Version: 1.0 · Effective date: 2025-06-10 · Review cadence: Annual, and before adding any subprocessor
Regulatory basis: HIPAA Business Associate requirements (45 CFR §164.308(b), §164.314(a), §164.502(e)); SOC 2 Vendor & Subprocessor Management
The third parties (subprocessors) that process customer data in the course of delivering Wellzesta's services. Customers may request the current list at any time.
| Subprocessor | Activity |
|---|---|
| Google Cloud | Cloud hosting; database and database activity logging (Google Cloud SQL); the LLM (Google Gemini) used by the Zesty AI assistant; business intelligence (Google Looker); user analytics (Firebase), storage (Google Cloud Storage); |
| Vimeo | Video storage and distribution |
| Filestack | Image and document storage and distribution |
| Elastic Cloud | Search, including the search index — hosted on Google Cloud |
| Sendgrid by Twilio | Email delivery |
| Sentry | API logging and error monitoring |
| New Relic | Application performance monitoring |
| Zendesk | Customer support and ticket tracking |