Subprocessors

Last updated August 27, 2026

These are the third parties Cara relies on to run the service. The table lists what each one handles and whether a data protection agreement covering health information is in place. We publish this before a vendor receives any client data, and we keep the status honest rather than aspirational.

Supabase (database, authentication, storage)

Can receive health informationAgreement not yet signed

Primary application database, sign-in, and file storage.

Data handled: All account data and all client records, including care details and transcripts.
Region: United States

Cloudflare (application hosting and network)

Can receive health informationAgreement not yet signed

Serves the application and terminates TLS.

Data handled: Request metadata and data in transit.
Region: Global edge

Twilio

Can receive health informationAgreement not yet signed

Phone numbers, inbound and outbound calling, SMS delivery.

Data handled: Phone numbers, call metadata, call audio, message content.
Region: United States

ElevenLabs

Can receive health informationAgreement not yet signed

AI voice receptionist: speech recognition and speech synthesis.

Data handled: Call audio and transcripts of inquiry conversations.
Region: United States

OpenAI and Google (via the Lovable AI Gateway)

No health informationAgreement not yet signed

Lead scoring, follow-up drafting, and the AI assistant.

Data handled: Redacted summaries only by default: initials, a coarse care category, location, hours, and funding type. Full detail is sent only if an agency explicitly enables full-content AI processing.
Region: United States

Resend

No health informationNot required (no health information)

Transactional and notification email delivery.

Data handled: Recipient address and non-clinical notification content. Cara does not place care details, transcripts, or dates of birth in email.
Region: United States

Stripe

No health informationNot required (no health information)

Subscription billing and payment processing.

Data handled: Agency billing contact and payment details. No client records.
Region: United States

Google (Places, Calendar)

Can receive health informationAgreement not yet signed

Business lookup during setup, and assessment scheduling when connected by the agency.

Data handled: Business listing data; calendar event titles and times when the agency connects a calendar.
Region: United States

ShiftCare, AlayaCare, AxisCare

Can receive health informationNot required (no health information)

Agency-initiated sync of converted clients into the agency's own care management system.

Data handled: Client name, contact details, and date of birth, pushed only at the agency's direction.
Region: Per vendor

Questions about this list, or want notice before we add a vendor? Email privacy@trycara.io.