Subprocessors

1. How We Use Subprocessors

A subprocessor is a third party we engage that may process personal data on behalf of our customers in the course of providing the Routina platform. We keep the list short on purpose, and every entry on it is here because the platform needs it to work.

Each subprocessor is bound by a written agreement imposing data protection obligations at least as stringent as those in our Data Processing Agreement, and we remain responsible to our customers for their performance. Several entries are engaged only when a customer turns on the corresponding feature or connects the corresponding integration; those are grouped in Section 4 and marked accordingly.

This list covers every environment we operate — app.routina.tech, partners.routina.tech, and any other domain or dedicated deployment we may add. Each runs on separate infrastructure with its own database, but the same set of subprocessors supports them. All processing takes place in the United States unless otherwise noted.

2. Infrastructure and Platform

Engaged for every customer. These provide the compute, storage, network, billing, and messaging the platform runs on.

3. AI Model Providers

AI features send inputs to a model provider for inference. Which provider receives them depends on the provider selected for your team. Routina does not use customer data to train models, and we contract for zero-retention or no-training handling where the provider offers it — the last column below states what is in place today.

Model providers set their own retention, abuse-monitoring, and model-improvement policies, and those policies can change. We select providers carefully and contract for the strongest terms available to us, but we cannot audit a third party's internal handling of data. See Section 8 of the DPA and Section 6 of the Terms of Service.

4. Feature-Dependent Subprocessors

These are engaged only when a customer enables the relevant feature or connects the relevant integration. If you do not use the feature, the subprocessor never receives your data.

Customer-configured integrations with systems you already operate — your CRM, EHR, ERP, or other connected platform — are not Routina subprocessors. Routina reads from and writes to them at your instruction; your own agreement with those vendors governs them.

5. Corporate and Website

These support our own operations and public website. They do not process customer platform data.

6. Customer-Provided Model Provider Keys

The platform lets a team run AI features under its own account with a model provider by supplying an API key. When you do that, inference requests run under your account with that provider, and your agreement with them — not ours — governs what happens to the data they receive. Routina transmits the inputs at your instruction and does not control that provider's retention, security, availability, or use of the data.

You remain responsible for reviewing that provider's terms, for confirming they meet your compliance obligations, and — if you are subject to HIPAA — for having whatever agreement they require. A BAA with Routina does not extend to a provider you engage directly. Your use of the platform remains governed by our Terms of Service either way.

7. Change Notification

We will publish any addition or replacement on this page and notify subscribed customers at least 30 days before the new subprocessor begins processing personal data. To receive those notices, email privacy@getroutina.com with the subject line "Subprocessor notifications" and the address you want them sent to.

If you object to a new subprocessor on reasonable data protection grounds, tell us within the notice period and we will work with you to resolve it. If we cannot, you may terminate the affected services and receive a prorated refund of prepaid fees for the unused period, as set out in Section 7 of the DPA.

Removals and changes to a subprocessor's stated purpose are reflected here when they take effect.

8. Contact

Questions about this list, or a request for our current technical and organizational measures: