Doxy.me

For ProvidersFor Clinics
Pricing
Sign in

Sub Processor List

Last updated: May 1, 2023

This Sub-Processor List describes which third-parties are used by Doxy.me Services as related to the collection, use and disclosure of Your information.


Definitions

Regardless of how you are using this website or the Doxy.me Service, this section defines certain terms that are used throughout this policy.

For the purposes of this Sub-Processor List:

  • You means the individual accessing or using the Doxy.me Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable. You must be at least 18 years of age in order to use the Service.
  • Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Agreement) refers to Doxy.me Inc., 3445 Winton Pl, Suite 114, Rochester, NY 14623.
  • Affiliate means an entity that controls, is controlled by or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
  • Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
  • Third-party Social Media Service refers to any website or any social network website through which a User can log in or create an account to use the Service.
  • Personal Data is any information that relates to an identified or identifiable individual.
  • Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing (among other things) the details of Your browsing history and/or connection information when using the Service.
  • Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
  • User is someone accessing the Website as a guest, a Provider, or a Patient.
  • Protected Health Information (PHI) means any health-related information as defined by applicable law.

Terms specific to the Doxy.me Service are:

  • Service refers to the software product accessible from the Website.
  • Provider means a doctor, medical group, or other healthcare professional who has signed up as a “Provider” on the Doxy.me Service.
  • Patient refers to an individual who is using the “Patient” component of the Service using a unique URL sent by the Provider to view the Waiting Room (prior to the Session). 
  • Account means a unique account created for You to access our Service or parts of our Service. This may also be referred to as Your Clinic.
  • Website refers to doxy.me, accessible from https://doxy.me
  • Session is secure audio and/or video communication between the Patient and the Provider—the key feature of the Doxy.me Service.
  • Waiting Room is the web page that is seen by Patients prior to the beginning of a video session. The Provider may change the look and feel of the Waiting Room and upload Provider-specific content.
  • Provider Link is the unique URL (web address) that the Patient uses to enter the Provider’s Waiting Room prior to a Session. An example is https://yourclinic.doxy.me/DrSmith


Usage Data

Usage Data is collected automatically when accessing the Service and visiting this Website.

Usage Data may include information such as Your Device’s Internet Protocol address, browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.



Payment Processing

Payment processing services enable doxy.me to process payments by credit card, bank transfer or by other means. To ensure greater security, doxy.me shares only the information necessary to execute the transaction with the financial intermediaries handling the transaction.
Some of these services may also enable the sending of timed messages to the User, such as emails containing invoices or notifications concerning the payment.

Stripe (Stripe, Inc)

Stripe is a payment processing service provided by Stripe, Inc.

Personal Data processed: provider name, email, address and other data supplied by provider relevant to processing a payment for the services.

Place of processing: United States – Privacy Policy.

Hosting and Backend Infrastructure

This type of service has the purpose of hosting Data and files that enable doxy.me to run and be distributed as well as to provide a ready-made infrastructure to run specific features or parts of doxy.me. Some of these services work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

Amazon Web Services (AWS) (Amazon Web Services, Inc.)

Amazon Web Services (AWS) is a hosting and backend service provided by Amazon Web Services, Inc.

Personal Data processed: provider data stored as part of the account; name and email address minimum.

Place of processing: United States – Privacy Policy. Privacy Shield participant.


Google Workspace (Alphabet, Inc.)

Google Workspace is a cloud-based suite of productivity applications that includes email and calendar functions provided by Alphabet, Inc. ("Google.")

Personal Data processed: provider and prospective customer name and email address may be processed.

Place of processing: United States - Privacy Policy

Snowflake, Inc.

Snowflake, Inc. provides cloud-based data storage and is used to store doxy.me provider data.

Personal Data processed: All production data captured by doxy.me for purposes of delivering the software services, marketing, and sales.

Place of processing: United States - Privacy Policy

Unbounce

Unbounce produces landing pages for websites.

Personal Data processed: IP address, the date and time visitors land on web pages, browser signatures, operating system, and device type.

Places of processing: Germany, Ireland - Privacy Policy

Analytics

The services contained in this section enable the Owner to monitor and analyze web traffic and can be used to keep track of User behavior.

Google Tag Manager (Alphabet, Inc.)

Google Tag Manager is a tag management system provided by Alphabet, Inc ("Google") that allows users to configure and instantly deploy tags on a website or mobile application from an easy-to-use web-based interface.

Google may use the Data collected to contextualize and personalize the ads of its own advertising network.

Personal Data processed: Cookies, usage data, Internet information.

Place of processing: United States - Privacy Policy

Google Ads conversion tracking (Alphabet, Inc.)

Google Ads conversion tracking is an analytics service provided by Alphabet, Inc. that connects data from the Google Ads advertising network with actions performed on Doxy.me.

Personal Data processed: Cookies; Usage Data.

Place of processing: United States – Privacy Policy. Privacy Shield participant.

Category of personal data collected: Internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers in our main Privacy Policy (https://doxy.me/en/privacy-policy).

Tableau (Tableau Software, Inc.)

Tableau is an interactive data visualization software used for business intelligence and analysis.

Personal Data processed: IP address, machine type and/or operating system, usage data for website visitors.

Place of processing: United States - Privacy Policy

Trevor.io

Trevor.io is a business intelligence and data visualization tool.

Personal Data processed: IP address, machine type and/or operating system, usage data for website visitors.

Place of processing: United States - Privacy Policy

Customer Experience

Aircall (Aircall SAS)

Aircall is a cloud-based call center and phone system. (https://aircall.io/)

General usage: Answers inbound calls and makes outbound calls.

Personal Data processed: Inbound telephone number and possible Caller ID; outbound number dialed.

Places of processing: United States, United Kingdom, European Union, Vietnam - Privacy Policy - Subprocessors List

Canny.io

Canny.io is a cloud-based customer feedback system. (https://canny.io/)

General usage: Capture, organize, and analyze product feedback in one place to assist in product decisions.

Personal Data processed: data from those that contacted Doxy.me support: name, email address, comment/complaint.

Places of processing: United States - Privacy Policy - Subprocessors List

Intercom (Intercom R&D Unlimited Company)

Intercom is a hosted ticketing system.

General usage: Feedback forms and surveys, ticketing system. (https://intercom.com) 

Personal Data processed: Data provided by existing customers that may include name and email address.

Place of processing: United States - Privacy Policy - Subprocessors List

SatisMeter

SatisMeter provides targeted feedback.

General usage: Customer feedback from new customers; measure satisfaction, gauge customer experience. (https://www.satismeter.com/)

Personal Data processed: Data provided by prospective or existing customers that may include name and email address.

Place of processing: Czech Republic - Privacy Policy

Segment.io, Inc. (Twilio)

Segment.io, Inc. collects user event data, and patient invitation data (email address for email invites, mobile number for SMS invites), within the doxy.me platform. (https://segment.com/)

Personal Data processed: Provider data processed includes cookies, IP address, usage data, email, mobile number, location, company name and plan. Patient data processed includes call data, location, and cookies.

Places of processing: United States and European Union - Privacy Policy - Subprocessors List

Mailchimp (Rocket Science Group)

Mailchimp is an all-in-one Marketing Platform for small business.

General usage: Outbound email, email tracking. (https://mailchimp.com) 

Personal Data processed: Data provided by prospective or existing customers that may include name and email address.

Place of processing: United States - Privacy Policy

HubSpot

HubSpot offers hosted software for marketing, sales, and customer service.

General usage: Customer database. (https://hubspot.com) 

Personal Data processed: Existing and potential customers that may include name, email address, phone number, company name.

Places of processing: United States and European Union - Privacy Policy - Subprocessors List

PubNub, Inc.

PubNub provides in-app messaging.

General usage: Chats within the Doxy.me Service. (https://pubnub.com) 

Personal Data processed: Name entered by Patient at beginning of Session and Provider name.

Place of processing: United States - Privacy Policy


Others

Adhere.ly

Adhere.ly provides reminders functionality within the doxy.me environment. It allows Patients to be notified about appointments, future check-ups, or other important events. Reminders are sent by email or text message. Personal Data are only used to provide the reminder service and then deleted. This feature is optional.

Personal Data processed: Patient name, Patient email address, Patient mobile number.

Place of processing: United States – Privacy Policy.

Datadog, Inc.

Datadog is a class of monitoring tools known as "Application Performance Management" and allows Us to monitor how Our cloud infrastructure and the applications running on them are working.  This includes browser performance data and any errors that users might experience on their devices. Datadog also collects all the server and application logs and centralizes them for automatic detection of issues and remediation

Personal data processed: None, although Datadog could capture a server error that has IP addresses in the error message, and logs are stored for 15 days and then permanently deleted. Performance data are stored for 30 days and then permanently deleted.

Place of processing: United States

Google Ads (Alphabet, Inc.)

Google Ads is an online advertising service provided by Google Inc. ("Google"). Google may set or read cookies on the user's browser. Applications that use this Google advertising service also share information with Google, like the app name and a unique identifier.

Personal Data processed: URL of page visited and IP address.

Place of processing: United States - Privacy Policy.

Limnu (ZipSocket, Inc.)

Limnu is an online whiteboard that enables people to collaborate visually in real-time. The whiteboards can be embedded into a website using the Limnu backend API.

Personal Data processed:

Data deleted immediately after each user session:

  • Any user content added to the whiteboard by each user

Data stored for longer periods:

  • Screen name provided by doxy.me
  • Time user account was created
  • Time on each whiteboard
  • IP Address
  • Geographic location
  • Device information (browser type/version, OS system/version)

Place of processing: United States - Privacy Policy.

Data will be transferred to the following sub-processors: Google, AWS, API2PDF (for office document processing, documents deleted after conversion).

Voyce

Doxy.me has partnered with Voyce, a HIPAA and PIPEDA compliant service, to add on demand interpreters to your calls. With a few clicks, you can add an interpreter for many languages with knowledge of medical terminology in over 240 languages.

Personal Data processed: No data, video, or audio is stored. The interpreter will hear and/or sign the conversation between patient and provider.

Place of processing: United States - Privacy Policy



Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective, and We will update the “Last updated” date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.



Contact Us

If you have any questions about this Privacy Policy, you can contact us by email at support@doxy.me.