Last updated: October 2026
These are the vendors that handle data on behalf of Alcove (Alfaaz, LLC). For each one we say what it does, whether it receives patient data, and the basis for its coverage. Recordings, transcripts and notes are processed only on Amazon Web Services. The other vendors below are not intended to receive patient data. If you type patient details into an in-app feedback message, it is redacted automatically and emailed to our team, so please leave patient details out of feedback. See also the Business Associate Agreement and the Privacy Policy.
| Vendor | What it does | Receives patient data? | Coverage basis |
|---|---|---|---|
| Amazon Web Services (United States) | Hosting and storage, speech-to-text (Amazon Transcribe), medical entity detection (Amazon Comprehend Medical), AI note generation (Amazon Bedrock), authentication (Amazon Cognito), logging and alerting. | Yes, for the services that process visit audio, transcripts and notes. Authentication holds account details only. | The AWS Business Associate Addendum, which applies to AWS's HIPAA-eligible services. |
| Anthropic Claude models, through Amazon Bedrock | Generate draft notes from transcripts. The models run inside AWS through Amazon Bedrock. | Yes, as part of the AWS processing above. | Covered with Amazon Bedrock under AWS. Alcove has no separate contract or data transfer with Anthropic. |
| Stripe | Subscription billing and payment processing. | No. Stripe receives a practice contact email, billing address, payment card details and a practice identifier. | No Business Associate Agreement. None is needed because no patient data is sent. |
| Resend | Transactional email: sign-in codes, invitations, billing notices and onboarding reminders. | No. Emails carry recipient addresses, practice names, roles and links, not patient data. | No Business Associate Agreement. None is needed because no patient data is sent. |
| Sentry | Error monitoring that receives technical error reports from the Alcove extension and web app. | No. Error reports are configured to exclude patient data. | Reports are configured to exclude patient data before they are sent. |
| Google Fonts | Delivers web fonts to the Alcove web app and extension pages. | No. Google receives the IP address and browser details of the person loading a page. | No Business Associate Agreement. None is needed because no patient data is sent. |
Questions about this list: privacy@alcove.health.