---
title: "Data Flow & Subprocessors"
subtitle: "EMRfi · Version 2026-09"
---

## Data flow, step by step
1. **Provider creates a financing session** (portal or API). Sent to EMRfi: balance amount, provider's reference number, optional patient reference and description. Stored by EMRfi; patient reference encrypted.
2. **Provider delivers the link** to the patient. If sent through EMRfi (text or email), the destination phone/email is stored encrypted and used once. Providers may instead deliver the link through their own systems, in which case EMRfi stores no contact information.
3. **Patient opens the page** at emrfi.com/pay/… in the provider's branding, reads the disclosure, and acknowledges it (recorded with timestamp and IP).
4. **Patient completes payment or financing** on a Stripe-hosted element embedded in the page. The patient chooses a lender (Affirm or Sunbit); application data goes from the patient's browser to Stripe and that lender. EMRfi receives only the outcome.
5. **Funds settle** to the provider's Stripe connected account, then to the provider's bank on Stripe's payout schedule. EMRfi's fee is collected by Stripe as an application fee.
6. **EMRfi notifies the provider** by signed webhook and portal status. The provider posts the payment in its own billing system.

## What never transits EMRfi
Patient names, dates of birth, addresses, government IDs, diagnoses, encounter details, insurance information, card numbers, bank numbers, credit application data, credit decisions.

## Subprocessors (entities that may handle data on EMRfi's behalf)
| Entity | Purpose | Data | Location |
|---|---|---|---|
| DigitalOcean, LLC | Application and database hosting | All EMRfi-held data (encrypted fields as described) | United States |
| MailerSend (MailerLite Ltd.) | Email and SMS delivery of payment links and codes | Destination phone/email, message content (provider name, amount, link) | EU/US |

## Independent recipients (not subprocessors; receive data directly from the patient under their own terms)
| Entity | Purpose |
|---|---|
| Stripe, Inc. | Payment processing, provider verification, payouts |
| Affirm, Inc. | Credit application, decision, and loan servicing |
| Sunbit, Inc. (loans issued by TAB Bank) | Credit application, decision, and loan servicing |

## Retention
Session records (amount, reference, outcome): 7 years. Patient contact fields: purged 30 days after the session resolves. Request logs: 90 days. Backups: 14 days.

## Changes
Subprocessor changes are posted at https://emrfi.com/privacy with 30 days' notice to providers.