SLP Nova Subprocessors and Ancillary Providers
Version 2026-10-launch-subprocessors-v4 · Last updated October 8, 2026.
Clinical processing is limited to the Microsoft services below. Nonclinical providers receive only the adult account, operational or generic public-asset information needed for their function. Their inclusion does not authorize clinical data in billing, email, authentication or public caches.
| Provider | Function and data boundary | Processing and retention |
|---|---|---|
| Microsoft Azure — App Service, PostgreSQL Flexible Server, private Blob Storage, Key Vault, Monitor/Application Insights and Entra | Clinical application, records, private audio, controlled assets, security and administration. Runtime/personnel access is limited to the service and lawful duties. | Core clinical resources: East US 2, United States. Active clinical deletion follows the Retention Policy; PostgreSQL backups have a 14-day rolling window. Other restricted storage/security copies follow their configured cycles and documented lawful exceptions. |
| Microsoft Azure OpenAI | Minimized context for requested report drafts, planning and assistants, with safety processing. No direct OpenAI API clinical path. | Model processing may occur in other Microsoft regions, including outside core hosting. Default monitoring can retain flagged prompts/completions and permit authorized human review under Microsoft's applicable terms. No clinical model-training permission or zero-retention promise is granted. |
| Microsoft Azure AI Speech | Fast Transcription for requested session audio and speaker separation for clinician review. Separately, prebuilt neural text to speech generates game prompt audio from curated, non-identifying words only; no customer clinical data or session recordings enter game synthesis. | US-region clinical service. Microsoft states the fast service does not retain supplied input/output after processing; Nova's audio/transcript copies have separate retention. Generated generic game clips are cached in the separate public game-audio store until replaced or removed. |
| Supabase — Auth | Adult professional sign-in, email/name, password hash, sessions/recovery and security metadata. No customer clinical data. | Authentication is separate from Azure clinical storage. Supabase's international service/support and backup/security processing are governed by its DPA; account deletion removes the active authentication identity, with protected provider residual cycles. |
| Supabase — public game-audio cache | Generic, curated synthesized words/audio only. No child identifiers, recordings, goals or clinical prompts. | Assets are publicly served and may remain until replaced/removed. Public asset storage is not clinical hosting. |
| Resend | Nonclinical authentication/notification/support messages and adult delivery metadata. | US processing. Standard Free/Pro/Scale email/log retention is 30 days; provider backups and account-closure processing follow its DPA. Recipient mailbox copies are separate. No clinical email content is authorized. |
| Stripe | Adult payment, subscription, contact/address/tax and transaction data; Stripe handles card details. | International processing under the applicable Stripe account/privacy terms. Minimum financial records remain for legal/tax duties; cancellation is separate from clinical/account erasure. |
| Cloudflare — DNS | DNS records/query and service-account metadata. | Global DNS infrastructure. DNS only; clinical HTTP traffic is not proxied through Cloudflare. No clinical content is authorized. |
Ordinary inbound/support email is a nonclinical communication channel, not a clinical-file delivery route. Requests needing sensitive material use authenticated secure delivery. Clinician devices, browsers and downloads are customer-controlled destinations rather than Nova subprocessors.
Supabase holds no customer clinical data. Customer clinical records remain in Azure. Direct OpenAI API, AssemblyAI, unrelated analytics/advertising services and collaboration tools are not active clinical processors for this service.
Before a PHI subprocessor is used, Nova obtains the applicable downstream confidentiality, purpose, security, reporting, rights and disposal assurances and verifies the actual feature's contractual scope. Material clinical-subprocessor/location/purpose changes are disclosed before affected processing, with the applicable authorization and a reasonable opportunity to raise substantiated protection concerns. If a lawful concern cannot be resolved, Nova provides safe return/export and transition. Foreign laws can permit authority access; acceptance does not override an institutional transfer prohibition.
Provider terms: Microsoft HIPAA offering, Microsoft AI privacy, Microsoft abuse monitoring, Speech Fast privacy, Speech TTS privacy, Supabase DPA, Resend DPA, Resend retention, Stripe privacy, Cloudflare privacy.