Subprocessors
Last updated August 27, 2026
LumaGen is operated by Helix Reserve LLC. These are the vendors that may process protected health information on our behalf, what each one does, and what it can see.
Every vendor on this list has signed a business associate agreement with Helix Reserve. The clinic signs with Helix Reserve; Helix Reserve signs with each subprocessor, so there is one entity on both sides of the chain with no exceptions.
This page is referenced by our Business Associate Agreement and forms part of it. We give thirty days' notice before a new subprocessor with access to protected health information begins processing, by email to your administrative contact and by updating this page. If you object on reasonable grounds, we will discuss it, and if it cannot be resolved you may end your subscription without penalty.
| Vendor | What it does | What it can see | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | All patient records, pedigrees, decisions, results and executed agreements | United States |
| Vercel | Application hosting | Patient data in transit, as part of requests and responsesData passes through in the course of serving the application; Vercel does not store it. | United States |
| Anthropic | Family-history extraction and drafting | Intake transcripts and draft summariesThirty-day retention under our agreement, with training on our data prohibited and human review of it prohibited. | United States |
| Retell | Voice intake: telephony and transport | Call audio and transcripts during an intake call | United States |
| Paubox | Encrypted email delivery | Message contents, including intake reminders sent to patients | United States |
| Google Workspace | Business email and documents | Correspondence with your clinic, where it contains patient information | United States |
Selected but not yet in service
| Vendor | What it does | What it can see | Where |
|---|---|---|---|
| Durable job queue | Background work: guideline sweeps, reminder emails, retries | Patient records touched by scheduled workNo vendor has been selected. When one is, it signs a business associate agreement before it processes anything, and this page is updated with the thirty days' notice described above. | United States |
Questions about this list: legal@helix-reserve.com