GLTrax
Service Providers & Partners
Effective Date: September 22, 2026
This is the complete list of companies GLTrax, LLC shares data with, what each one does, and whether it receives health information. It is published rather than available on request, so you do not have to ask us for it.
1. Service Providers
These companies handle data on our instructions, to run GLTrax. They may only use it to provide their service to us, and not for their own purposes.
| Company | Health data? | Location |
|---|---|---|
| Supabase — privacy terms Database, sign-in and file storage — where your account and everything you log actually lives. Our primary data store. Deleting your account deletes your rows here. | Yes | United States (AWS us-east-1) |
| Amazon Web Services — Bedrock — privacy terms The AI model behind the check-in chat and your weekly summaries. Prompts are not stored by the service and are not used to train any model. We never send your data to a model provider outside AWS. | Yes | United States (us-west-2) |
| Amazon Web Services — Transcribe — privacy terms Turning your voice into text when you speak a check-in instead of typing it. Only the words are kept, on your check-in. No recording is retained, and speaker identification and voice matching are switched off — the credentials involved cannot invoke them at all. | Yes | United States (us-west-2) |
| Amazon Web Services — Location Service — privacy terms Suggesting real street addresses as you type one into the lab order form. Receives only the address text you type, and nothing else — no name, no account identifier, no panel, no medication, no result. Listed as receiving health data even so: a home address entered while ordering a laboratory test is precise location information about someone seeking a health service, which Washington’s My Health My Data Act treats as consumer health data whatever the string itself says. Using our existing AWS provider rather than a mapping vendor is what keeps this inside a boundary you have already been told about. | Yes | United States (us-west-2) |
| Amazon Web Services — SES — privacy terms Sending your reminder, summary and account emails. A weekly summary email contains health information by its nature, so we treat the body of these messages as health data rather than as ordinary mail. | Yes | United States (us-west-2) |
| Amazon Web Services — hosting — privacy terms Running the application itself (ECS Fargate, ECR, Secrets Manager, load balancing). Your data passes through this layer in transit on every request. Nothing is stored here. | Yes | United States (us-west-2) |
| Stripe — privacy terms Subscription billing and lab payments. We never store your card number, and no health information is sent to Stripe. A lab payment carries the amount, not what was tested. | No | United States |
| RevenueCat — privacy terms Managing your subscription when you buy it inside the iOS app. Receives your account identifier and which plan you bought, so we know whether your subscription is active. Apple takes the payment and holds the card details; no health information is sent. | No | United States |
2. Independent Parties
These are not our service providers. Each has its own relationship with you and its own legal obligations, and each decides for itself how it handles your information within those obligations.
| Company | Health data? | Location |
|---|---|---|
| FPK Services LLC d/b/a Analyte Health — privacy terms Fulfilling lab panels you order — the ordering portal, the contracting party, and the route to the performing laboratory. Receives your name, date of birth, address and the panel you chose. They are an independent party, not our processor: results reach us only under the Records Release Authorization you sign. | Yes | United States |
| Wilcrest Medical Group The clinicians who review and sign your laboratory requisition. A HIPAA covered entity, and your clinician for the order. Records they hold are their medical records under their own retention rules — a deletion request to us does not reach them, and you would contact them directly. | Yes | United States |
| Google — privacy terms Sign in with Google, if you choose to use it. Confirms who you are at sign-in and nothing more. If you use email and password instead, Google is not involved at all. | No | United States |
| Google Analytics — privacy terms Counting visits to our public marketing pages and blog. Loads only on the public marketing site and only if you accept cookies. It is not present on any page you reach after signing in, so it never sees a check-in, a chart or a lab result. | No | United States |
3. A Note on Analytics
Analytics runs on our public marketing pages and blog only, and only if you accept cookies. It is not present on any page you reach after signing in, so an analytics or advertising tool does not receive your check-ins, charts, summaries, medications or lab results — not in a URL, not in an event, not in a page title.
Two technical controls hold that boundary rather than convention. Our content security policy names the analytics hosts only on those two marketing sources, so a tag loaded anywhere else in the application fails outright; and an automated check in our build blocks a change that would move the boundary. We name the mechanisms because "enforced in the application" is not something you can verify and these are.
4. Where Your Data Is
GLTrax is offered in the United States only, and is designed to store and process your information in the United States. Every provider in the list above is recorded with a United States location, and we do not intentionally transfer your information abroad for processing as part of the ordinary operation of the Platform.
5. Changes to This List
If we add someone
We update this page before a new provider begins handling your data, not after. If a change materially affects how your health information is handled, we will tell you directly as well.
If you ask us to delete your data
We notify the companies that received the relevant data and instruct them to delete it where applicable. Records held by Wilcrest Medical Group as your clinician are the exception, and the reason is explained in their row above.