Legal
Trust
How Daobook handles the protected health information of a clinic in the United States, and who handles it for us.
The agreement
Every clinic in the United States accepts Daobook's Business Associate Agreement when it opens its account, with the state addenda for California, Washington and Nevada beside it. The agreement says what Daobook may do with protected health information, how it is kept, how a breach is reported, and what happens when a clinic leaves. The clinic's owner can read the accepted version, and download it as a PDF, under Settings → Security → Business Associate Agreement.
How the data is kept is on the data security page.
Subcontractors
A subcontractor creates, receives, keeps or transmits protected health information for Daobook, under a written agreement that binds it to the same restrictions Daobook carries. These are the subcontractors for the US edition.
| Vendor | What it does | What it handles | Where | Agreement |
|---|---|---|---|---|
| Amazon Web Services | Hosting, the database, file storage, backups, encryption keys, logs and monitoring (us-west-2) | Everything Daobook stores: the database, files and backups | United States (Oregon) | Agreement to be in place before the first US clinic |
| Anthropic | The Claude API, through a separate US organization | Clinical text a practitioner sends to an AI feature: Scribe transcripts to notes, note tidying and translation, letters, case summaries | United States | Agreement to be in place before the first US clinic |
| Amazon Transcribe | Speech to text for the Scribe (us-west-2) | Consultation audio and its transcript | United States (Oregon) | Agreement to be in place before the first US clinic |
| AWS End User Messaging | Text messages for US clinics: reminders, confirmations and replies | Mobile numbers, client names, appointment times and the links in messages | United States | Agreement to be in place before the first US clinic |
| Amazon SES | Every email Daobook sends for a US clinic | Client names and addresses, appointment details, invoices and receipts, intake links, letters | United States | Agreement to be in place before the first US clinic |
| Sentry | Error reporting, in a US-stored organization | The error, the page and the record ids only: never request bodies, cookies or clinical text | United States | Agreement to be in place before the first US clinic |
| Empirical Health US | The herbal dispensary that fills prescriptions | What an order needs: the formula, the practitioner and clinic, and what the pharmacy needs to label it | United States | Vendor to be confirmed before the first US clinic |
| Zoho Mail | Daobook's own mailboxes (security@, support@ and privacy@ daobook.health) | What a clinic writes to Daobook support, which can name a patient | Australia | Agreement to be in place before the first US clinic |
Payment processing (Stripe), ops alerts (Slack), the dispensary's store (Shopify) and a practitioner's own calendar are outside this list because no protected health information reaches them; the controls that keep it so are part of Daobook's security programme.
Changes to this list
Daobook gives 30 days' notice before a new subcontractor handles any protected health information, by a dated line here and an email to the owner of every US clinic's account.
- 26 October 2026 — The list as published with the US edition. Nothing has been added since.
Questions
Security and privacy questions go to security@daobook.health; anything else to support@daobook.health.