As of September 11, 2026, Practice Pad Technologies LLC has no subcontractors receiving Protected Health Information, consistent with our on-device processing architecture. All PHI is processed on the therapist’s device or stored in the therapist’s own Google Workspace account under a BAA the therapist holds directly with Google LLC.
This page is maintained pursuant to Section 3.5 of the Practice Pad Business Associate Agreement (v1.1.0) and will be updated within thirty (30) days of any material change to our subprocessor roster.
Practice Pad is designed from the ground up to keep PHI off our servers. Here is what happens to clinical data in Practice Pad:
The following vendors provide infrastructure services to Practice Pad. None of these vendors receive, process, or store PHI in connection with Practice Pad services.
| Vendor | Service | PHI Access |
|---|---|---|
| Netlify, Inc. | Hosts the practicepadapp.com website and one serverless function, record-baa, which receives the professional information you enter when you accept the Practice Pad Business Associate Agreement (your name, email address, license number, NPI, and a device identifier) and records your acceptance to confirm the BAA is in effect. This function processes your own professional contact and credential information only; it does not receive, process, or store client Protected Health Information or clinical content. Operational events (such as whether the acceptance was recorded successfully) may appear in Netlify’s server logs to support reliability; these logs do not contain client PHI or clinical content. |
No PHI |
| Resend (Resend, Inc.) | Sends transactional email on our behalf when you execute the Practice Pad Business Associate Agreement: a confirmation receipt to the email address you provide and an internal notification to Practice Pad. To send these messages, Resend processes your professional contact and licensing details submitted during BAA acceptance — your name, email address, license number, and (if provided) NPI. This is your own professional information as the clinician, not your clients’ Protected Health Information; no client PHI is transmitted to or processed by Resend at any point. Resend does not use this information for any purpose other than delivering these messages on our behalf. | No PHI |
| Apple Inc. | Provides the iOS operating system, TestFlight distribution, on-device Vision Framework (OCR), and App Store distribution. All OCR processing is on-device only. | No PHI |
| Google LLC | Provides Google Workspace (Drive, Sheets, Calendar, Forms) under a BAA held directly between Google and the therapist. PHI in Google Workspace is in the therapist’s direct possession and control, not Practice Pad’s. | Therapist’s BAA |
Apple and Google are listed for transparency only. Neither qualifies as a Practice Pad Subprocessor as defined in the BAA because neither receives PHI from Practice Pad on Practice Pad’s behalf.
Questions about this list?
Contact our Privacy Officer at support@practicepadapp.com with the subject line “Subprocessor Inquiry.”
Perry Emerick, MS, LPC — Privacy & Security Officer, Practice Pad Technologies LLC