Subprocessor list
Status: Current as of October 2, 2026 · Notification: 30 days in advance · Subscribe: [email protected]
The third-party providers Burna AI uses to run the Burna AI platform, the Healthnotes app, the Care Journal app it operates for the Counted Voice Foundation, and burna.ai, with what each one receives, where it processes data and the agreement that covers it. Burna AI gives 30 days' notice before a new provider receives customer data.
Introduction
Burna AI uses the third-party service providers below (subprocessors) to deliver and support the Burna AI platform at app.burna.ai, the Healthnotes app, the Care Journal app (which Burna AI builds and operates for the Counted Voice Foundation) and the burna.ai website. For each provider, the register below shows what Burna AI uses it for, the data it receives, where it processes that data, whether that data can include protected health information (PHI), and the agreement that covers it.
Burna AI updates this list whenever a provider is added, removed, or changes what it receives. Customers may subscribe to change notifications by emailing [email protected].
How Burna AI's products use these providers
The Burna AI platform (app.burna.ai). Patient data is stored on Railway and in Cloudflare R2. Grading, attribution, chat and protocol work use the language model providers in the register. Microsoft Azure transcribes visit recordings once they upload. While a clinician records, the live transcript comes from the speech recognition built into the clinician's browser, which in Chrome and Edge runs on the browser maker's online service. Browserbase hosts the browser sessions used to file adverse event records into an EDC system. Plans are billed through Autumn, with card payments through Stripe.
Healthnotes. Healthnotes is used by people taking part in a clinical study. Its data is stored on Railway and in Cloudflare R2, and its Ask chat uses the language model providers in the register. PostHog records app analytics, and Expo provides its push notification service.
burna.ai. The website counts visits with PostHog without cookies. A conversation booked on burna.ai is scheduled through Cal.com. When someone signs up on a burna.ai form, Burna AI adds them to its email list in Resend, Exa researches publicly available information about them, OpenAI turns that research into a summary, a lead score and a draft reply, Notion stores the record, and Slack alerts the team. A Grade My Note submission is stored by Burna AI, and Slack alerts the team. Google Tag Manager, Google Analytics 4, the LinkedIn Insight Tag, Plausible and Apollo.io load only after a visitor selects Accept All on the cookie banner.
How to Read This List
Each table in the register has five columns:
- Provider: the company providing the service.
- Purpose and data: what Burna AI uses the service for, and the data it receives.
- Location: where the provider processes that data. "Provider's regions" means the provider chooses the region within its own infrastructure.
- PHI: whether that data can include Protected Health Information (PHI) under HIPAA.
- Agreement: the agreement that covers the data. BAA is a Business Associate Agreement under HIPAA. DPA is a data processing agreement Burna AI has executed with the provider. Data processing terms are the provider's own data processing terms. Standard terms are the provider's published terms of service.
Subprocessor register
Burna AI's products share one infrastructure, so one register covers all of them. Where a provider serves a single product, its purpose names that product.
Hosting, storage and network
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| Railway | Hosts every Burna AI application service, database and backup, including the database of record for patient data | United States (US East, Virginia) | Yes | BAA |
| Cloudflare R2 | Stores uploaded files, recordings and documents; serves public media and speech-model files | Provider's regions | Yes | BAA |
| Cloudflare | DNS, content delivery, network protection and image delivery for Burna AI's websites and services | Global edge network | Can pass through in transit | Same agreement as Cloudflare R2 |
| Upstash | Rate limiting using hashed request identifiers, and a cache of public reference documents | Provider's regions | No | Data processing terms |
AI model and speech providers
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| Anthropic | Language model inference for CTCAE grading and for causality and attribution assessment; receives the clinical text under assessment | Provider's regions | Yes | BAA |
| OpenAI | Language model inference and text embeddings for grading support, chat, assistants and protocol reading; receives the text, documents and images sent for an answer. On burna.ai, also summarises and scores website sign-ups and drafts replies | Provider's regions | Yes | BAA |
| Google (Gemini API) | Language model inference that keeps conversation memory for the assistants; receives conversation text | Provider's regions | Yes | BAA |
| OpenRouter | Routes requests to DeepSeek and Kimi (Moonshot AI) language models, used to read handwriting and marks on the drawing canvas and for lower-cost reasoning steps; passes each request to a host serving that model | Provider's regions | Yes | BAA |
| Microsoft Azure (Speech) | Transcribes visit recordings that clinicians make in the Burna AI platform; receives the recording audio | United States (East US) | Yes | BAA |
| xAI (Grok Voice) | Transcribes visit recordings that patients and caregivers make in the Care Journal app; receives the recording audio | Provider's regions | Yes | BAA |
Product services
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| Browserbase | Hosted browser sessions for filing adverse event records into an electronic data capture (EDC) system from the Burna AI platform; a session displays the subject's record, and its state is discarded when the session ends | United States | Yes, displayed and not stored | BAA |
| Autumn | Plans, entitlements and billing state for Burna AI platform plans, Protocol Studio plans and purchases on ctcae.ai | Provider's regions | No | DPA |
| Stripe | Card payments, taken on Stripe's own checkout | Provider's regions | No | DPA |
| Mux | Video hosting and playback on ctcae.ai | Provider's regions | No | Standard terms |
| Expo | Push notification service for Burna AI's mobile apps; receives the device's push address, and a notification carries only an identifier and a category | Provider's regions | No | Standard terms |
Email, scheduling and team communication
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| Resend | Email: sign-in codes, account and product notices, product-update and newsletter lists; receives names and email addresses, and clinical content stays behind a signed-in link | Provider's regions | No | Data processing terms |
| Cal.com | Scheduling for conversations booked on burna.ai, ctcae.ai and protocolstudio.ai; receives the name, email address and chosen time | Provider's regions | No | Standard terms |
| Slack | Internal alerts about website sign-ups, Grade My Note submissions and product feedback, and support requests with any screenshots the user attaches | Provider's regions | Possible, if a user includes it in feedback or a support screenshot | Data processing terms |
Website sign-ups on burna.ai
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| Exa | Researches publicly available information about a person who signs up on a burna.ai form, using the name, email address, organisation, role and message they submit | Provider's regions | No | Standard terms |
| Notion | Stores a record of each burna.ai sign-up with its research summary and lead score | Provider's regions | No | Standard terms |
Analytics and error reporting
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| PostHog | Product analytics and error reports. In the apps: page views, feature events and a pseudonymous user ID after sign-in. On the marketing websites: visit counts without cookies | United States (PostHog US cloud) | No | Data processing terms |
| Tinybird | Analytics events, de-identified before they are sent | United States (AWS US East) | No | Data processing terms |
burna.ai website tags
These load on burna.ai only after a visitor selects Accept All on the cookie banner. ctcae.ai and protocolstudio.ai each load one of them, Google Analytics 4: ctcae.ai on its public content pages, and protocolstudio.ai on every page except search.
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| Google (Tag Manager and Analytics 4) | Loads the tags in this table and measures website traffic | Provider's regions | No | Standard terms |
| LinkedIn (Insight Tag) | Measures website visits for LinkedIn advertising | Provider's regions | No | Standard terms |
| Plausible | Measures website traffic | Provider's regions | No | Standard terms |
| Apollo.io | Website visitor tracking | Provider's regions | No | Standard terms |
Sign-in and identity
Accounts and sign-in run on Burna AI's own systems, hosted on Railway. Sign-in codes are emailed through Resend.
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| Google (Sign in with Google) | Confirms a person's identity when they choose Sign in with Google, where a product offers it, and returns their name and email address | Provider's regions | No | Standard terms |
Other services
| Provider | Purpose and data | Location | PHI | Agreement |
|---|---|---|---|---|
| Business operations tools | Email, document signing, legal and professional services, and internal operations | Provider's regions | Not intended for PHI | Standard terms |
Services a customer or a person connects to Burna AI, such as an organisation's electronic health record system, a Google account or Apple Health, exchange data with Burna AI at their direction and are outside this list.
MODEL TRAINING NOTE Burna AI does not allow customer data to be used for model training or fine-tuning without explicit written consent from the customer for that specific use. Burna AI's agreements with its model providers exclude customer data from training by default. See the Responsible AI Statement for the full commitment.
Subprocessor onboarding process
Burna AI's vendor review standard asks for the following before a provider receives customer data:
- A security review of the provider's posture, using its SOC 2 report or ISO 27001 certificate where the provider has one.
- A privacy review of how the provider handles data, including the subprocessors it uses in turn.
- A record of the data the provider receives, its data class and an accountable owner at Burna AI.
- A Business Associate Agreement (BAA) before the provider receives PHI as part of the service.
- A data processing agreement, with Standard Contractual Clauses where personal data is transferred out of the EEA or UK.
Reviews repeat every year, and whenever the data a provider receives changes.
Notification of changes
Burna AI notifies customers of new subprocessors that may process customer data at least 30 days before the subprocessor is engaged. Customers may object to a new subprocessor in writing within the notification window; Burna AI will work with the customer to find an alternative or, if no alternative is feasible, the customer may terminate the affected portion of the engagement with a pro-rata refund.
Subprocessor change notifications are sent to customer-designated security contacts and posted on this page.
To subscribe to subprocessor change notifications without an active customer relationship, email [email protected] with the subject line "Subprocessor Change Notifications."
Contact
For questions about Burna AI's subprocessors, processing locations, or data handling practices, reach the inboxes below. They also cover privacy review, security questionnaires, and subscription to subprocessor change notifications.
- Privacy questions: [email protected]
- Security questions: [email protected]
- General inquiries: [email protected]
Questions about this document go to [email protected].