Legal
Data sub-processors
Third-party service providers engaged by EVAL Health to process patient and practitioner data.
Last updated: December 2, 2025
Overview
EVAL Health engages third-party service providers ("Sub-processors") to support cloud infrastructure, data storage, and secure communication delivery. We conduct due diligence to ensure each sub-processor complies with GDPR, HIPAA, and applicable data privacy regulations.
Current Sub-Processors
| Name | Location | Services | Processing Locations |
|---|---|---|---|
| Amazon Web Services, Inc. | United States | Cloud Service Provider: platform hosting, encrypted patient data / PHI storage, operational notifications via email and SMS | Virginia, Ohio, California |
Downstream Sub-Processors
AWS may engage additional sub-processors for specific services, such as telecommunications aggregators for SMS delivery. You can view AWS's current sub-processor list on the AWS Compliance website.
Updates to This List
As our business evolves, EVAL Health may change its sub-processor engagements:
- Routine updates: This page is updated at least 30 days before a new sub-processor is authorized to access personal data
- Emergency replacements: Immediate updates occur if a sub-processor is replaced due to a security breach or insolvency
- Customer objections: Current customers with a valid Data Processing Agreement may object to a new sub-processor on data protection grounds by contacting us at privacy@eval.health within the timeframe specified in their agreement