This page lists the third-party vendors ("subprocessors") that Wren Clinical LLC uses in connection with WrenEHR. It identifies each vendor's role, the data they may access, and their HIPAA Business Associate Agreement (BAA) status.
Amazon Web Services (AWS)
Role: Cloud infrastructure for the entire Platform – AI processing via AWS Bedrock (routing requests to Anthropic's Claude models), the clinician application and APIs (Elastic Container Service, Lambda, API Gateway, load balancing, and web application firewall), databases (Aurora PostgreSQL), file storage (S3), encryption keys (KMS), backups (AWS Backup), queues and scheduling (SQS and EventBridge), email delivery (Simple Email Service), text-message delivery (End User Messaging), telehealth audio and video (Chime SDK), client portal sign-in (Cognito), static content and calendar-feed delivery (CloudFront), monitoring and security services (CloudWatch, CloudTrail, GuardDuty, and Config), and supporting networking, secrets-management, alerting, and deployment services (including EC2, Systems Manager, Secrets Manager, SNS, Elastic Container Registry, and Certificate Manager).
Data Accessed: Protected Health Information (PHI), including Client records, clinical notes, documents, session audio and transcripts, insurance information, messages sent to Clients, and telehealth media, stored and processed in the US East (N. Virginia) Region, with monthly database backups also copied to the US West (Oregon) Region. Calendar feeds may be cached for up to sixty (60) seconds at AWS content-delivery locations in North America and Europe. AI requests are processed in AWS Regions in the United States by default, or in AWS commercial Regions worldwide if a Practice administrator turns off "Keep AI processing in the US."
BAA Status: BAA executed. AWS is covered under a signed HIPAA Business Associate Agreement. Under AWS's terms for Bedrock, prompts and outputs are not used to train AI models and are not shared with Anthropic.
AssemblyAI
Role: Speech-to-text transcription of session audio captured through the in-app recorder (including in telehealth rooms), the Wren Recorder browser extension, or a WrenEHR mobile application, using speaker labels; and real-time transcription of dictation.
Data Accessed: Session audio and the resulting transcripts, and dictation audio, transmitted over TLS and processed in the United States. After a recorded session's transcript is saved, Wren Clinical requests deletion of the transcription job from AssemblyAI. Dictation audio is streamed directly from the user's browser to AssemblyAI and is not stored by Wren Clinical.
BAA Status: BAA executed. AssemblyAI is covered under a signed HIPAA Business Associate Agreement, under which AssemblyAI does not use Customer Data to train AI models.
Stedi
Role: Health care clearinghouse for insurance transactions – eligibility inquiries, professional claims, claim status inquiries, electronic remittance advice, claim acknowledgments, and payer enrollments.
Data Accessed: PHI needed for those transactions, including Client and subscriber names, dates of birth, sex, addresses, relationship to the subscriber, and insurance member and group numbers; other insurance coverage and amounts paid by other payers; diagnosis and procedure codes, places of service, dates of service, charges, prior-authorization numbers, and payer claim numbers; provider names, NPIs, taxonomy codes, and tax identification numbers (which, for a clinician who bills under their own number, may be a Social Security number); and, for enrollments, practice contact names, email addresses, phone numbers, and uploaded enrollment documents.
BAA Status: BAA executed. Stedi is covered under a signed HIPAA Business Associate Agreement.
Stripe
Role: Card payment processing for Practices through Stripe Connect. Each Practice (or clinician) accepts payments on its own Stripe Express account.
Data Accessed: Card details and billing ZIP codes, which the cardholder or Practice staff enter in the browser and which are sent directly to Stripe; payment amounts; and internal Wren Clinical identifiers for the Practice, the Client, and the invoice. When an account is set up, Stripe also receives the Practice's name, the email address of the person setting it up, and a description of the business as an outpatient mental health practice. Wren Clinical does not send Stripe Client names, contact details, diagnoses, service codes, or dates of service. Stripe handles this information under its own privacy policy (stripe.com/privacy).
BAA Status: Not required. Stripe does not offer a HIPAA BAA. Payment information is shared with Stripe within the payment-processing provisions of HIPAA (Section 1179 of the Social Security Act, 42 U.S.C. § 1320d-8), and no clinical content is sent to Stripe.
Clerk
Role: Authentication and identity management for Authorized Users (practice staff), including sign-in, session tokens, and one organization per Practice.
Data Accessed: Authorized Users' names, email addresses, and sign-in credentials, and Practice names; and, when Wren Clinical personnel start a support session through Clerk, the reason they give. Wren Clinical's own staff also sign in to its internal operations console through Clerk. Clients do not sign in through Clerk. Clerk's sign-in script loads on every Platform page, including client portal and telehealth pages, so visitors' browsers connect to Clerk and share standard connection information (such as IP address and browser type); Clerk does not receive Client portal account information or health information.
BAA Status: Not required. Clerk does not create, receive, maintain, or transmit PHI in connection with WrenEHR.
Google (Google Fonts)
Role: Delivery of the web fonts used by the Platform's pages.
Data Accessed: Standard connection information (such as IP address and browser type) from browsers that load Platform pages, including client portal pages. Google does not receive account information or health information.
BAA Status: Not required. Google Fonts does not receive PHI.
Cloudflare
Role: Domain name system (DNS) hosting for wrenclinical.com domains.
Data Accessed: None. Cloudflare answers DNS lookups only; traffic to WrenEHR's application, API, and operations console goes directly to AWS and does not pass through Cloudflare. (The staff sign-in subdomains, such as clerk.ehr.wrenclinical.com, are hosted by Clerk on its own providers.)
BAA Status: Not required. Cloudflare does not create, receive, maintain, or transmit PHI in connection with WrenEHR.
Zoho
Role: Business email for wrenclinical.com addresses, including support@wrenclinical.com and the addresses that send automated messages to Clients.
Data Accessed: Email sent to those addresses, which may include replies from Clients to automated messages and support emails from Practices.
BAA Status: [CONFIRM BEFORE PUBLISHING – see audit finding B4.]
Changes to This List
Wren Clinical may update this list at any time by posting a revised version at ehr.wrenclinical.com/legal/subprocessors. When a change involves a subprocessor that processes PHI, Wren Clinical will notify each Practice's administrators by email or in the Platform. Changes take effect when posted.