| Google Cloud (Google LLC and affiliates) | Database, file storage, application servers, encryption-key management and logging | All practice information. Sensitive fields and files are also encrypted with a key unique to the practice. | South Africa (Johannesburg) for the system of record. Some background and email-dispatch services run in Belgium. |
| Google Firebase | Sign-in, push notifications to the Android and iOS apps, and app crash reports | User account details. Notifications contain generic text and record identifiers only, never patient names. Crash reports are designed to exclude patient information. | Google’s global infrastructure, including the United States |
| Google Cloud Vertex AI (Gemini) | Drafting clinical notes, letters and summaries; extracting information from documents and images | Transcripts, clinical context, patient details a clinician chooses to include, patient summaries, and documents being scanned | European Union (Netherlands, Belgium), with the United States as a fallback. Patient Overview summaries may be processed in any region where Google provides the service. |
| Google Cloud Speech-to-Text | Transcribing consultation audio | Consultation audio | European Union, with the United States as a fallback |
| Groq, Inc. | Transcribing consultation audio | Consultation audio | United States, and other countries where Groq or its own sub-processors operate |
| Postmark (ActiveCampaign, LLC) | Sending email | Email addresses and message content, including documents a practice chooses to email (such as letters, invoices, statements and consent certificates), appointment reminders and billing exports | United States |
| Apple Push Notification service | Delivering push notifications to iPhones and iPads | Generic notification text and record identifiers; no patient names | United States |
| MediKredit Integrated Healthcare Solutions | Medical-aid claims and eligibility checks, for practices that use claims | Patient, medical-aid and claim details, including diagnosis and procedure codes | South Africa |
| EMGuidance | Electronic prescribing, for clinicians who connect their EMGuidance account | Patient details needed for a prescription | South Africa |
| Microsoft (Outlook) and Google (Calendar) | Calendar sync, only when a clinician connects their own calendar | Appointment times; appointment details are hidden by default unless the clinician chooses to show them | The calendar provider’s cloud |
| Slack Technologies | Internal operational alerts to the GreenNotes team | Record identifiers only; no patient information or email addresses | United States |