All third-party services that may process Protected Health Information on behalf of AI VOX, with current Business Associate Agreement status. A "subprocessor" is a third party engaged by AI VOX that may create, receive, maintain, or transmit PHI on behalf of a Covered Entity. Every subprocessor listed below either has a signed Business Associate Agreement directly with AI VOX, or is downstream of a subprocessor whose BAA explicitly covers them.
1. Amazon Web Services, Inc.
| Purpose | Compute (EC2), database (RDS Postgres), application hosting (Amplify), email delivery (SES), object storage (S3), monitoring (CloudWatch). |
|---|
| Data accessed | All PHI processed by AI VOX is stored on AWS infrastructure. |
|---|
| BAA status | Executed. AWS Business Associate Addendum accepted via AWS Artifact. |
|---|
| Hosting region | AWS US East (N. Virginia) — us-east-1 |
|---|
2. Retell AI, Inc.
| Purpose | Inbound and outbound telephony, real-time speech-to-text, conversational AI orchestration, and text-to-speech for the voice agent. |
|---|
| Data accessed | Call audio in real time, full transcripts, structured call analysis, and any PHI verbally disclosed during the call. |
|---|
| BAA status | Executed. Retell's BAA covers Retell itself and the downstream model, STT, and TTS providers it uses on AI VOX's behalf. |
|---|
| Hosting region | United States |
|---|
3. Large Language Model Provider (via Retell)
| Provider | OpenAI or Anthropic (depending on the configured agent model), engaged via Retell. |
|---|
| Purpose | Generation of the AI voice agent's conversational responses during a call. |
|---|
| Data accessed | Live conversation context during the call. No conversation data is retained for training under the enterprise terms negotiated by Retell. |
|---|
| BAA status | Covered under Retell's executed BAA with AI VOX. |
|---|
4. Speech-to-Text Provider (via Retell)
| Provider | Deepgram or equivalent provider engaged by Retell. |
|---|
| Purpose | Real-time transcription of the caller's speech into text. |
|---|
| BAA status | Covered under Retell's executed BAA with AI VOX. |
|---|
5. Text-to-Speech Provider (via Retell)
| Provider | ElevenLabs or Cartesia (depending on configured agent voice), engaged via Retell. |
|---|
| Purpose | Synthesis of the AI voice agent's verbal responses. |
|---|
| BAA status | Covered under Retell's executed BAA with AI VOX. |
|---|
6. Google Calendar (clinic-authorized)
| Provider | Google LLC, accessed through the Covered Entity's own Google Workspace account. |
|---|
| Purpose | Reading existing appointments and writing new appointment events to the clinic's calendar. |
|---|
| BAA status | AI VOX does not hold a direct BAA with Google. Calendar access is delegated through the Covered Entity's own Workspace account, under which the Covered Entity is responsible for executing any necessary BAA with Google. |
|---|
Notes
- AI VOX does not currently use any subprocessor whose primary place of business is outside the United States for the processing of PHI.
- If a Covered Entity prefers a specific configuration of upstream providers, AI VOX can accommodate such requests subject to availability through Retell's configuration. Contact work@theaivox.com.
- This list excludes vendors used for internal business operations that do not handle PHI (accounting, subscription payment processing, productivity software). PHI is never transmitted to such vendors.