Effective September 23, 2026 · Version 2026-09-23.1
This list supplements Privacy. It distinguishes providers operating parts of Lessen from independently governed platforms and people you choose. It is not a claim that every party is exclusively a processor or that every feature is already launched.
| Provider or category | Function and relevant information | Status |
|---|---|---|
| Supabase | Database, authentication and server functions; account records, authorized betting and health information, settings, sharing, operational and clinic records | In use; application database region US West (us-west-1) |
| SharpSports | Read-only sportsbook connections; our connection identifier and access/refresh requests; credentials supplied in its own connection flow; sportsbook records returned to Lessen | Integration in use with sandbox testing; production service activation is a separate launch step |
| Anthropic | Les response generation; messages, relevant context and selected summaries | API integration in use; provider operational and safety retention applies |
| Expo and Apple Push Notification service / Google Firebase Cloud Messaging | Notification delivery; device tokens and message content | Used for supported notification features; this is not Firebase Analytics |
| EmailOctopus | Optional launch and product emails; email address and confirmation/delivery status. No assessment answers, scores or patient records | Free account created; integration setup in progress |
| Resend | Sign-in, sharing, operational and clinic decision emails; email addresses, content and delivery information | In use |
| Stripe | Clinician web subscriptions; billing identity, checkout payment information, subscription and transaction status | Live connection configured; sandbox tests are separate from customer transactions |
| Google sign-in | Verified account sign-in and basic profile information selected in the sign-in flow | In use for the portal; phone sign-in setup is separate |
| Apple App Store / Google Play | App distribution and consumer purchase administration; purchase records, platform identifiers and platform diagnostics | Consumer store launch and completed purchase integration pending |
| RevenueCat | Planned coordination of consumer store entitlements; account identifier and subscription events | Not yet enabled for consumer billing; no betting records needed |
| Vercel | Website hosting, request delivery and limited marketing-page analytics; network/request and broad visit information | In use; no marketing analytics on private patient or portal pages |
| Google Fonts | Web font delivery; network and browser request information | In use on web pages |
| jsDelivr | Delivery of the portal's browser authentication library; network and browser request information | In use |
| Google Workspace | Support and company email; correspondence and delivery information | In use |
| Google public DNS resolver | Optional practice-domain TXT check; submitted domain and technical query details | In use for business-control checks; no patient records sent |
| Public provider directories, including NPPES when relevant | Public provider information used in review; submitted public provider identifiers | Optional review source; an NPI is not required for starter access |
Providers may use infrastructure, personnel and permitted subprocessors outside the United States even where the application database is US-hosted. Their own platform functions and legal retention duties are described in their notices. We do not imply that a provider has signed a HIPAA business associate agreement for Lessen merely by listing it here.
Recipients you choose: a support person or clinician receives only information granted through the relevant share. An organization may have independent professional and recordkeeping duties. These recipients are not automatically Lessen's processors.
Research: no external research recipient is currently activated. Any future recipient and purpose must be disclosed through the required program notice, consent and agreement. Researchers, clinics, employer health programs or insurers are not silently authorized to receive individual records by being named as possible categories.
Other disclosures: legally required recipients and a lawful business successor are addressed in Privacy. No advertiser or data broker receives individual health data from Lessen for advertising or resale.
We update this list when material service-provider arrangements change and provide any additional notice or consent the law or a signed agreement requires. For provider questions or contact information relevant to a privacy request, email admin@lessen.app.
Google Ads measurement
Google provides optional advertising measurement on public marketing and policy pages, only after the browser user allows it. This can involve visit, network/device information and measurement cookies. Personalization is disabled; no quiz answers, scores, email addresses or patient records are configured for disclosure. Private product pages and the questionnaire do not load this tag. See Website Storage and Analytics Notice.