A structured summary of CUBE OneCare data processing activities — data subjects, categories, purposes, lawful bases, processors, and cross-border transfers.
Individuals using CUBE OneCare patient portal or mobile app
Clinicians and healthcare professionals using provider portal
Organization admins managing CUBE OneCare deployment
Visitors to cubeonecare.com marketing website
Summary of data processing activities, their purposes, and lawful bases.
| Activity | Data Categories | Purpose | Lawful Basis | Retention |
|---|---|---|---|---|
| Patient Engagement | Name, email, phone, DOB, health preferences, care plan data | Care coordination, appointment management, health reminders | Contractual necessity + consent | Active + 7 years post-termination |
| Provider Management | Name, email, NPI, credentials, schedule, clinical notes metadata | Provider onboarding, scheduling, clinical workflow support | Contractual necessity | Active + 7 years post-termination |
| Benefits Analytics | Aggregated utilization data, plan enrollment, claims summaries | Population health insights, benefits optimization | Legitimate interest + contractual necessity | Active + 3 years post-termination |
| AI-Assisted Insights (CUBE Assist) | User queries, context window, generated responses, confidence scores | Health navigation, care coordination assistance | Consent + contractual necessity | Active + 1 year (audit logs: 3 years) |
| Authentication & Security | Email, hashed passwords, MFA tokens, session data, IP addresses | User authentication, security monitoring, fraud prevention | Contractual necessity + legitimate interest | Active + 1 year (security logs: 2 years) |
| Website Analytics | Anonymous session ID, page views, device type, referrer (no PII) | Product improvement, conversion optimization | Legitimate interest + consent | 90 days (anonymized aggregates retained longer) |
| Transactional Communications | Email address, notification preferences, message content | Account notifications, appointment reminders, security alerts | Contractual necessity | Active + 30 days (delivery logs: 1 year) |
| Category | Purpose | DPA Coverage |
|---|---|---|
| Cloud Infrastructure | Hosting, compute, storage, database | DPA listed for some vendors in the annex |
| CDN / Edge | Content delivery, DDoS protection | No DPA or BAA recorded in annex |
| Email Delivery | Transactional email notifications | No DPA or BAA recorded in annex |
| Monitoring | Application performance monitoring | No DPA or BAA recorded in annex |
| Security | Penetration testing, vulnerability scanning | No DPA or BAA recorded in annex |
All primary data processing occurs in the United States. Where subprocessors have global infrastructure, data may transit through additional jurisdictions. The DPA template includes cross-border transfer provisions; where an SCC instrument is required, it is agreed and executed in the contract. No SCC instrument is executed by default, and no PHI is stored outside the US without explicit customer authorization.
Disclaimer: This data processing inventory is a summary for transparency purposes. It does not constitute a contractual commitment. Specific data processing terms are governed by the Data Processing Agreement (DPA) between your organization and CUBE Collective LLC. Categories of subprocessors are disclosed, and the sub-processors themselves are named in the sub-processor annex and on the Trust Center sub-processors page. CUBE Collective LLC, 30 N Gould St. Ste. R, Sheridan, WY 82801, USA.