The service providers that process personal information on our behalf, the function each performs, and the jurisdiction in which that processing takes place. One of them has access to patient records.
Last updated: August 30, 2026
Praxio processes personal information on behalf of the pharmacies and clinics that use its services, including health information concerning their patients. Where a third party carries out part of that processing on our instructions, that party is a sub-processor. This page identifies each of them.
Section 5 of the privacy policy summarises this information for prospective customers. This page sets out the detail required for a privacy impact assessment: each service engaged, the function it performs, the categories of personal information disclosed to it, and the jurisdiction in which the processing takes place.
This list is complete as at the date shown above. No party outside it processes personal information on our behalf.
The clinical data entered into the service, together with the patient details associated with it, is held in the database and is disclosed nowhere else. Google Cloud hosts that database. No other service listed on this page receives a patient record, and none is asked for one. The region in which an account is held is shown in the account, under Settings → Data Residency. Where an account is configured to hold its records on a single computer belonging to the customer, no sub-processor receives them at all, as those records do not leave that computer. That configuration supports one computer and one user, and accordingly permits neither colleague access nor the sharing of patients.
The remaining services support the ordinary administration of an account: authentication, billing, email delivery and support correspondence. That boundary was established by design rather than identified afterwards, and it is the reason a single service provider, rather than seven, is in a position to read a patient record.
Before entrusting personal information to a service provider we assess the protection available in the jurisdiction it operates in, as Quebec's Law 25 requires, and we take the provider's published data-processing terms, which oblige it to act on our instructions and to keep what it holds confidential.
One entry constitutes an exception, which we state expressly. Telegram is a consumer messaging service and is not covered by a data-processing agreement. It is used solely to deliver a notification that a support conversation has begun. The notification accordingly contains a short extract and a link rather than the conversation, and the conversation itself remains within our own administrative interface.
Most of the services listed operate in the United States. We disclose this expressly rather than imply a protection we are not in a position to provide: a United States provider may be subject to lawful orders issued by United States authorities irrespective of where data is physically held. The location in which patient records are stored determines which jurisdiction holds them; it does not place a provider beyond the legal process of another jurisdiction.
A new sub-processor is published on this page at least 30 days before it begins processing personal information, and the account holder is notified by email when the list changes. The date shown at the top of this page is the date on which the list last changed.
If a change is not acceptable to you, you may object before it takes effect. Where the matter cannot be resolved, you may terminate the subscription; billing is monthly and no penalty applies on termination.
One exception applies, stated here in advance. Where a provider fails, or a security incident requires immediate replacement, the change is made first, published on this page as soon as practicable, and notified to you together with an account of what occurred.
Four matters that might be expected to appear on this list, with the reason each is excluded:
Enquiries concerning any matter on this page may be addressed to us, including a request to identify the parties to whom a particular record has been communicated. Law 25 confers a right to that information, and we will provide it in writing rather than require it to be inferred from this list.