The service providers that process data for Arxova

Provides cloud infrastructure supporting Arxova's cryptographic signing operations for blockchain audit receipts. Signing requests contain digital fingerprints rather than underlying medical records. Arxova maintains an applicable Business Associate Agreement with AWS.

• GDPR center (opens aws.amazon.com)

Provides ARIA and other optional AI-powered features, including health summaries, insights, document interpretation, and background guidance. Depending on the feature, receives minimized health information, user-entered text, or uploaded documents and images that may contain personal identifiers. Processing requires the user's AI consent. Anthropic's commercial AI services are covered by Arxova's applicable Business Associate Agreement.

• Data processing terms (opens www.anthropic.com)

Delivers iOS push notifications. Receives device push tokens and notification payloads. Arxova's server-generated notifications are designed not to include specific health readings, medications, diagnoses, or clinic or study names.

Provides Arxova's email newsletter service. Receives subscriber email addresses and newsletter engagement information, such as opens and clicks. The newsletter is separate from the Arxova health application and is not intentionally supplied with health records.

• Data processing terms (opens www.beehiiv.com)

Provides over-the-air application updates and relays mobile push notifications to Apple and Google. May receive device information, application version information, push tokens, and notification text. Server-generated notifications are designed not to include health readings, medication names, condition names, or clinic or study names.

• Terms (opens expo.dev)
• Privacy policy (opens expo.dev)

Fasten Health facilitates patient-directed connections to healthcare providers and electronic health record systems through FHIR-based and other supported interoperability methods. When authorized by a user, Fasten processes the information necessary to establish the connection, retrieve the user's medical records, and securely transmit those records to Arxova. These connections are initiated and authorized by the user to support access to their own health information.

• Vendor trust center (opens trust.fastenhealth.com)

Hosts Arxova's application servers and databases, including systems that store and process personal information and health records. Processing is governed by Arxova's infrastructure configurations, access controls, encryption safeguards, and applicable Business Associate Agreement.

• Healthcare compliance (opens fly.io)

Delivers Android push notifications. Receives device registration tokens and notification payloads. Arxova's server-generated notifications are designed not to include specific health readings, medications, diagnoses, or clinic or study names.

• Data processing terms (opens firebase.google.com)

Provides business email, documents, and internal collaboration services. Arxova does not intentionally use Google Workspace to store or process patient medical records. Business communications may include personal or professional contact information.

• Data processing terms (opens cloud.google.com)

Provides blockchain API infrastructure used to submit or retrieve Solana audit transactions. May process transaction information and technical request metadata. Current audit receipts use random references and generic event names; historical receipts may expose wallet-linked health-related event types. No individually negotiated agreement is asserted.

Provides infrastructure used to upload encrypted health records to the Arweave permanent storage network. May process encrypted record payloads and associated transaction metadata. Historical uploads before October 1, 2026 may include public wallet-linked record-type labels. No individually negotiated agreement is asserted.

Provides product analytics for Arxova's application and website. Receives pseudonymous feature-use events that may reveal health-related interests. App analytics can be disabled in Settings, although this does not stop all server-side events.

• Data processing terms (opens posthog.com)

Supports user authentication, account-associated Solana wallets, and authorized wallet-signing operations. May process email addresses, authentication identifiers, wallet addresses, and signing requests. Arxova does not intentionally send medical records or health measurements to Privy.

Provides SMS and WhatsApp delivery for Arxova Circle communications. May receive contact telephone numbers, the user's first name, message content describing health or well-being, and replies. SMS is used for United States and Canadian numbers; WhatsApp is used for supported international numbers.

• Data processing terms (opens www.twilio.com)

Hosts Arxova's public website, web application, clinic console, and research portal. May process visitor IP addresses, technical request logs, and research-related consent or review information transmitted through hosted services. Arxova's web application sends medical records directly to its application servers rather than through Vercel.

• Data processing terms (opens vercel.com)

Faxes a person's signed records request to the doctor's office when they tap "Send it for me", at their direction and to the number they confirm. Receives records that offices fax back to Arxova. The request includes the person's name, date of birth and what they are asking for. Faxed records are medical records. Arxova has a signed Business Associate Agreement with Sinch, and Sinch's "Don't save" settings are on, so it keeps no copy once a fax is delivered.

• Sinch Fax HIPAA compliance (opens developers.sinch.com)