Menchi Sub-processors

This page lists every third party that processes patient health information (PHI) on Menchi’s behalf. We update this list whenever it changes and notify Clinic customers at least 30 days before any new sub-processor begins handling their data.

Last updated: 2026-08-13

Sub-processor table

Sub-processor	Role	Country	Data handling	DPA status
Twilio	Telephony. Receives inbound calls and runs the voice session, converting speech to text and text to speech inside Twilio’s own infrastructure.	United States	Live audio in transit only. Calls are not recorded.	In place. Twilio’s Data Protection Addendum forms part of its standard terms and covers Twilio’s own sub-processors.
Deepgram (engaged by Twilio)	Speech-to-text. Converts the caller’s speech into written text within Twilio’s voice session.	United States	Audio in transit only. Menchi holds no direct account or credential with Deepgram.	Covered by Twilio. Deepgram is a published Twilio sub-processor. Zalto has no separate contract with them.
ElevenLabs (engaged by Twilio)	Text-to-speech. Synthesizes Menchi’s spoken replies within Twilio’s voice session.	United States	Response text in transit only. Menchi holds no direct account or credential with ElevenLabs.	Covered by Twilio. ElevenLabs is a published Twilio sub-processor. Zalto has no separate contract with them.
Anthropic	Conversational AI. Processes the call transcript to generate Menchi’s replies.	United States	Anthropic is contractually prohibited from training models on our data. Inputs and outputs are deleted within 30 days.	In place. Anthropic’s DPA is incorporated by reference into its Commercial Terms. A zero-retention agreement is not yet in place.
Fly.io	Hosts the relay that runs the conversation. Receives the call transcript as text and the caller’s phone number.	US company; Menchi’s machine runs in Toronto, Canada	Held in memory for the duration of the call. No PHI is stored on Fly. Fly never receives call audio.	Not yet signed. Fly pre-signs a DPA that Zalto has not yet countersigned.
Vercel	Application runtime. Runs Menchi’s Twilio webhooks and the clinic dashboard.	Canada (Montréal)	Stateless function execution. No PHI persisted in Vercel infrastructure.	In place. Vercel’s DPA becomes binding on acceptance of its terms.
Supabase	Primary storage. Postgres database holding transcripts, bookings and audit logs.	Canada (ca-central-1, Montréal)	Encrypted at rest (AES-256). All stored PHI lives here.	In place. Supabase’s DPA forms part of its Terms of Service; acceptance of the Agreement has the same effect as signing.

On the two rows marked “engaged by Twilio.” Menchi does not hold an account, key or contract with Deepgram or ElevenLabs. Twilio’s voice session performs speech-to-text and text-to-speech inside Twilio’s own infrastructure using these vendors, both of which Twilio publishes on its sub-processor list and covers under its DPA. They are disclosed here because patient speech does reach them, not because Zalto engages them directly.

How PHI flows through these sub-processors

A typical patient call:

Patient dials a clinic’s number. Twilio (US) routes the call.
Twilio converts the caller’s speech to text using Deepgram (US), inside Twilio’s infrastructure.
That text streams to Menchi’s relay on Fly.io, running in Toronto, Canada. Call audio never leaves Twilio.
The relay sends the conversation transcript to Anthropic (US) to generate the reply.
The reply text returns to Twilio, which synthesizes speech using ElevenLabs (US).
The patient hears Menchi’s reply.
Transcript, booking and audit log entries are written to Supabase (Montréal, Canada).
The clinic dashboard, served by Vercel (Montréal, Canada), reads those records.

Net result: the call is never recorded. Speech and transcript text pass through US providers while the call is happening. Everything Menchi runs and everything Menchi stores is in Canada.

Cross-border processing

Menchi is operated by Zalto Inc., a Canadian corporation in Mississauga, Ontario. We acknowledge that some PHI processing occurs in the United States while a call is in progress, and each US-based sub-processor operates under a data protection addendum, with the exception noted in the DPA status column above.

For more on how PHIPA cross-border requirements are met, see our Privacy Policy at trymenchi.com/privacy.

Notification of changes

Material changes to this list (new sub-processors, change in country of processing, removal of an existing sub-processor) are communicated to Clinic customers at least 30 days before they take effect. Clinic customers may object to a new sub-processor on reasonable grounds; objections that cannot be resolved are grounds for termination of the Clinic’s Information Manager Agreement.

Questions

Email menchi@zalto.live with any questions about our sub-processors or how PHI is handled.

Changelog

Version	Date	Change
1.0	2026-04-30	Initial publication
2.0	2026-08-13	Corrected against the running system. Removed OpenAI, which is not used. Added Deepgram and Fly.io, both previously undisclosed. Replaced the “DPA on file” column with verified per-vendor status. Removed the description of a call-recording fetch-and-purge process that was never built; calls are not recorded. Removed the Anthropic zero-retention and ElevenLabs no-retention claims, neither of which is contracted. Corrected the Vercel row after moving the application runtime from Washington, D.C. to Montréal.