Third-Party Services
A plain-language summary of platform and integration dependencies. Provider details can change and should be verified before relying on a particular residency, certification, or contractual safeguard.
Current governance status
Base44—not a dedicated ChatGPT connection—handles Calmshell’s built-in AI integration and may route requests to providers that include OpenAI, Anthropic, or Google. Health-related AI remains disabled by default until current vendor terms, data-processing agreements, processing locations, and clinical responsibilities are approved.
Base44
Application platform, authentication, database, functions, hosting, and integrations
Data involved
Account and app data required to operate Calmshell, which can include wellness information
Verification status
Cross-border storage or processing may occur
Base44 AI service providers
Optional AI Companion, progress reflections, assessment reflections, and AI-assisted soundscape ranking
Data involved
Only when AI consent is on: submitted AI messages or minimized wellness data, depending on the feature
Verification status
Health-related AI disabled by default pending governance approval
Stripe (when payments are used)
Payment and billing processing
Data involved
Billing, transaction, and account-contact details needed to process a payment
Verification status
Verify current Calmshell contract and enabled payment flow
Configured communication and media providers
Email, video, SMS, speech, maps, or other optional integrations
Data involved
Feature-specific contact, message, media, voice, or location data
Verification status
Current provider, scope, retention, and DPA must be verified per feature
Required vendor checks
Before a provider processes personal health information, Calmshell should document and approve:
- The legal entity, feature purpose, and minimum data fields.
- Storage, processing, backup, logging, and support locations.
- Retention, deletion, security, breach-notification, and subprocessor terms.
- A signed data-processing agreement and, where applicable, health-data terms.
- User-facing consent, withdrawal, incident response, and vendor-offboarding procedures.
Questions about third-party data processing?
Contact the Privacy Officer: privacy@calmshell.ca