Draft v0.1 — not yet published. The list has to be true before it is published. Every row marked "confirm" needs Gerardo to check what is actually wired into production today, and every row needs a signed written agreement behind it before a clinic BAA can be honoured. Drafted 27 August 2026. Not reviewed by a lawyer.
This page lists the third parties Closefly uses to deliver its services and that may handle personal information, and where applicable protected health information, on our clients' behalf. We stay responsible for what they do. We require each of them, by contract, to protect the information to the standard we have accepted, to use it only on our instructions, and where protected health information is involved, to sign a downstream business associate agreement.
We will give clients at least 30 days' notice before adding a new subprocessor that handles patient information, so they can object.
| Provider | What it does for us | Where | Patient data? | Written agreement |
|---|---|---|---|---|
| GoHighLevel (HighLevel Inc.) | CRM, pipelines, conversations, calendars, automations | United States | Yes | Confirm — BAA available on their platform, must be executed |
| LeadConnector / Twilio | Text and voice delivery, phone numbers, A2P 10DLC registration | United States | Yes, message content | Confirm which entity is contracting; BAA required |
| CleverFox / Godubi | AI messaging, lead scoring, and assistant layer, licensed to Closefly | Argentina | Yes | Missing. Licence terms under negotiation; no downstream BAA in place |
| Make.com (Celonis) | Workflow automation between forms, calendar, and CRM | European Union / United States | Yes | Confirm — DPA available, BAA needs checking |
| Typeform | Intake forms and lead capture | European Union | Yes | Confirm — Typeform's free plan does not support a BAA |
| Calendly | Consultation booking | United States | Yes | Confirm — BAA is a paid-plan feature |
| Anthropic and/or OpenAI | Language models used for drafting and classifying replies | United States | Depends on configuration | Confirm — zero-retention and BAA terms must be requested |
| Google Workspace | Email, documents, and file storage | United States | Yes, in email | Confirm — Google offers a BAA under Workspace |
| Netlify and Vercel | Website and blog hosting | United States | No | Standard terms; no patient data |
| Stripe or equivalent | Client billing and card processing | United States | No | Confirm which processor is live |
Open gap
Closefly cannot sign a Business Associate Agreement with a clinic until every provider in this table that touches patient information has signed one with Closefly. The Argentine platform is the hard one: it is the core of the service, it is licensed rather than owned, and there is no downstream agreement in place today. That has to be fixed before the first clinic BAA is signed, not after.
Changes to this list
Clients may subscribe to changes by emailing legal@closefly.ai. We publish the date of the last change at the top of this page.