This register is provided for transparency. The Business Associate Agreement status of each PHI-handling subprocessor is confirmed in the applicable customer agreement; confirm the current list before public launch.
Subprocessor Register
This page lists the third-party service providers MyJourney uses to operate the service. Core data stores — the PostgreSQL database, Redis cache, and MQTT broker — are self-hosted by MyJourney on the infrastructure below and are not separate third parties. Additional customer-specific subprocessors may be identified in applicable agreements.
| Subprocessor | Purpose | Data / PHI posture | Location |
|---|---|---|---|
| Akamai / Linode | Cloud hosting, compute, networking, block storage, and backups that run the MyJourney application and database. | Stores PHI, encrypted at rest and in transit. HIPAA Business Associate Agreement pending execution — to be in place before production PHI. | United States |
| Stripe | Organization-paid subscription billing, invoicing, and payment processing. | Receives billing and transaction data only (customer/organization identifiers, amounts, payment metadata). Clinical PHI is not sent to Stripe. | United States |
| xAI (Grok) | AI-assisted coaching and analytics features, only where an Organization enables them. | Off by default. Used only where an Organization explicitly enables AI features; when enabled, only the minimum data needed for that feature is sent. Organizations that have not enabled AI features send no data to this provider. | United States |
| OpenAI | Alternate AI provider for AI-assisted features, only where an Organization enables them. | Off by default. Available as an alternate provider; when explicitly enabled by an Organization, only the minimum data needed for the feature is sent. Not currently the active provider. | United States |
| Email delivery (SMTP) | Transactional email — account provisioning, password resets, and operational notifications. | Message metadata and notification content only; clinical PHI is minimized and not included in email bodies. | United States |
Questions about this register or a specific subprocessor: privacy@rsbbgroup.com.