Subprocessors
Last updated June 10, 2026
Harmonize Iris relies on a small number of outside companies to run the app. These companies are listed below. Each one only sees the data it needs to do its specific job.
If we add or remove a company from this list, we’ll update this page and bump the date above. If we add one that handles sensitive data in a meaningfully new way, we’ll also notify users in the app before the change takes effect.
Supabase
What they do: Database, login, file storage, and the emails that confirm your account and reset your password.
What we send them: Everything you enter into a case (de-identified case data, symptom text, pulse and tongue notes, formula entries, tongue photos), your email address, and your name.
Where they’re based: United States
How long they keep it: Kept while your account and cases exist, and deleted when you delete a case or close your account. Encrypted backups are retained on a rolling basis and cycle out automatically.
Vercel
What they do: Hosts the app itself and runs the code that responds to your clicks.
What we send them: Request logs (URLs you visit, your IP address, your browser type). No case content is logged.
Where they’re based: United States
How long they keep it: Operational request logs are short-lived and deleted automatically; no case content is logged.
Anthropic
What they do: Provides the Claude AI model used for the intake and follow-up clinical analysis and the consult chat.
What we send them: The de-identified case text and chat messages sent to the AI for analysis. No patient identifiers — that's the de-identification rule you agreed to at signup.
Where they’re based: United States
How long they keep it: Sent only to generate your analysis. Anthropic does not use it to train its models, and deletes the inputs and outputs within 30 days.
Upstash
What they do: Stores the counters that rate-limit login attempts and signup attempts to prevent abuse.
What we send them: Your IP address and a count of recent failed login attempts. No case data.
Where they’re based: United States
How long they keep it: Abuse-prevention counters expire automatically — nothing is kept beyond 24 hours.
Sentry (Functional Software, Inc.)
What they do: Catches errors and crashes so we can fix them. Only receives information when something goes wrong.
What we send them: Error type and where in the code it happened. Your account ID (a random string, no email). The page you were on when it crashed, with any case identifiers stripped out. No case content, no patient text, no request bodies.
Where they’re based: United States
How long they keep it: Error reports are deleted automatically on a rolling retention schedule.
Resend (Resend, Inc.)
What they do: Delivers the daily activity-summary email we send to the platform owner to monitor the health of the app.
What we send them: The platform owner's email address and the text of the daily summary email. The summary itself contains only counts of activity (e.g. "12 cases were opened"), action labels, and your account ID — no case content, no patient text, no request bodies.
Where they’re based: United States
How long they keep it: Email delivery records are kept on a rolling schedule and are not used for anything else.
Google Workspace (Google LLC)
What they do: Hosts our support inbox (support@tcm-hub.com) and the account and support emails we send to and receive from you.
What we send them: Your email address and the contents of any email you send to or receive from our support address.
Where they’re based: United States
How long they keep it: Emails stay in the support mailbox until we delete them; Google retains them on its standard schedule.
Questions about this list? Email support@tcm-hub.com.