The following sub-processors are engaged by Project Line (קו פרויקטים, Israel business No. 310333984) to provide the Intelligent Clinic Management Platform service. Material changes (addition or replacement) are notified to all clinics 30 days before they take effect.
| Sub-processor | Purpose | Data hosted | Region | Safeguards |
|---|---|---|---|---|
| Microsoft Azure (Microsoft Corp.) | Cloud hosting: App Service, SQL Database, Blob Storage, Key Vault | All clinic + patient records, file attachments, backups | Israel Central by default; other Azure regions per clinic contract | EU SCCs; Azure Data Protection Addendum; ISO 27001/27018; HIPAA-eligible service list |
| OpenAI, L.L.C. | LLM inference for voice agent, chat agent, image OCR | Real-time audio stream (speech-to-speech, not retained), prompts, document/card images | US; EU residency where available | SCCs; OpenAI DPA; zero-retention API tier; no model training on customer data |
| Twilio Inc. | Inbound + outbound voice + SMS; phone-number provisioning | Phone numbers, call routes, SMS bodies | US; EU regions available | SCCs; Twilio DPA; no BAA with Twilio. For US clinics the AI phone assistant and patient SMS are switched off; inbound calls are only bridged to the clinic's own phone, with Twilio acting as a telecommunications conduit — no recording, no AI |
| Stripe Payments Europe Ltd. | Card tokenization, charge, refund (PCI SAQ-A scope) | Tokenized payment methods, payment metadata; no PAN ever stored at processor | EU/UK/US | EU SCCs; Stripe DPA; PCI-DSS Level 1 |
| Meta Platforms Ireland Ltd. | WhatsApp Business Cloud API messaging | Patient phone, template body, delivery status | EU/Ireland | Meta DPA; WhatsApp Business Terms; SCCs for non-EU transfers |
| Google LLC | Google Workspace OAuth — the clinic attaches its own Drive / Gmail | Only what clinic shares; OAuth tokens stored encrypted | EU/US | SCCs; Google Workspace DPA. Optional; clinic opt-in. |
| Microsoft (Azure AD / Microsoft Graph) | Optional clinic OAuth — Outlook / OneDrive | Only what clinic shares; OAuth tokens stored encrypted | EU/US | Microsoft 365 DPA; SCCs. Optional. |
| PayPal Holdings, Inc. | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) | Tokenized payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | EU/UK/US | Optional — clinic opt-in. SCCs; processor DPA; PCI-DSS Level 1. |
| Cardcom Ltd. (Israel) | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) | Tokenized payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | Israel | Optional — clinic opt-in. Israeli PCI-DSS Level 1 acquirer; clinic signs vendor agreement directly with processor. |
| Tranzila Ltd. (Israel) | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) | Tokenized payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | Israel | Optional — clinic opt-in. Israeli PCI-DSS Level 1 acquirer; clinic signs vendor agreement directly with processor. |
| PayPlus Ltd. (Israel) | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) | Tokenized payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | Israel | Optional — clinic opt-in. Israeli PCI-DSS Level 1 acquirer; clinic signs vendor agreement directly with processor. |
| Meshulam Ltd. (Israel) | Card / bank payment processing for clinic-issued invoices (clinic opt-in per processor) | Tokenized payment methods, transaction amount, invoice metadata; no PAN stored at processor (PCI-DSS SAQ-A scope) | Israel | Optional — clinic opt-in. Israeli PCI-DSS Level 1 acquirer; clinic signs vendor agreement directly with processor. |
| GreenInvoice Ltd. (Israel) | Electronic invoice generation for the Israeli tax authority (Heshbonit Mas / חשבונית מס) | Patient name, invoice line items, total, VAT (no clinical content) | Israel | Optional — clinic opt-in. Invoicing provider, not a card acquirer; the clinic signs the vendor agreement directly with the provider. |
| iCount Ltd. (Israel) | Electronic invoice generation for the Israeli tax authority (Heshbonit Mas / חשבונית מס) | Patient name, invoice line items, total, VAT (no clinical content) | Israel | Optional — clinic opt-in. Invoicing provider, not a card acquirer; the clinic signs the vendor agreement directly with the provider. |
| Stedi, Inc. (USA) | US insurance claims clearinghouse (electronic 837P claims, 277 status, 835 remittance) — US clinics only | Claim data: patient demographics, diagnoses (ICD-10), procedures (CPT), amounts | US | Optional — clinic opt-in, US clinics only. The clinic holds its own Stedi account and API key and contracts with Stedi directly; the clinic is responsible for its own HIPAA business associate agreement with Stedi. Claim data leaves the platform only when the clinic submits a claim. |
| Zoho Corporation (Zoho Mail) | Transactional email delivery: notifications to patients and clinics, login codes, invoices | Recipient email address, recipient name, message content | US (zoho.com data center) | EU SCCs; Zoho DPA |
UK and Israel transfer mechanisms. For UK personal data, the EU SCCs listed above are applied together with the ICO's UK Addendum (B1.0) or the UK International Data Transfer Agreement (IDTA); transfers to Microsoft and Twilio may additionally rely on the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge). For Israeli clinics, transfers abroad rest on the recipient's contractual undertakings per Regulation 2(4) of the Privacy Protection (Transfer of Data Abroad) Regulations 5761-2001.
When a sub-processor is added or replaced, Project Line creates a SubProcessorChangeRecord with at least 30-day notice. A broadcast email goes to every clinic. Clinics that object may terminate the Service Agreement before the effective date (DPA §5).
To object to a sub-processor, email support@projectlineil.com before the effective date specified in the notice.
© 2026 Project Line. All rights reserved.