Subprocessors — Practice Pad

No PHI Subprocessors — Current as of May 7, 2026

As of May 7, 2026, Practice Pad Technologies LLC has no subcontractors receiving Protected Health Information, consistent with our on-device processing architecture. All PHI is processed on the therapist’s device or stored in the therapist’s own Google Workspace account under a BAA the therapist holds directly with Google LLC.

This page is maintained pursuant to Section 3.5 of the Practice Pad Business Associate Agreement (v1.1.0) and will be updated within thirty (30) days of any material change to our subprocessor roster.

Why No Subprocessors?

Practice Pad is designed from the ground up to keep PHI off our servers. Here is what happens to clinical data in Practice Pad:

✓ Handwritten notes are converted to text on-device using Apple’s Vision Framework — no data leaves the iPad for OCR.
✓ Clinical assessments are scored on-device using PHI retrieved via the therapist’s own Google OAuth token — PHI does not transit Practice Pad’s infrastructure.
✓ Notes are stored locally in AES-256 encrypted SQLite (SQLCipher) on the therapist’s device.
✓ When synced, notes go from the device directly to the therapist’s own Google Drive — under the therapist’s own Google Workspace BAA with Google LLC.

Infrastructure Vendors (No PHI)

The following vendors provide infrastructure services to Practice Pad. None of these vendors receive, process, or store PHI in connection with Practice Pad services.

Vendor	Service	PHI Access
Netlify, Inc.	Hosts the practicepadapp.com website and the `provision-library.js` template provisioning function, which processes template file identifiers only.	No PHI
Apple Inc.	Provides the iOS operating system, TestFlight distribution, on-device Vision Framework (OCR), and App Store distribution. All OCR processing is on-device only.	No PHI
Google LLC	Provides Google Workspace (Drive, Sheets, Calendar, Forms) under a BAA held directly between Google and the therapist. PHI in Google Workspace is in the therapist’s direct possession and control, not Practice Pad’s.	Therapist’s BAA

Apple and Google are listed for transparency only. Neither qualifies as a Practice Pad Subprocessor as defined in the BAA because neither receives PHI from Practice Pad on Practice Pad’s behalf.

Future subprocessors: If Practice Pad ever engages a subcontractor that will receive PHI (for example, if an AI-powered feature were added using a third-party model provider), this page will be updated at least 30 days before the subcontractor begins receiving PHI, and affected users will be notified at the email address associated with their account.

Questions about this list?

Contact our Privacy Officer at support@practicepadapp.com with the subject line “Subprocessor Inquiry.”

Perry Emerick, MS, LPC — Privacy & Security Officer, Practice Pad Technologies LLC