ExamFlow › Subprocessor List
Subprocessor List
Version 1. Published 3 November 2026. This list is part of our Terms of Service and Business Associate Agreement. It has not yet been through outside legal review; the facts in it are current and we will say so here when that review is done.
This list is part of the Terms of Service and the Business Associate Agreement.
What this list is
These are the companies that help us run ExamFlow and may process your practice's information. For each, the list says what it does, whether it ever handles protected health information (PHI), and, if it does, what agreement covers it.
The rule we follow. No company handles PHI for us until it has signed a business associate agreement with us. This is required by 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2). A feature that needs a company whose agreement is not yet signed stays switched off (BAA §5.3).
Current subprocessors
| Company | What it does for us | PHI? | Agreement | Where |
|---|
| Microsoft Corporation (Azure) | Hosts the application, the database, uploaded documents and backups | Yes | Microsoft's HIPAA Business Associate Agreement, included in the Microsoft Products and Services Data Protection Addendum | United States |
| Microsoft Corporation (Azure Communication Services) | Sends recall text messages to drivers, only for practices that have turned reminders on. Not offered at launch | Yes, when a practice turns reminders on | Same Microsoft agreement. Azure Communication Services is listed in scope | United States |
| Microsoft Corporation (Microsoft 365) | Sends account email to your staff, such as password resets and invitations | No. Messages are built to carry no patient information | Same Microsoft agreement | United States |
| Stripe, Inc. | Collects payment for your subscription to ExamFlow | No. Stripe collects card details on its own pages; we never receive them | Stripe Services Agreement | United States |
Not our subprocessors: services you connect
These receive information from ExamFlow only because you connected your own account. You choose the provider, you hold the account, and your own agreement with them governs (Terms §6; BAA §8(e)):
- Your cloud drive (Microsoft 365, Google Workspace or Dropbox business tiers), if you turn on record copies. Not yet available.
- The FMCSA National Registry, when your examiner submits results. Today your examiner does this under their own Registry login.
How we tell you about changes
- Adding or replacing a subprocessor that handles PHI: we update this list and email your administrator at least 30 days before it begins processing your PHI.
- Emergencies, such as a provider failing or a security problem that needs an immediate switch: we may make the change at once and tell you within 5 business days, with the reason.
- Subprocessors that never handle PHI: we update this list. No advance notice.
- If you object to a new PHI subprocessor, tell us within the 30 days. If we cannot address the objection, you may end your subscription and receive a pro-rated refund of prepaid fees for the unused period. That is your remedy for this objection. Your rights under the BAA are unaffected.
History
| Date | Change |
|---|
| 3 November 2026 | First published |