Sub-processors
MyoMed Prep LLC self-hosts its platforms on its own hardware, so this list is short. Some of it is conditional — a couple of entries apply only when a feature is switched on. We publish it because institutional buyers and their counsel need it before they can proceed, and because a list that is honest about what is not used is worth more than one that is vague about what is.
Origin network protection is first-party, not a sub-processor. A next-generation firewall
(Protectli Vault running OPNsense) sits in front of the self-hosted rack and is the perimeter
of record. Cloudflare, where used, is public DNS, TLS termination, and an optional outbound
Tunnel for reachability. It is not the origin firewall, not a WAF-of-record, and not the sole
network control. The Tunnel is an optional Compose profile in this repository
(cloudflared, profile tunnel); public sites may also be published
through a local reverse proxy behind that same firewall.
1. Current sub-processors
| Cloudflare, Inc. | Public DNS, TLS termination, and optional Cloudflare Tunnel ingress. Processes traffic metadata and content in transit — IP address, request headers, and the encrypted payload of requests that pass through Cloudflare to our servers. Does not store your learning data. Does not operate the origin firewall. United States. Applies when the operator uses Cloudflare for public DNS, TLS, or Tunnel reachability. |
|---|---|
| Stripe, Inc. | Payment processing and subscription billing. Receives your email address and payment details, which you enter on pages Stripe hosts — card numbers never reach MyoMed Prep systems and we never store them. Stripe is an independent controller for its own fraud-prevention and regulatory purposes. United States. Applies only if you subscribe; free and trial accounts involve no payment processor. |
| Resend, Inc. (transactional email relay) | Delivery of account email — password resets, address verification, and material policy notices. Receives your email address and the contents of that message. It is not used for marketing, because we do not send any. Applies only to accounts that trigger such an email. |
2. Conditional, and off unless configured
| Encrypted backup storage | Off-site backup. Where an operator configures a remote backup target, database dumps are encrypted with a passphrase before leaving our hardware, so the storage provider holds ciphertext and cannot read its contents. Not enabled by default. |
|---|
3. What is deliberately absent
- No advertising or analytics networks. No Google Analytics, no advertising pixels, no data brokers. Nothing on our pages tracks you across other sites.
- No cloud hosting provider for your learning data. Accounts, progress, attempts, notes and readiness results live on hardware we own and administer.
- No hosted AI provider for the learner tutor. A tutor turn stays on MyoMed Prep hardware and is not sent to Ollama Cloud or any other hosted model. Operator-side authoring or batch tools, if used at all, never receive learner tutor turns. Member sessions are described in the Synapsis AI Privacy Policy.
- RadMatrix has no sub-processors at all in its default mode. It is local-first: your image library and reports stay in your own browser, and a self-hosted DICOM server, where used, is one you operate. See the RadMatrix privacy policy inside that application.
4. Changes to this list
We will update this page before a new sub-processor begins processing personal data, and institutional customers under a written agreement will be notified in advance as that agreement requires. To be told when this page changes, write to contact.admin@myomedprep.org.
Company details
| Legal entity | MyoMed Prep LLC |
|---|---|
| Entity type | Limited liability company |
| State of organization | Montana, United States |
| Mailing address | 1827 11th Ave, Unit #2170, Helena, Montana 59601, United States |
| Governing law | State of Montana, United States |
| General & legal contact | contact.admin@myomedprep.org |
| Phone | (240) 405-5475 |
| Copyright agent | DMCA designated agent |