Think Beyond Practice LLC | Last Updated: August 31, 2026
This page lists the third-party service providers ("Subprocessors") that Think Beyond Practice LLC engages to help operate the Platform. Some Subprocessors process Member account information, payment data, or other personal information. A subset of Subprocessors process Protected Health Information (PHI) on behalf of Members under Business Associate Agreements (BAAs).
This list is reviewed regularly and updated when Subprocessors are added or removed. Material changes will be communicated to Members through the Platform or by email in accordance with our Privacy Policy. If you have questions about a specific Subprocessor or our diligence process, contact privacy@thinkbeyondpractice.com.
These Subprocessors may process Protected Health Information in the course of providing services and are engaged under Business Associate Agreements. PHI is processed transiently to deliver the requested output and is not retained for ongoing storage beyond what is necessary to provide the service.
| Subprocessor | Service & role in PHI processing | Processing location |
|---|---|---|
| Amazon Web Services, Inc. (AWS Lambda, Amazon Bedrock, Amazon S3, Amazon SES) | Serverless compute (AWS Lambda) that processes clinical requests, and AI model inference via Amazon Bedrock, which runs Anthropic's Claude models to generate and draft clinical documentation (notes, letters, assessment summaries), documentation audit, and coding support from content submitted by the clinician — entirely within AWS's HIPAA-eligible infrastructure. Also any transient PHI storage the Platform requires (Amazon S3) and application-driven email delivery (Amazon SES: patient-facing assessment delivery links, letter generator outputs, clinical workflow notifications). Requests are processed transiently; message content is not logged or retained by the Platform's proxy. Amazon Bedrock does not share the Platform's inputs or outputs with the model developer and does not use them to train models. | United States |
| Microsoft Corporation (Azure AI Speech & Azure Storage) | Ambient speech-to-text transcription for the AI Scribe, and the transient encrypted audio storage that supports it. Audio is deleted after transcription. | United States |
| Google LLC (Google Workspace) | Human-composed email through Member-facing inboxes (support, legal, privacy). PHI may flow through these channels. | United States |
A note on the AI models: clinical documentation is generated by Anthropic's Claude models, but those models are accessed through Amazon Bedrock and run within AWS's HIPAA-eligible infrastructure under our AWS Business Associate Agreement. When accessed through Amazon Bedrock, Anthropic — the developer of the Claude models — does not receive the Platform's inputs or outputs and does not train its models on them. Anthropic is therefore the developer of the models used, not a recipient of Protected Health Information processed through the Platform.
These Subprocessors process Member account information, payment data, or other operational data. They are not used for PHI-containing communications or PHI processing in the ordinary course of operations.
| Subprocessor | Service & role |
|---|---|
| Netlify, Inc. | Static website and application hosting (serves the Platform's pages and front-end assets). PHI processing is handled by BAA-covered services above, not by this hosting layer. |
| Supabase, Inc. | Database and backend for Member account, subscription, community, and consent records. Not used to store patient PHI in the ordinary course of operations. |
| Stripe, Inc. | Payment processing and subscription billing. Processes payment and account information; does not process PHI. |
| OpenAI, L.L.C. | Text-embedding model used solely to index Think Beyond Practice's own community/education content for search ("Ask the Archive"). Does not process patient PHI. |
Think Beyond Practice processes Covered Entity PHI solely within the United States, and requires the Subprocessors above that process PHI to do the same, unless the Covered Entity has provided express written consent to process in a different location.
Think Beyond Practice maintains separate email infrastructure for different communication types, designed to route PHI-containing communications only through services engaged under Business Associate Agreements:
Google Workspace is used for human-composed email through Member-facing inboxes (support, legal, privacy, and similar). PHI may flow through these channels.
Amazon SES is used for application-driven email. This includes transactional messages that may contain PHI (such as patient-facing assessment delivery links, letter generator outputs, and clinical workflow notifications) as well as operational and account communications (such as system notifications, member broadcasts, account confirmations, and reminders).
This architectural separation is designed to ensure that PHI-containing communications are processed only by BAA-covered services. Members who identify any communication that appears to contain PHI delivered through a non-BAA channel should report it to privacy@thinkbeyondpractice.com.
Before engaging any Subprocessor that may process Member data or PHI, Think Beyond Practice performs reasonable diligence, including:
Review of the Subprocessor's privacy and security practices; verification of compliance certifications where applicable (SOC 2, HIPAA attestations, and similar); execution of a Business Associate Agreement for any Subprocessor that processes PHI; and review of the Subprocessor's data-handling practices for alignment with our Privacy Policy commitments. We periodically review existing Subprocessors to confirm continued compliance and may discontinue use of a Subprocessor that does not meet our standards.
Material changes to this Subprocessor list will be communicated to Members through one or more of the following channels: an update to the "Last Updated" date at the top of this page; email notification to Members where the change materially affects how PHI is processed; and a Platform announcement for changes affecting Platform functionality. Members may review this page at any time at https://thinkbeyondpractice.com/subprocessors.
By using the Platform and accepting our Terms of Service, Privacy Policy, and Business Associate Agreement, Members acknowledge and consent to the engagement of these Subprocessors for the operation of the Platform. Members who object to a specific Subprocessor may contact privacy@thinkbeyondpractice.com to discuss alternatives or, if no acceptable alternative is available, terminate their subscription.
Think Beyond Practice LLC
9631 N Nevada St, Suite 209, Spokane, WA 99218