On this page
Key points
- Subprocessors are used only where needed to provide, secure, support, or bill the service.
- Primary AI, transcription, and clinical email processing all run in Australia (ap-southeast-2).
- Clinical content is not sent to billing or analytics providers.
- Identifiable patient health information is never used to train AI models.
How to read this list
Each entry names the provider, what it does, the data it may receive, and the processing region. Providers marked as processing outside Australia are secondary or fallback paths, and are called out so a clinic can assess them under Australian Privacy Principle 8.
Miraa may update subprocessors as vendors, infrastructure, regions, or product features change. Material changes affecting clinical data handling will be communicated through a reasonable channel.
AI inference and transcription (Australia)
Amazon Web Services - Amazon Bedrock (ap-southeast-2, Sydney): all AI note generation, document drafting, summarisation, extraction, and assistant features. Data processed may include prompts, transcripts, clinical context, and generated drafts. Miraa invokes models through Australia-only inference profiles and the account is configured for zero data retention, so request and response content is not retained by AWS or shared with the model provider. Miraa operates under an AWS Business Associate Addendum.
Amazon Web Services - Amazon Transcribe and Amazon S3 (ap-southeast-2, Sydney): authoritative batch transcription of consultation and telehealth audio, including speaker diarisation, and storage of the associated audio objects. Data processed includes recorded consultation audio and the resulting transcript text.
AI inference and transcription (outside Australia)
OpenAI (United States): the Whisper transcription fallback used when the Australian batch path is unavailable, plus live telehealth audio chunks and cloud dictation clips where those features are enabled. Data processed may include consultation audio and transcript text. This is a secondary path; clinics requiring Australia-only processing should raise it before rollout.
Google Gemini (United States): retained as a configured alternative model provider for transcript and document processing. Network egress to this provider is currently disabled, so no clinical data is sent to it. It is listed because the configuration exists and would become active if that setting were changed.
Google (United States): where a clinician uses the browser's built-in speech recognition for the live in-consult preview, Chrome transmits that audio to Google's speech service. This preview is not the authoritative transcript. Clinics should treat it as an overseas disclosure and factor it into patient notice.
Hosting, database, storage, and authentication
Supabase (ap-southeast-2, Australia): authentication, database, file storage, row-level access controls, and related backend services. Data processed may include account data, clinic workspace data, patient records, audio objects, transcripts, generated outputs, audit records, and technical logs.
Vercel (syd1, Sydney, for application compute): web app hosting, serverless execution, deployment, performance, and operational logging. Data in transit passes through this layer, and data processed may include request metadata, limited application payloads, technical logs, and service diagnostics.
Patient communication
Resend (United States): delivery of email to patients and next of kin, including after-visit letters and referral letters. Data processed includes recipient email addresses and the clinical content of the letter. Clinics should treat outbound clinical email as an overseas disclosure under Australian Privacy Principle 8 unless they have confirmed an Australian delivery configuration.
An Australian email delivery path using Amazon SES in ap-southeast-2 is implemented in the product and can be enabled per deployment. It is not the default. Clinics that require Australian delivery of clinical email should confirm their configuration with Miraa before rollout rather than assuming it.
Twilio (United States): SMS for appointment confirmations, reminders, and patient messaging where the clinic enables it. Data processed may include patient phone numbers and message content the clinic composes or approves.
ElevenLabs (United States): voice for the AI receptionist where a clinic enables Miraa Connect. Data processed may include patient voice audio and call context.
Billing, analytics, and operations
Stripe (United States): subscription checkout, billing portal, invoices, payment status, tax and payment processing, and webhook events. Clinical content is not sent to Stripe.
Upstash (United States): rate limiting, abuse prevention, and short-lived operational controls. Data processed may include technical identifiers, request metadata, and counters. Clinical content is not sent to Upstash.
PostHog (United States): product analytics. Miraa configures this to exclude clinical content; clinical text, transcripts, and patient identifiers are not sent to PostHog.
Clinic-enabled integrations
These integrations process data only when a clinic enables and authorises them, and only for the clinic that enabled them. Practice management and clinical record systems: Cliniko (Australia), Splose (Australia), Nookal (Australia), MediRecords (Australia), and Epic or Oracle Cerner via FHIR (hosted by the clinic or its health service). Data processed may include patient demographics, appointments, and clinical notes pushed to the clinic's own record system.
Secure clinical messaging: HealthLink (Australia and New Zealand), used to deliver referrals and clinical documents to other providers.
Calendar and productivity: Google Workspace Connected Apps (Gmail, Google Calendar, and Google Contacts), Microsoft Graph, and Apple iCloud CalDAV (United States), used where a clinician or clinic connects them. Google Workspace data may include email and draft content, correspondence metadata, calendar events, attendee details, and contact names or addresses; these sources may contain clinical information. Accounting: Xero (Australia and New Zealand) and Intuit QuickBooks (United States), used for financial workflows and not for clinical content.
Third-party integrations are also governed by the third party's terms, privacy practices, permissions, availability, and security controls. Clinics should review those terms before enabling an integration.
Support and incident handling
Miraa may use support, monitoring, email, or incident-response tools to diagnose issues and communicate with clinics. Support channels should avoid identifiable patient information unless it is necessary, authorised, and handled through an appropriate channel.