Last updated: 2026-08-22
This registry states which routes are approved for which data. Availability in a provider or gateway catalogue is not approval. "Blocked for health" means no health or other special-category data may be sent through that route.
Vercel's standard AI Product Terms prohibit health information in AI inputs, and Vercel's standard DPA prohibits sensitive and special-category Customer Data. Because the current application is hosted on Vercel, health-data production launch is blocked until Vercel gives written contractual permission for the exact hosting and Gateway flows or the health-data handling architecture moves to a contractually suitable service.
Zero Data Retention reduces retention. It does not override this prohibition.
| Service | Purpose | Current status for Member health data | Key conditions |
|---|---|---|---|
| Vercel hosting | Application delivery and server execution | Blocked pending written amendment or architecture change | Standard DPA currently prohibits sensitive and special-category Customer Data |
| Vercel AI Gateway | AI routing and inference access | Blocked | Standard AI Product Terms prohibit health information in inputs; ZDR does not change that |
| Anthropic | Chat, extraction, and utility AI | Not approved until the exact account terms, DPA, retention, transfer, and model route are recorded | Business API route only; no training; required retention control |
| OpenAI | Chat, embeddings, and transcription | Not approved until the exact account terms, DPA, retention, transfer, and route are recorded | Business API route only; no training; required retention control |
| Google Gemini | Chat and utility AI | Not approved until the exact service tier, DPA, retention, transfer, and route are recorded | Paid enterprise or API terms appropriate to the data |
| Moonshot AI or Kimi | Chat and utility AI | Blocked for health | No approved health-data transfer assessment is on file |
| xAI | Chat | Not approved until the exact account terms, DPA, retention, transfer, and route are recorded | Business API route only; no training; required retention control |
| Composio | Connected app tools | Blocked for health until its contract, subprocessors, permissions, retention, and transfers are reviewed | Tool-specific least privilege required |
| Exa | Web and research retrieval | General public queries only | Do not include personal or health data in search queries |
| Configured MCP servers | Coach-selected tools | Unapproved by default | Each server needs a named operator, purpose, permissions, DPA, retention, and transfer review |
| Service | Purpose | Typical location or transfer | Current control |
|---|---|---|---|
| Supabase | Database, authentication, and storage | Primary project region configured in Ireland | Project contract, RLS, encryption, backup schedule, and DPA evidence required |
| Vercel | Hosting and Web Analytics | International, including United States | Health-data contract gate above |
| Sentry | Error and performance diagnostics | International, including United States | Do not deliberately log prompt content, secrets, or health records |
| Stripe | Payments | International, including United States | Card data handled by Stripe; payment identifiers stored in platform |
| Resend | Transactional email | International, including United States | Send only the minimum content needed for the message |
| Telegram | Optional member messaging and files | International | Coach must disclose it; no health use until contract and transfer review is complete |
| Unipile | Optional messaging and social sync | Provider-dependent | Only enabled accounts and permissions; health use blocked by default |
| Apify | Optional public content statistics | EU and United States depending on route | Public or non-sensitive content only |
| Google Workspace | Optional Gmail, Calendar, and Drive tools | Provider-dependent | User-authorised scopes; least privilege; tool output can enter AI context |
| Wispr or configured transcription connector | Optional voice workflow | Provider-dependent | Not approved for health until contract and retention review is recorded |
| Operator subscription relay | Owner-only plain-text AI through a locally signed-in consumer subscription | Provider-dependent | Disabled unless a separate documented contract review approves the exact non-Member data and use; never for Member data |
Before any route changes from blocked or not approved to approved, the operator records:
Stealth, secret, prerelease, beta, and unreviewed models are prohibited from processing personal data. New providers are disabled until approved. A cheaper fallback may be used only if it has the same or stronger approved privacy class for the data in that request.