GLTrax
Service Providers & Partners
Effective Date: August 17, 2026
This is the complete list of companies GLTrax, LLC shares data with, what each one does, and whether it receives health information. It is published rather than available on request, so you do not have to ask us for it.
1. Service Providers
These companies handle data on our instructions, to run GLTrax. They may only use it to provide their service to us, and not for their own purposes.
| Company | Health data? | Location |
|---|---|---|
| Supabase — privacy terms Database, sign-in and file storage — where your account and everything you log actually lives. Our primary data store. Deleting your account deletes your rows here. | Yes | United States (AWS us-east-1) |
| Amazon Web Services — Bedrock — privacy terms The AI model behind the check-in chat and your weekly summaries. Prompts are not stored by the service and are not used to train any model. We never send your data to a model provider outside AWS. | Yes | United States (us-west-2) |
| Amazon Web Services — Transcribe — privacy terms Turning your voice into text when you speak a check-in instead of typing it. Only the words are kept, on your check-in. No recording is retained, and speaker identification and voice matching are switched off — the credentials involved cannot invoke them at all. | Yes | United States (us-west-2) |
| Amazon Web Services — SES — privacy terms Sending your reminder, summary and account emails. A weekly summary email contains health information by its nature, so we treat the body of these messages as health data rather than as ordinary mail. | Yes | United States (us-west-2) |
| Amazon Web Services — hosting — privacy terms Running the application itself (ECS Fargate, ECR, Secrets Manager, load balancing). Your data passes through this layer in transit on every request. Nothing is stored here. | Yes | United States (us-west-2) |
| Stripe — privacy terms Subscription billing and lab payments. We never store your card number, and no health information is sent to Stripe. A lab payment carries the amount, not what was tested. | No | United States |
| RevenueCat — privacy terms Managing your subscription when you buy it inside the iOS app. Receives your account identifier and which plan you bought, so we know whether your subscription is active. Apple takes the payment and holds the card details; no health information is sent. | No | United States |
2. Independent Parties
These are not our service providers. Each has its own relationship with you and its own legal obligations, and each decides for itself how it handles your information within those obligations.
| Company | Health data? | Location |
|---|---|---|
| FPK Services LLC d/b/a Analyte Health — privacy terms Fulfilling lab panels you order — the ordering portal, the contracting party, and the route to the performing laboratory. Receives your name, date of birth, address and the panel you chose. They are an independent party, not our processor: results reach us only under the Records Release Authorization you sign. | Yes | United States |
| Wilcrest Medical Group The clinicians who review and sign your laboratory requisition. A HIPAA covered entity, and your clinician for the order. Records they hold are their medical records under their own retention rules — a deletion request to us does not reach them, and you would contact them directly. | Yes | United States |
| Google — privacy terms Sign in with Google, if you choose to use it. Confirms who you are at sign-in and nothing more. If you use email and password instead, Google is not involved at all. | No | United States |
| Google Analytics — privacy terms Counting visits to our public marketing pages and blog. Loads only on the public marketing site and only if you accept cookies. It is not present on any page you reach after signing in, so it never sees a check-in, a chart or a lab result. | No | United States |
3. A Note on Analytics
Analytics runs on our public marketing pages and blog only, and only if you accept cookies. It is not present on any page you reach after signing in. Your check-ins, charts, summaries, medications and lab results are never seen by an analytics or advertising tool — not in a URL, not in an event, not in a page title. This is enforced in the application itself and by our content security policy, not left to convention.
4. Where Your Data Is
Everything is stored in the United States. GLTrax is offered in the United States only, and we do not transfer your information abroad for processing.
5. Changes to This List
If we add someone
We update this page before a new provider begins handling your data, not after. If a change materially affects how your health information is handled, we will tell you directly as well.
If you ask us to delete your data
We notify every company on this list that received it, instructing them to delete it too. Records held by Wilcrest Medical Group as your clinician are the exception, and the reason is explained in their row above.