Version: 1.0
Effective date: 2026-04-20
Next review: 2026-10-20
Optimability uses the following third-party processors to deliver its Services. Subprocessors are expected to maintain reasonable confidentiality, privacy, and security standards consistent with Optimability's public Privacy Policy and Terms of Service.
| Subprocessor | Purpose | Data Categories Processed | Location | Contract / Terms | Last Updated |
| Anthropic, Inc. | AI protocol generation, lab parsing, call transcript analysis, Opti replies | Health biomarkers, coaching notes, call transcripts, protocol text, client goals, Google Calendar event titles and times when the client messages Opti | United States | Vendor terms / privacy terms | 2026-10-24 |
| Supabase, Inc. | Primary database, authentication support, storage of app records | Client personal data, adherence logs, protocol documents, consent records | United States | Vendor terms / privacy terms | 2026-04-20 |
| Railway Corp. | Application hosting, deployment, environment secrets | Application code, server logs, environment variables | United States | Vendor terms / privacy terms | 2026-04-20 |
| Fathom Video, Inc. | Call recording and transcription when clients consent | Audio/video recordings and transcripts | United States | Vendor terms / privacy terms | 2026-04-20 |
| OpenAI, LLC | Embedding generation for semantic search | Text excerpts from coaching notes, call transcripts, protocol documents | United States | Vendor terms / privacy terms | 2026-04-20 |
| Google LLC | Lab PDF storage (Google Drive), Google sign in, Google Calendar access when the client connects it (read, and the client's own training sessions added, moved and removed) | Lab result PDFs (blood, gut, DEXA, OAT), Google account identifiers, Google Calendar events (read, not stored); training sessions written to the client's calendar | United States | Standard DPA via Google Workspace | 2026-10-26 |
| Slack Technologies, LLC | Internal operational alerts (client milestone notifications, system alerts) | Client key identifiers, score summaries (no full PHI in Slack) | United States | Standard DPA | 2026-04-20 |
| Airtable, Inc. | Operational backbone — client roster, phase tracking, intake metadata | Client names, contact info, program phase, operational status | United States | Standard DPA | 2026-04-20 |
| Garmin Ltd. | Wearable data integration (HRV, sleep, activity) via Garmin Connect API | HRV, sleep metrics, activity data, Garmin account OAuth tokens | United States / Switzerland | Standard API ToS | 2026-04-20 |
| WHOOP, Inc. | Wearable data integration (strain, recovery, sleep) via WHOOP API | Strain score, recovery score, sleep data, WHOOP account OAuth tokens | United States | Standard API ToS | 2026-04-20 |
| Twilio Inc. | Text messages with Opti, only for clients who opt in by replying YES | Mobile number, text messages sent to and from Opti | United States | Standard DPA | 2026-10-10 |
All subprocessors listed above process data in the United States, which may have different data protection laws than Canada and other countries of residence. US government agencies may access data under the CLOUD Act (18 U.S.C. §2713) and FISA §702 without judicial review in individual cases.
Optimability mitigates this risk through HTTPS in transit, database access controls, selected application-layer encryption, role-based app access, and limiting vendor use to the delivery of Optimability services.
Clients who do not consent to cross-border transfer may not be able to use the Services. See the Privacy Policy.
Optimability will update this page within 30 days of any change to the subprocessor list (addition, removal, or material change of existing subprocessors). Existing clients will be notified by email at least 15 days before a new subprocessor accesses their personal data.
To object to a new subprocessor, contact privacy@optimability.com within 15 days of notification.
For questions about this list, contact privacy@optimability.com
Questions? Contact privacy@optimability.com