Cohera Subprocessor Disclosure and HIPAA Vendor Matrix

Company: Cohera

Document Type: Subprocessor Disclosure & HIPAA Vendor Matrix

Version: 1.1

Purpose and Scope

This document identifies third-party vendors and subprocessors supporting the Cohera platform and is maintained as part of Cohera’s HIPAA compliance program.

Subprocessor Disclosure

• Amazon Web Services (AWS)

Service: Cloud infrastructure hosting and encrypted data storage

HIPAA Status: BAA in place

• Amazon Simple Email Service (Amazon SES), provided by AWS

Service: Transactional and system email delivery

Data: Email address and delivery metadata only

HIPAA Status: HIPAA-eligible service covered by the AWS BAA

• BlackWidow Tech

Service: Application development and technical support

HIPAA Status: Business Associate / subcontractor

HIPAA Vendor Matrix

AWS – Hosting – PHI (Encrypted) – BAA Yes – US

Amazon SES – Email – Limited Identifiers – BAA Yes (AWS BAA) – US

BlackWidow Tech – Development – Limited Access – BAA Yes – US

Governance

Subprocessors are reviewed periodically, and access is limited to minimum necessary.