI), GDPR DPA available, hardware hosted in ISO 27001-certified datacenters |
| Cloudflare, Inc. | CDN, DDoS protection, WAF, Turnstile CAPTCHA | Request metadata, IP addresses, Turnstile challenge tokens | United States | SOC 2 Type II, ISO 27001; no CUBE BAA is signed with this vendor today; the only signed BAA is with Stedi; this vendor's BAA is pending and will be published in the CUBE control panel when available; until then OneCare does not process real PHI |
| Amazon Web Services, Inc. | Object storage for encrypted clinical attachments and platform file assets (S3) | Encrypted clinical attachments and platform file uploads. PHI processing requires a Business Associate Agreement executed directly with CUBE, scoped and contracted per client. | United States | SOC 2 Type II, ISO 27001, PCI DSS Level 1, HIPAA-eligible service (no CUBE BAA is signed with this vendor today; the only signed BAA is with Stedi; this vendor's BAA is pending and will be published in the CUBE control panel when available; until then OneCare does not process real PHI) |
| Amazon Web Services, Inc. (Amazon SES) | Backup transactional email delivery — used only when configured primary email providers are unavailable | Email addresses and message content for transactional and operational mail sent through this backup path. PHI processing requires a Business Associate Agreement executed directly with CUBE, scoped and contracted per client. | United States | ISO/IEC 27001:2022, 27017:2015, 27018:2019 certified; listed on AWS's HIPAA Eligible Services Reference (AWS HIPAA-eligible services list; no CUBE BAA is signed with this vendor today; the only signed BAA is with Stedi; this vendor's BAA is pending and will be published in the CUBE control panel when available; until then OneCare does not process real PHI) |
| Stripe, Inc. | Payment processing — CUBE's own direct charges (licences and website checkout), for which CUBE is the merchant of record, and Stripe Connect for tenant collections, where the tenant is the merchant of record and CUBE receives a platform commission | Billing contact and payment method for CUBE's direct charges. For Stripe Connect collections, transaction metadata and the platform commission; the tenant is the merchant of record for those charges. | United States | PCI DSS Level 1, SOC 2 Type II |
| Foundation model provider — clinical inference | Routed by CUBE Mind for clinical documentation assistance and CUBE Assist | Prompt + completion payload (scrubbed of direct identifiers where possible); no training on customer data | United States | SOC 2 Type II, zero-retention endpoint; HIPAA BAA in negotiation, not executed |
| Foundation model provider — operational inference | Routed by CUBE Mind for selected operational AI flows | Prompt + completion payload under enterprise zero-retention terms; no training on customer data | United States | SOC 2 Type II, zero-retention endpoint; HIPAA BAA in negotiation, not executed |
| Foundation model provider — multimodal inference | Routed by CUBE Mind for multimodal features | Prompt + completion payload under enterprise data-processing terms; no training on customer data | United States | SOC 2 Type II, ISO 27001; HIPAA BAA in negotiation, not executed |
| Resend, Inc. | Transactional email (account verification, password reset, appointment reminders), operated redundantly with SendGrid — either provider may deliver a given message, and both may be active | Email address, subject line, body (no PHI beyond appointment metadata) | United States | SOC 2 Type II; HIPAA BAA in negotiation, not executed |
| Twilio SendGrid, Inc. | Transactional email delivery, operated redundantly with Resend — either provider may deliver a given message, and both may be active | Email address, subject line, body (no PHI beyond appointment metadata) | United States | No SCC instrument pre-executed; the transfer safeguard is agreed and executed in the contract before any EU-to-US transfer |
| Twilio, Inc. | SMS, voice, and telephony services for multi-factor authentication, appointment reminders, and clinic PBX | Phone number, message text (no free-form PHI) | United States | SOC 2 Type II; HIPAA BAA offered by the vendor, not executed by CUBE |
| Sentry (Functional Software, Inc.) | Application error monitoring and performance telemetry | Stack traces, request metadata, user identifiers (scrubbed of free-form PHI by design) | United States | SOC 2 Type II; HIPAA BAA offered by the vendor, not executed by CUBE |
| Fly.io, Inc. | Hosting for the marketing website (cubeonecare.com) — no PHI | Public website traffic and build artifacts | United States (Virginia) | SOC 2 Type 2, hardware hosted in ISO 27001-certified datacenters |
| PostHog, Inc. | Privacy-preserving product analytics on the marketing website (opt-in) | Aggregated event data from public marketing site only — disabled inside signed-in product portals | United States | SOC 2 Type II |
| Stedi, Inc. | Healthcare EDI clearinghouse — eligibility (270/271), claims (837), remittance (835) | Patient demographics, coverage identifiers, claim and remittance payloads | United States | SOC 2 Type II; HIPAA BAA executed with CUBE |
| Photon Health, Inc. | Electronic prescribing and pharmacy routing | Prescriber identity, patient identifiers, prescription content | United States | HIPAA BAA offered by the vendor, not executed by CUBE |
| Metriport, Inc. | Medical-record retrieval and exchange (FHIR) | Patient identifiers and retrieved clinical records | United States | HIPAA BAA offered by the vendor, not executed by CUBE |
| Validic, Inc. | Connected-device and wearable data ingestion | Device readings and the patient identifier they are keyed to | United States | HIPAA BAA offered by the vendor, not executed by CUBE |
| Sketchfab (Epic Games, Inc.) | Third-party 3D viewer embedded in the provider anatomy explorer | Viewer IP address and browser metadata only — no CUBE data is sent | United States | No agreement recorded; embed receives only what any third-party iframe receives |
| OpenStreetMap Foundation | Pharmacy location lookup and map tiles in the patient portal | Search location or map viewport, and the viewer's IP address. No patient identifier is sent | United Kingdom | Open data service; no agreement recorded. Queries carry a location, so this row is disclosed as a processor rather than a passive embed |
| Unsplash, Inc. | Stock photography served on public marketing pages | Viewer IP address and browser metadata only | United States | No agreement recorded; the image request receives only what any third-party image host receives |
| Google LLC (user content CDN) | Profile avatars for accounts that signed in with Google | Viewer IP address and the avatar URL of the signed-in account | United States | No agreement recorded; avatar delivery only, no CUBE data is sent |
| GitHub, Inc. (avatar CDN) | Profile avatars for accounts that signed in with GitHub | Viewer IP address and the avatar URL of the signed-in account | United States | No agreement recorded; avatar delivery only, no CUBE data is sent |
| GitHub, Inc. | Source-code hosting | Engineering source code and build artifacts (no customer data) | United States | SOC 2 Type II, ISO 27001 |
CUBE OneCare is aligned with HIPAA as a platform. Processing PHI requires a Business Associate Agreement executed directly with the client. CUBE's own Business Associate Agreement with its infrastructure hosting provider has not yet been executed; no PHI is processed on that hosting platform until it is.
Per our Data Processing Addendum, we notify enterprise customers at least thirty (30) days in advance of adding or replacing a material subprocessor. Customers may subscribe to the change feed by emailing [email protected].
Controllers subject to GDPR, UK GDPR, or Swiss FADP may object in writing to a proposed new subprocessor on reasonable data-protection grounds within the 30-day notice window. If we cannot accommodate the objection, the customer may terminate the affected service for convenience, with a prorated refund of any prepaid fees.