Vendors that handle patient data

Last updated: September 23, 2026

HepBuddy uses three outside companies to store your patients' data and deliver their messages. Each one has signed a business associate agreement (BAA) with HepBuddy. A BAA is the HIPAA contract that limits what a vendor may do with patient data.

HepBuddy stays responsible to your clinic for how these vendors handle patient data. That is Section 3.8 of the BAA your clinic signs with HepBuddy.

Vendors that get patient data

Google Cloud (Firebase)

What it does: Stores patient records and runs the HepBuddy app.
Patient data it gets: Everything HepBuddy holds: names and contact details, assigned exercises, session activity, effort and pain ratings, message logs, support person contact details, and any exercise video your PTs upload.
BAA: Signed July 31, 2026. Google Cloud HIPAA Business Associate Addendum.

Google Workspace (Gmail)

What it does: Sends HepBuddy's email.
Patient data it gets: Email addresses, names, and the email itself. That includes exercise links and progress updates for patients and support people who chose email.
BAA: Signed July 18, 2026. Google Workspace HIPAA Business Associate Amendment.

Spruce Health

What it does: Sends and receives HepBuddy's text messages.
Patient data it gets: Phone numbers and the text of each message. Messages can include first names, exercise links, and exercise progress.
BAA: Signed July 20, 2026. Part of Spruce's Terms of Service for Organizations.

Texts also pass through each person's mobile carrier. Carriers are not HepBuddy vendors and do not sign BAAs. That is why patients and support people agree to receive texts before HepBuddy sends any.

Vendors that do not get patient data

Stripe bills your clinic. It gets your clinic's name, the number of practitioners on your plan, and your card details. It gets no patient data.
Google Fonts supplies the typeface on HepBuddy pages. When someone opens a page, Google sees their device's IP address and browser, as with any web font. It does not see names, exercises, or any other patient data.
Firebase Hosting serves this public website. It gets no patient data.

Before we add a vendor

We add a vendor to this list, and get its signed BAA, before it receives any patient data.

Questions about a vendor? Email harrisonshu@hepbuddy.com.