MedPath Subprocessors
Last updated: 1 November 2026
MedPath is operated by MANNA STUDIOS LLC, 30 N Gould St Ste N, Sheridan, WY 82801.
These are the third parties that process data on our behalf. They act on our instructions and may not use your data for their own purposes. The list is derived from every outbound network call in the code, not from memory, and it accompanies our Privacy Policy.
| Processor | Purpose | What reaches them | Location |
|---|---|---|---|
| Supabase | Database, accounts, authentication | All application data and your email address | United States (AWS us-west-2, Oregon) |
| Vercel | Configured application hosting and request handling | Application traffic, request data, operational logs and network metadata | Global delivery network; execution/log locations depend on configuration and provider terms |
| OpenAI | AI coach, paste-to-capture, practice transcription | Feature context: questions, shared drafts/comments, pasted text and recorded audio. The app does not persist audio. | Processing and retention depend on provider terms and endpoint settings |
| Resend | Transactional email and opt-in waitlist updates | Your email address, reminder content, and marketing waitlist audience, optional organization, consent records and subscription preferences | United States |
| Sentry | Error monitoring and sampled tracing | App filters retain bounded diagnostic types, compiled code locations, route classes, status and generated correlation identifiers. Session Replay and structured Sentry logs are disabled; transport/network metadata and provider enrichment remain subject to provider settings. | Configured US ingestion; provider processing/retention subject to account settings and terms |
Not subprocessors
This is the source-configured service inventory, not a guarantee of exclusive US processing or zero provider retention. Audio discarded by the application may still be retained under the transcription provider’s terms. The text AI endpoint is configurable; a change to the actual processor requires review and an inventory update before use. Cloudflare was the former application target; the current build targets Vercel. Historical deployment copies and logs are subject to their provider retention, not erased by changing the build target. Similarly, disabling session recording does not delete prior provider-held recordings, and already-open app versions may keep their earlier settings until reloaded.
Worth stating, because both look like they might be:
- Have I Been Pwned receives the first five characters of a SHA-1 hash when you set a password, and nothing else. Not the password, not a full hash, and nothing identifying you or your account. The service cannot tell which password was checked or who checked it.
- Google Fonts was one until August 2026. Typefaces are now served from MedPath’s own domain, so no visitor information reaches Google.
Changes
We update this page when the list changes. It is the authoritative record of who processes MedPath data.
Questions
Write to Contactmannastudios@gmail.com and we will answer within 30 days.
MANNA STUDIOS LLC 30 N Gould St Ste N Sheridan, WY 82801