Legal
Sub-processors
Effective November 15, 2026 · operated by 1581455 B.C. Ltd. dba WhiteCoat Prep
1. What this document is
DebriefMD is operated by 1581455 B.C. Ltd., doing business as WhiteCoat Prep, at debriefmd.ca and app.debriefmd.ca. A sub-processor is a third party that processes personal information on DebriefMD's behalf. This page lists them, what each one handles and where.
Who receives a coaching note, a summary, a report or a notification is set out once, in section 11 of the Privacy Policy. This page describes the services that carry that information, not the people it is sent to.
2. Amazon Web Services
DebriefMD-controlled hosting, database, storage, queues, transcription and AI
processing are configured in one AWS region: ca-central-1, Montréal, Québec.
AWS is the only infrastructure provider. That statement covers the service
DebriefMD runs. It does not cover a browser or device, which can be wherever
it is used, a downloaded file, or the mailbox an email is delivered to (see
section 4).
Source and redacted material. A recording can contain patient or other identifiers. Amazon Transcribe receives the source audio, before any identifier removal. Identifier removal then runs in three passes on the transcript: a pattern pass, a contextual pass on a language model in Bedrock, then the pattern pass again. The contextual pass therefore receives whatever identifiers the first pattern pass missed. The raw transcript and the redacted transcript are separate records. S3 and the database hold identifiable source audio and raw transcripts until they are deleted, as the table below says. Removal is imperfect, and it does not make an assessment about a named trainee anonymous.
All services below were checked against DebriefMD's infrastructure definitions and application code on 2026-11-01. That check reads our own configuration; it is not an audit of the live AWS account.
| Service | Purpose | Information it handles | Retention |
|---|---|---|---|
| S3 (recordings bucket) | Store uploaded audio | Identifiable source audio: debrief recordings, faculty closing-conversation recordings and demo recordings | Deleted 30 days after capture by a bucket lifecycle rule; prior versions expire a day later |
| S3 (transcripts bucket) | Store transcription output | Raw transcript files from Transcribe, before identifier removal | Deleted after 30 days by a bucket lifecycle rule |
| RDS PostgreSQL 16 | All durable application data | Accounts, profiles, preceptor records, session metadata and consent records; raw transcripts (identifiable) and redacted transcripts; assessments, the copies of reviewed notes a resident shared with their program, reports, narratives, support requests; audit and pipeline logs | As the Privacy Policy section 9 table states for each record. Automated backups are kept 7 days |
| SQS (queue and dead-letter queue) | Trigger and retry processing | File locations, job references and email-feedback events. No recording, transcript or assessment content | 14 days maximum |
| Lambda | Processing workers | Audio, raw and redacted transcripts, assessments, names and email addresses, narrative counts and support-request text, in memory while a job runs | Not stored by the function beyond the job; logs as below |
| ECS Fargate + Application Load Balancer | Run the web application | All request traffic | No access logs are kept at the load balancer; application logs as below |
| Transcribe | Speech to text | Source audio before identifier removal | Output written to the transcripts bucket above. See "Training and service improvement" below |
| Bedrock (Claude 3 Sonnet) | Language-model processing, six uses listed below | Raw and redacted transcripts, form templates, counts, support-request text | See "Training and service improvement" below |
| SES (Simple Email Service) | Send every DebriefMD email | Recipient names and addresses and the message content listed below. No audio and no transcript | AWS's own sending records; our send log is described in the Privacy Policy |
| SNS (Simple Notification Service) | Route SES bounce and complaint feedback to the processing queue | The bounced or complaining address, message references and mail-system diagnostics | Passed to the queue; not stored by SNS |
| EventBridge | Two schedules: transcription-job completion and the daily scheduled-summary run | Job names, timings and status | Not stored as content |
| CloudWatch Logs | Application and worker logs | Account, session and job identifiers, email addresses in delivery diagnostics, and error details. Error text is passed through the pattern scrub before logging, but logs are not free of personal information | One month; three months for the scheduled-send log |
| KMS (Key Management Service) | Encryption keys | Keys only | Annual rotation |
| Secrets Manager | Credentials and signing secrets | No user content | Until rotated |
| ECR (Elastic Container Registry) | Container images | No user content | Until replaced |
| Certificate Manager | TLS certificates | No user content | Until renewed |
What Bedrock is used for. Each use is one model call with one input:
- Identifier removal (contextual pass): the raw transcript, after the first pattern pass. It can contain identifiers that pass missed.
- Assessment drafting: the redacted transcript with the assessment form template, once per form.
- EPA suggestion, on request: the redacted transcript with the resident's own list of candidate EPA forms.
- Faculty closing-conversation comments: the redacted transcript of a faculty member's closing conversation, with the rotation report's comment boxes, to draft those comments for the faculty member to review.
- Progress narrative, on request: counts computed from a resident's coaching notes. Never a transcript.
- Support reply draft, on request: the subject, message and attached technical details of a support request, to draft a reply for support staff to edit. Nothing is sent automatically.
Privacy Policy section 16 describes how these outputs are reviewed by a person before they are used.
What SES carries. Sign-in links and email-change confirmations; coaching-note copies a resident chooses to send (the reviewed PDF, plus the resident's own self-rating in their own copy only, and for a preceptor the links described in the Privacy Policy); assessment-ready notifications and digests (resident name, preceptor, rotation and date, no note content); summaries a resident sends or schedules, and the notice when a scheduled send is skipped; policy-change notices; support-request status notices; and internal notices to our own inbox carrying a reference number and category only. No email carries audio or a transcript. Which recipient gets which message is in Privacy Policy section 11.
Encryption and access. The database, both storage buckets, secrets and the container registry are encrypted with a customer-managed KMS key with annual rotation. The queue uses AWS-managed encryption. Object storage blocks public access and requires TLS. The database has no public address.
Region of model processing
Bedrock is configured for direct, on-demand invocation of a model in
ca-central-1, not through a cross-region inference profile. Newer models in
that region are offered only through cross-region inference, which can route
content outside Canada, so the model in use is a residency choice. The region
is fixed in code rather than read from configuration. A regional endpoint is
not, on its own, proof of where processing happens; this is the configuration
we have set, and we have not independently verified AWS's processing location.
Any change of model is reviewed for region, provider terms and retention, and
for any notice the change requires, before it is switched on.
Training and service improvement
Bedrock and Transcribe are governed by different AWS terms and settings, and a statement about one is not a statement about the other.
Bedrock. AWS publishes these commitments in its Bedrock FAQ (https://aws.amazon.com/bedrock/faqs/): "No, AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models"; "Users' inputs and model outputs are not shared with any model providers"; and "Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock". The data-protection guide states the mechanism: "Because the model providers don't have access to those accounts, they don't have access to Amazon Bedrock logs or to customer prompts and completions" (https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html). These were read on 2026-08-14. They are AWS's published statements. They support, but do not replace, review of the agreement that applies to our account.
Transcribe. AWS's default for its AI services is that "AWS AI services may use and store customer content for service improvement, such as fixing operational issues, evaluating service performance, debugging, or model training. For this purpose, we might store such content in an AWS Region outside of the AWS Region where you are using the service. You can opt out of use of your content for service improvement by using the AWS Organizations opt-out policy" (https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out.html). Transcribe is on AWS's list of services that policy covers (https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out_all.html); Bedrock is not on that list. The AI services opt-out policy has been applied to the AWS organization that holds DebriefMD's account since 2026-08-14. We have not yet confirmed its effective scope for the account in use. AWS states that opting out also deletes content already stored for service improvement, with the limit that "this deletion is limited to content stored that is not required to provide service functions."
Agreement status
AWS states that its Data Processing Addendum is incorporated into the AWS Service Terms and applies to customer data processed through AWS. Which AWS entity, terms version and addenda apply to DebriefMD's account is still being confirmed: (aws agreement status, to be confirmed). AWS's FAQs and documentation describe how it handles content; they are not a substitute for that contractual review.
A comment in our infrastructure code describes a storage bucket as "BAA-covered". A Business Associate Addendum is a US HIPAA instrument. Whether one is in place has not been confirmed, and having one would not establish compliance with Canadian privacy law.
3. Google
Google Analytics is paused. No analytics script loads and no analytics request is sent, including for anyone who previously opted in. A saved opt-in preference may remain in your browser but has no effect. If analytics is turned on again it could process technical usage information outside Canada, and we will update this page and the cookie notice, and offer the choice, before it collects anything. It has never received recordings, transcripts or assessment content. See the cookie notice for the browser-storage detail.
Sign in with Google is switched off. The sign-in option is not available and the provider is not registered in the application. Accounts that once linked a Google sign-in keep that historical link record, which is not used to sign anyone in. Sign-in today is by an emailed link, sent through SES. Any future sign-in provider will be listed here before it is turned on.
Fonts are not a Google flow. Typefaces are downloaded when the application is built and served from DebriefMD's own hosting, so loading a page makes no request to Google Fonts or any other font host.
4. Recipients outside this list
An email leaves SES for the recipient's mail provider. Sending from Montréal does not determine where that mailbox stores the message, and an institution or program may route mail through its own systems. A downloaded file is on the device that saved it. A browser can be used anywhere. These recipients, mail providers, institutional systems and devices are outside the hosting statement in section 2. They are not DebriefMD's sub-processors: DebriefMD does not contract them to process information on its behalf, and their own terms govern what they do with what they receive.
5. Selection and oversight
Before engaging a sub-processor we consider whether the data can be kept in Canada, the contractual commitments on retention and training, whether encryption at rest and in transit is available under our own keys, and the provider's security posture.
DebriefMD does not yet run a formal, documented, recurring sub-processor review, and the evidence gaps stated above (the AWS agreement status and the effective scope of the Transcribe opt-out) are still open. A material change of supplier, purpose, location or access is versioned on this page and notified before or at its effective date, with any fresh consent or institutional authorization the law requires.
6. Questions
Questions go to DebriefMD's privacy officer role at hello@debriefmd.ca.
hello@debriefmd.ca
Questions?
Email hello@debriefmd.ca and a person will answer, whether it is about this document or about your own data.