Subprocessors

Purpose — Core infrastructure including database (Firestore), file storage (Cloud Storage), serverless functions (Cloud Functions), and hosting. All customer data at rest lives here.

Data processed — All Customer Content, conversation logs when enabled, form submissions, leads, support tickets, metadata, and system logs.

Location — US (default)

HIPAA BAA — Signed

Purpose — AI inference only. When a visitor sends a message the query text is processed in real time to generate a response, then immediately discarded. Nothing is stored.

Data processed — Query text only, ephemeral. Zero data retention policy. Never used for model training. No Customer Content or PHI retained by OpenAI at any point.

Location — US

HIPAA BAA — Signed

Purpose — User authentication and identity management for clinic admin accounts. Handles login, session management, MFA, and email OTP verification.

Data processed — Admin name, business email, login events, session tokens. No patient data, no health information, no Customer Content.

Location — US

HIPAA BAA — Not required, no PHI processed

Purpose — Payment processing for subscription billing. Linkd never stores payment card information directly.

Data processed — Billing name and payment details processed and stored by Stripe, not by Linkd. No patient data, no health information.

Location — US

Not applicable — No PHI processed

Purpose — Vector database for semantic search. Customer-uploaded knowledge base documents are converted to vector embeddings and stored here to power chatbot responses.

Data processed — Vector embeddings of Customer Content only. No patient data, no conversation content, no personal health information.

Location — US

HIPAA BAA — Not required, no PHI processed